Latest Vulnerabilities with Public Exploits

Updated 25m ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

369,122 CVEs tracked 55,214 with exploits 5,127 exploited in wild 1,653 CISA KEV 4,257 Nuclei templates 56,233 vendors 49,181 researchers

55,214 results Clear all

CVE-2008-2198 1 PoC Analysis EPSS 0.02

Kmita Tellfriend < 2.0 - Remote Code Execution via htmlcode.php file Parameter

PHP remote file inclusion vulnerability in kmitaadmin/kmitat/htmlcode.php in Kmita Tellfriend 2.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file parameter.

CWE-94 May 14, 2008 STIX 2.1

CVE-2008-2199 1 PoC Analysis EPSS 0.02

Kmita Mail < 3.0 - Remote Code Execution via HTML Code File Parameter

PHP remote file inclusion vulnerability in kmitaadmin/kmitam/htmlcode.php in Kmita Mail 3.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file parameter.

CWE-94 May 14, 2008 STIX 2.1

CVE-2008-2202 3 PoCs Analysis EPSS 0.02

Maian Uploader 4.0 - Stored Cross-Site Scripting via Multiple Parameters

Multiple cross-site scripting (XSS) vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter to upload/admin/index.php in a search action, the (2) msg_charset and (3) msg_header9 parameters to admin/inc/header.php, and the (4) keywords parameter to index.php in a search action.

CWE-79 May 14, 2008 STIX 2.1

CVE-2008-2130 1 PoC Analysis EPSS 0.01

iGaming CMS 1.5 - SQL Injection via poll_vote.php id Parameter

SQL injection vulnerability in poll_vote.php in iGaming CMS 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CWE-89 May 09, 2008 STIX 2.1

CVE-2008-2115 1 PoC Analysis EPSS 0.01

ScriptsEZ.net Power Editor 2.0 - Cross-Site Scripting via te and dir Parameters

Multiple cross-site scripting (XSS) vulnerabilities in editor.php in ScriptsEZ.net Power Editor 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) te and (2) dir parameters in a tempedit action.

CWE-79 May 08, 2008 STIX 2.1

CVE-2008-2116 1 PoC Analysis EPSS 0.03

ScriptsEZ.net Power Editor 2.0 - Path Traversal via te and dir Parameters

Multiple directory traversal vulnerabilities in editor.php in ScriptsEZ.net Power Editor 2.0 allow remote attackers to read arbitrary local files via a .. (dot dot) in the (1) te and (2) dir parameters in a tempedit action.

CWE-22 May 08, 2008 STIX 2.1

CVE-2008-2096 1 PoC Analysis EPSS 0.01

BackLinkSpider - SQL Injection via cat_id Parameter

SQL injection vulnerability in BackLinkSpider allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to a site-specific component name such as link.php or backlinkspider.php.

CWE-89 May 07, 2008 STIX 2.1

CVE-2008-0927 1 PoC Analysis EPSS 0.70

Microsoft Windows-nt - Resource Management Error

dhost.exe in Novell eDirectory 8.7.3 before sp10 and 8.8.2 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with (1) multiple Connection headers or (2) a Connection header with multiple comma-separated values. NOTE: this might be similar to CVE-2008-1777.

CWE-399 Apr 14, 2008 STIX 2.1

CVE-2008-2193 1 PoC Analysis EPSS 0.02

ScorpNews 2.0 - Remote Code Execution via example.php site Parameter

PHP remote file inclusion vulnerability in example.php in Thomas Gossmann ScorpNews 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the site parameter.

CWE-94 May 14, 2008 STIX 2.1

CVE-2008-2180 1 PoC Analysis EPSS 0.01

cpLinks 1.03 - SQL Injection via Admin Username or Search Parameters

Multiple SQL injection vulnerabilities in cpLinks 1.03, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) admin_username parameter (aka the username field) to admin/index.php and the (2) search_text and (3) search_category parameters to search.php. NOTE: some of these details are obtained from third party information.

CWE-89 May 13, 2008 STIX 2.1

CVE-2008-2181 1 PoC Analysis EPSS 0.02

cpLinks 1.03 - Cross-Site Scripting via search_text and search_category Parameters

Multiple cross-site scripting (XSS) vulnerabilities in search.php in cpLinks 1.03 allow remote attackers to inject arbitrary web script or HTML via the (1) search_text and (2) search_category parameters. NOTE: the XSS reportedly occurs in a forced SQL error message. NOTE: some of these details are obtained from third party information.

CWE-79 May 13, 2008 STIX 2.1

CVE-2008-6617 1 PoC Analysis EPSS 0.03

SiteXS CMS 0.1.1 - Unauthenticated Arbitrary File Upload via adm/visual/upload.php

Unrestricted file upload vulnerability in adm/visual/upload.php in SiteXS CMS 0.1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/.

CWE-264 Apr 06, 2009 STIX 2.1

CVE-2008-2175 1 PoC Analysis EPSS 0.01

Gamma Scripts BlogMe PHP 1.1 - SQL Injection via id Parameter

SQL injection vulnerability in comments.php in Gamma Scripts BlogMe PHP 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CWE-89 May 13, 2008 STIX 2.1

CVE-2008-2177 1 PoC Analysis EPSS 0.01

phpDirectorySource 1.1.06 - SQL Injection via lid or login Parameter

Multiple SQL injection vulnerabilities in phpDirectorySource 1.1.06, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) lid parameter to show.php and the (2) login parameter to admin.php.

CWE-89 May 13, 2008 STIX 2.1

CVE-2008-2183 1 PoC Analysis EPSS 0.01

SMartBlog 1.3 - SQL Injection via idt Parameter

SQL injection vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to execute arbitrary SQL commands via the idt parameter.

CWE-89 May 13, 2008 STIX 2.1

CVE-2008-2185 1 PoC Analysis EPSS 0.02

SMartBlog 1.3 - Path Traversal via Page Parameter

Directory traversal vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to include arbitrary local files via directory traversal sequences in the page parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CWE-22 May 13, 2008 STIX 2.1

CVE-2008-6656 1 PoC Analysis EPSS 0.01

Open Auto Classifieds 1.4.3b - SQL Injection via Listings ID Parameter or Login Username Field

Multiple SQL injection vulnerabilities in Open Auto Classifieds 1.4.3b allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to listings.php and (2) the username field to login.php.

CWE-89 Apr 07, 2009 STIX 2.1

CVE-2008-6616 1 PoC Analysis EPSS 0.01

Zen Cart 2008 - Cross-Site Scripting via Advanced Search Keyword Parameter

Cross-site scripting (XSS) vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in the advanced_search_result page. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CWE-79 Apr 06, 2009 STIX 2.1

CVE-2008-6615 1 PoC Analysis EPSS 0.01

Zen Cart 2008 - SQL Injection via Advanced Search Keyword Parameter

SQL injection vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to execute arbitrary SQL commands via the keyword parameter in the advanced_search_result page. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CWE-89 Apr 06, 2009 STIX 2.1

CVE-2008-2192 1 PoC Analysis EPSS 0.04

Itcms - Code Injection

Static code injection vulnerability in box/minichat/boxpop.php in IT!CMS (aka itcms) 1.9 allows remote attackers to inject arbitrary PHP code into box/MiniChat/data/shouts.php via the shout parameter.

CWE-94 May 14, 2008 STIX 2.1

Latest Vulnerabilities with Public Exploits

Investigate

Ecosystems

Reference Indexes

Recent Blog Posts

CVEForge Labs

KEV Gaps