Latest Vulnerabilities with Public Exploits

Updated 4h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

364,075 CVEs tracked 54,961 with exploits 5,098 exploited in wild 1,637 CISA KEV 4,223 Nuclei templates 55,918 vendors 48,528 researchers

54,961 results Clear all

CVE-2014-2227 1 PoC Analysis EPSS 0.02

Ubiquiti Networks UniFi Video <3.0.1 - CSRF

The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVision Controller) before 3.0.1 does not restrict access to the application, which allows remote attackers to bypass the Same Origin Policy via a crafted SWF file.

CWE-264 Jul 25, 2014 STIX 2.1

CVE-2014-4736 1 PoC Analysis EPSS 0.02

blogengine e2 < 2.4 - SQL Injection via note-id Parameter

SQL injection vulnerability in E2 before 2.4 (2845) allows remote attackers to execute arbitrary SQL commands via the note-id parameter to @actions/comment-process.

CWE-89 Jul 24, 2014 STIX 2.1

CVE-2014-9095 1 PoC Analysis EPSS 0.02

Raritan Power IQ <4.2.1 - SQL Injection

Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to license/records.

CWE-89 Nov 26, 2014 STIX 2.1

CVE-2014-3085 1 PoC Analysis EPSS 0.08

IBM Global Console Manager 16 and 32 Firmware < 1.20.0.22575 - Authenticated OS Command Injection via lpres Parameter

systest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the lpres parameter.

CWE-78 Aug 17, 2014 STIX 2.1

CVE-2014-3081 1 PoC Analysis EPSS 0.04

IBM Global Console Manager <1.20.0.22575 Authenticated Arbitrary File Read via prodtest.php

prodtest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote authenticated users to read arbitrary files via the filename parameter.

CWE-200 Aug 17, 2014 STIX 2.1

CVE-2014-3080 1 PoC Analysis EPSS 0.04

IBM Global Console Manager <1.20.0.22575 XSS via KVM CGI or AVCT Alert Key

Multiple cross-site scripting (XSS) vulnerabilities on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to kvm.cgi or (2) the key parameter to avctalert.php.

CWE-79 Aug 17, 2014 STIX 2.1

CVE-2014-5201 1 PoC Analysis EPSS 0.05

Gallery Objects 0.4 - SQL Injection via viewid Parameter

SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter in a go_view_object action to wp-admin/admin-ajax.php.

CWE-89 Aug 12, 2014 STIX 2.1

CVE-2014-4927 1 PoC Analysis EPSS 0.11

ACME micro_httpd - Denial of Service via Long URI in GET Request

Buffer overflow in ACME micro_httpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 routers allows remote attackers to cause a denial of service (crash) via a long string in the URI in a GET request.

CWE-119 Jul 24, 2014 STIX 2.1

CVE-2014-5112 1 PoC Analysis EPSS 0.09

Fonality trixbox - Remote Code Execution via lang Parameter

maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter.

CWE-94 Jul 28, 2014 STIX 2.1

CVE-2014-5111 4 PoCs Analysis NUCLEI EPSS 0.21

Fonality trixbox - Path Traversal via Lang Parameter

Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter to (1) home/index.php, (2) asterisk_info/asterisk_info.php, (3) repo/repo.php, or (4) endpointcfg/endpointcfg.php in maint/modules/.

CWE-22 Jul 28, 2014 STIX 2.1

CVE-2014-5109 1 PoC Analysis EPSS 0.03

Fonality trixbox - SQL Injection via mac Parameter in endpoint_generic.php

SQL injection vulnerability in maint/modules/endpointcfg/endpoint_generic.php in Fonality trixbox allows remote attackers to execute arbitrary SQL commands via the mac parameter in a Submit action.

CWE-89 Jul 28, 2014 STIX 2.1

CVE-2014-5104 4 PoCs Analysis EPSS 0.02

ol-commerce 2.1.1 - SQL Injection via Multiple Parameters

Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) a_country parameter in a process action to affiliate_signup.php, (2) affiliate_banner_id parameter to affiliate_show_banner.php, (3) country parameter in a process action to create_account.php, or (4) entry_country_id parameter in an edit action to admin/create_account.php.

CWE-89 Jul 28, 2014 STIX 2.1

CVE-2014-5100 1 PoC Analysis EPSS 0.02

Omeka < 2.2.1 - Cross-Site Request Forgery

Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new super user account via a request to admin/users/add, (2) insert cross-site scripting (XSS) sequences via the api_key_label parameter to admin/users/api-keys/1, or (3) disable file validation via a request to admin/settings/edit-security.

CWE-352 Jul 25, 2014 STIX 2.1

CVE-2014-4968 8.8 HIGH 1 PoC Analysis EPSS 0.06

Boat Browser 8.0 and 8.0.1 - Remote Code Execution via WebView.addJavascriptInterface

The WebView class and use of the WebView.addJavascriptInterface method in the Boat Browser application 8.0 and 8.0.1 for Android allow remote attackers to execute arbitrary code via a crafted web site, a related issue to CVE-2012-6636.

Feb 12, 2020 STIX 2.1

CVE-2014-9919 6.1 MEDIUM 1 PoC Analysis EPSS 0.01

Bilboplanet 2.0 - Stored Cross-Site Scripting via Fullname Parameter

An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the fullname parameter to signup.php.

CWE-79 May 15, 2019 STIX 2.1

CVE-2014-9918 6.1 MEDIUM 1 PoC Analysis EPSS 0.01

Bilboplanet 2.0 - Stored Cross-Site Scripting via signup.php user_id Parameter

An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the user_id parameter to signup.php.

CWE-79 May 15, 2019 STIX 2.1

CVE-2014-9917 6.1 MEDIUM 1 PoC Analysis EPSS 0.01

Bilboplanet 2.0 - Stored Cross-Site Scripting via Tags Parameter

An issue was discovered in Bilboplanet 2.0. There is a stored XSS vulnerability when adding a tag via the user/?page=tribes tags parameter.

CWE-79 May 15, 2019 STIX 2.1

CVE-2014-9916 6.1 MEDIUM 1 PoC Analysis EPSS 0.01

Bilboplanet 2.0 - Cross-Site Scripting via Tribe Name or Tags Parameter

Multiple cross-site scripting (XSS) vulnerabilities in Bilboplanet 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) tribe_name or (2) tags parameter in a tribes page request to user/ or the (3) user_id or (4) fullname parameter to signup.php.

CWE-79 Feb 24, 2017 STIX 2.1

CVE-2014-7192 1 PoC 1 Writeup Analysis EPSS 0.13

syntax-error <1.1.1 - Code Injection

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.

CWE-94 Dec 11, 2014 STIX 2.1

CVE-2014-9302 1 PoC Analysis EPSS 0.02

Alfresco Community Edition < 5.0.a - Server-Side Request Forgery via CMIS Browser Servlet URL Parameter

Server-side request forgery (SSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS) in Alfresco Community Edition 5.0.a and earlier allows remote attackers to trigger outbound requests via a crafted URI in the url parameter.

Dec 07, 2014 STIX 2.1

Latest Vulnerabilities with Public Exploits

Investigate

Ecosystems

Reference Indexes

Recent Blog Posts

CVEForge Labs

KEV Gaps