Latest Vulnerabilities with Public Exploits

Updated 3h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

371,558 CVEs tracked 55,337 with exploits 5,152 exploited in wild 1,656 CISA KEV 4,275 Nuclei templates 56,399 vendors 49,609 researchers

55,337 results Clear all

CVE-2004-2115 1 PoC Analysis EPSS 0.58

Oracle HTTP Server 1.3.22 - Cross-Site Scripting via isqlplus Parameters

Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.

Dec 31, 2004 STIX 2.1

CVE-2004-2116 1 PoC Analysis EPSS 0.09

Tiny Server 1.1 - Path Traversal

Directory traversal vulnerability in Tiny Server 1.1 allows remote attackers to read or download arbitrary files via a .. (dot dot) in the URL.

Dec 31, 2004 STIX 2.1

CVE-2004-2119 1 PoC Analysis EPSS 0.02

Tiny Server 1.1 - XSS

Cross-site scripting (XSS) vulnerability in Tiny Server 1.1 allows remote attackers to inject arbitrary web script or HTML via the URL.

Dec 31, 2004 STIX 2.1

CVE-2004-2121 1 PoC Analysis EPSS 0.03

Borland Web Server <1.0b3 - Path Traversal

Multiple directory traversal vulnerabilities in Borland Web Server (BWS) 1.0b3 and earlier allow remote attackers to read and download arbitrary files via (1) multi-dot "......" sequences, or (2) "%5c%2e%2e" (encoded "\..") sequences, in the URL.

Dec 31, 2004 STIX 2.1

CVE-2004-2117 1 PoC Analysis EPSS 0.08

Tiny Server 1.1 - DoS

Tiny Server 1.1 allows remote attackers to cause a denial of service (crash) via malformed HTTP requests such as (1) a GET request without the HTTP version (HTTP/1.1), or (2) a request without GET or the HTTP version.

Jan 24, 2004 STIX 2.1

CVE-2004-2099 1 PoC Analysis EPSS 0.04

Need for Speed Hot Pursuit 2.0 <242 - Buffer Overflow

Buffer overflow in Need for Speed Hot Pursuit 2.0 client (NFSHP2), version 242 and earlier, allows remote attackers (servers) to execute arbitrary code via long (1) gamename, (2) gamever, (3) hostname, (4) gametype, (5) mapname or (6) gamemode commands.

Dec 31, 2004 STIX 2.1

CVE-2004-2104 3 PoCs Analysis EPSS 0.12

Novell NetWare Enterprise Web Server 5.1-6.0 - Info Disclosure

Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to obtain sensitive server information, including the internal IP address, via a direct request to (1) snoop.jsp, (2) SnoopServlet, (3) env.bas, or (4) lcgitest.nlm.

Dec 31, 2004 STIX 2.1

CVE-2004-2107 1 PoC Analysis EPSS 0.08

Finjan SurfinGate 6.0 and 7.0 - Unauthenticated Command Execution via FHTTP Commands

Finjan SurfinGate 6.0 and 7.0, when running in proxy mode, does not authenticate FHTTP commands on TCP port 3141, which allows remote attackers to use the finjan-parameter-type header to (1) restart the service, (2) use the getlastmsg command to view log information, or (3) use the online command to force a policy update from the database server.

Dec 31, 2004 STIX 2.1

CVE-2004-2120 1 PoC Analysis EPSS 0.03

reptile_web_server - Denial of Service via Incomplete GET Requests

Reptile Web Server allows remote attackers to cause a denial of service (CPU consumption) via multiple incomplete GET requests without the HTTP version.

Jan 23, 2004 STIX 2.1

CVE-2004-2102 1 PoC Analysis EPSS 0.01

FREESCO 2.05 - Cross-Site Scripting via Test Parameter

Cross-site scripting (XSS) vulnerability in FREESCO 2.05, a modified version of thttpd, allows remote attackers to inject arbitrary web script or HTML via the test parameter.

