CVE-2015-1054

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 2.9%

from disclosure to weapon0 days

Published on NVDJan 16

1st PoCJan 4

exploitation probability

2.9%top 14% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

Cross-site scripting (XSS) vulnerability in the Games feature in Crea8Social 2.0 allows remote authenticated users to inject arbitrary web script or HTML via the Game Content field in Add Game.

Affected products

n/a · n/a

public PoCs found — 3

exploitdbwww.exploit-db.com/exploits/35691unverified cve_referencepacketstormsecurity.com/files/129816/Crea8Social-2.0-Cross-Site-Scripting.htmlunverified cve_referencewww.exploit-db.com/exploits/35691unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://codecanyon.net/item/crea8social-php-social-networking-platform-v31/9211270 http://codecanyon.net/item/crea8social-php-social-networking-platform-v31/9211270/support http://osvdb.org/show/osvdb/116732 http://packetstormsecurity.com/files/129816/Crea8Social-2.0-Cross-Site-Scripting.html https://exchange.xforce.ibmcloud.com/vulnerabilities/99615 http://www.exploit-db.com/exploits/35691