Dec 31, 2004 STIX 2.1

CVE-2004-0095 1 PoC Analysis EPSS 0.38

McAfee ePolicy Orchestrator - Denial of Service and Possible Remote Code Execution via Invalid HTTP Content-Length

McAfee ePolicy Orchestrator agent allows remote attackers to cause a denial of service (memory consumption and crash) and possibly execute arbitrary code via an HTTP POST request with an invalid Content-Length value, possibly triggering a buffer overflow.

Feb 17, 2004 STIX 2.1

CVE-2004-2094 1 PoC Analysis EPSS 0.02

WebcamXP 1.06.945 - Cross-Site Scripting via URL Parameter

Cross-site scripting (XSS) vulnerability in WebcamXP 1.06.945 allows remote attackers to inject arbitrary HTML or web script as other users via a URL that contains the script.

Dec 31, 2004 STIX 2.1

CVE-2004-2096 1 PoC Analysis EPSS 0.02

mephistoles_httpd 0.6.0 final - Cross-Site Scripting via URL Injection

Cross-site scripting (XSS) vulnerability in Mephistoles httpd 0.6.0 final allows remote attackers to execute arbitrary script as other users by injecting arbitrary HTML or script into the URL.

Dec 31, 2004 STIX 2.1

CVE-2004-2745 1 PoC Analysis EPSS 0.03

Anteco Visual Technologies OwnServer < 1.0 - Path Traversal via URL

Directory traversal vulnerability in Anteco Visual Technologies OwnServer 1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in a URL.

CWE-22 Dec 31, 2004 STIX 2.1

CVE-2004-2748 1 PoC Analysis EPSS 0.05

NetIQ WebTrends Reporting Center Enterprise Edition 6.1a - Information Disclosure via Invalid profileid Parameter

viewreport.pl in NetIQ WebTrends Reporting Center Enterprise Edition 6.1a allows remote attackers to determine the installation path via an invalid profileid parameter, which leaks the pathname in an error message.

CWE-200 Dec 31, 2004 STIX 2.1

CVE-2004-2749 1 PoC Analysis EPSS 0.02

2Wire HomePortal - Path Traversal via Return Parameter

Directory traversal vulnerability in wra/public/wralogin in 2Wire Gateway, possibly as used in HomePortal and other product lines, allows remote attackers to read arbitrary files via a .. (dot dot) in the return parameter. NOTE: this issue was reported as XSS, but this might be a terminology error.

CWE-22 Dec 31, 2004 STIX 2.1

CVE-2004-2127 1 PoC Analysis EPSS 0.04

Web Blog 1.1 - Directory Traversal via File Parameter

Directory traversal vulnerability in Web Blog 1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file variable.

Jan 20, 2004 STIX 2.1

CVE-2004-2754 1 PoC Analysis EPSS 0.02

YaBB SE - SQL Injection via ID_MEMBER Parameter

SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the ID_MEMBER parameter to the (1) recentTopics and (2) welcome functions.

CWE-89 Dec 31, 2004 STIX 2.1

CVE-2004-0067 14 PoCs Analysis EPSS 0.03

phpGedView < 2.65 - Cross-Site Scripting via Multiple Scripts

Multiple cross-site scripting (XSS) vulnerabilities in phpGedView before 2.65 allow remote attackers to inject arbitrary HTML or web script via (1) descendancy.php, (2) index.php, (3) individual.php, (4) login.php, (5) relationship.php, (6) source.php, (7) imageview.php, (8) calendar.php, (9) gedrecord.php, (10) login.php, and (11) gdbi_interface.php. NOTE: some aspects of vector 10 were later reported to affect 4.1.

CWE-79 Feb 17, 2004 STIX 2.1

CVE-2004-2746 1 PoC Analysis EPSS 0.03

Pensacola WEB Designs Xtremeasp Photogallery - SQL Injection

SQL injection vulnerability in adminlogin.asp in XTREME ASP Photo Gallery 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.

CWE-89 Dec 31, 2004 STIX 2.1

Latest Vulnerabilities with Public Exploits

Investigate

Ecosystems

Reference Indexes

Recent Blog Posts

CVEForge Labs

KEV Gaps