CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,373 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-11
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2014-8773 EXP | MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSR… | Patch early | 6.8 medium | 1.1% | 2014-12-03 |
| CVE-2008-5817 EXP | Multiple SQL injection vulnerabilities in index.php in Web Scribble Solutions webClassifieds 2005 allow remote attackers to execute arbitrary SQL comm… | Patch early | 6.8 medium | 1.1% | 2009-01-02 |
| CVE-2016-3984 EXP | The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333),… | Patch early | 5.1 medium | 1.1% | 2016-04-08 |
| CVE-2007-3214 EXP | SQL injection vulnerability in style.php in e-Vision CMS 2.02 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbit… | Patch early | 6.8 medium | 1.1% | 2007-06-14 |
| CVE-2007-5954 EXP | Cross-site scripting (XSS) vulnerability in buscador.php in JLMForo System allows remote attackers to inject arbitrary web script or HTML via the clav… | Patch early | 6.1 medium | 1.1% | 2007-11-14 |
| CVE-2007-1776 EXP | SQL injection vulnerability in index.php in the DesignForJoomla.com D4J eZine (com_ezine) 2.8 and earlier component for Joomla! allows remote attacker… | Patch early | 6.8 medium | 1.1% | 2007-03-30 |
| CVE-2008-2177 EXP | Multiple SQL injection vulnerabilities in phpDirectorySource 1.1.06, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQ… | Patch early | 6.8 medium | 1.1% | 2008-05-13 |
| CVE-2008-2411 EXP | SQL injection vulnerability in index.php in SazCart 1.5.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 1.1% | 2008-05-22 |
| CVE-2008-3649 EXP | SQL injection vulnerability in categorydetail.php in Article Friendly Standard allows remote attackers to execute arbitrary SQL commands via the Cat p… | Patch early | 6.8 medium | 1.1% | 2008-08-13 |
| CVE-2008-5630 EXP | SQL injection vulnerability in merchants/index.php in Post Affiliate Pro 3 and 3.1.4 allows remote attackers to execute arbitrary SQL commands via the… | Patch early | 6.8 medium | 1.1% | 2008-12-17 |
| CVE-2008-5636 EXP | SQL injection vulnerability in cate.php in Lito Lite CMS, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands… | Patch early | 6.8 medium | 1.1% | 2008-12-17 |
| CVE-2014-2531 EXP | SQL injection vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) before 5.0.14 build 577 a… | Patch early | 6.5 medium | 1.1% | 2014-10-21 |
| CVE-2014-9435 EXP | Multiple SQL injection vulnerabilities in Absolut Engine 1.73 allow remote authenticated users to execute arbitrary SQL commands via the (1) sectionID… | Patch early | 6.5 medium | 1.1% | 2015-01-02 |
| CVE-2012-5865 EXP | SQL injection vulnerability in dispatch.php in Achievo 1.4.5 allows remote authenticated users to execute arbitrary SQL commands via the activityid pa… | Patch early | 6.5 medium | 1.1% | 2014-10-20 |
| CVE-2012-1500 EXP | Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code. | Patch early | 5.4 medium | 1.1% | 2020-02-13 |
| CVE-2019-9556 EXP | FiberHome an5506-04-f RP2669 devices have XSS. | Patch early | 5.4 medium | 1.1% | 2019-12-31 |
| CVE-2013-3098 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in TRENDnet TEW-812DRU router with firmware before 1.0.9.0 allow remote attackers to hijack… | Patch early | 6.8 medium | 1.1% | 2014-02-04 |
| CVE-2012-4252 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to hijack the authentication of administrators… | Patch early | 5.1 medium | 1.1% | 2012-08-13 |
| CVE-2012-1416 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in SocialCMS 1.0.2 allow remote attackers to hijack the authentication of administrators fo… | Patch early | 6.8 medium | 1.1% | 2012-10-08 |
| CVE-2007-5308 EXP | SQL injection vulnerability in galerie.php in PHP Homepage M (phpHPm) 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbit… | Patch early | 6.8 medium | 1.1% | 2007-10-09 |
| CVE-2008-2083 EXP | SQL injection vulnerability in directory.php in Prozilla Hosting Index, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrar… | Patch early | 6.8 medium | 1.1% | 2008-05-05 |
| CVE-2008-2916 EXP | Multiple SQL injection vulnerabilities in Pre ADS Portal 2.0 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitra… | Patch early | 6.8 medium | 1.1% | 2008-06-30 |
| CVE-2008-4897 EXP | SQL injection vulnerability in fichiers/add_url.php in Logz podcast CMS 1.3.1, when magic_quotes_gpc is disabled, allows remote attackers to execute a… | Patch early | 6.8 medium | 1.1% | 2008-11-04 |
| CVE-2008-6805 EXP | Multiple SQL injection vulnerabilities in Mic_Blog 0.0.3, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands… | Patch early | 6.8 medium | 1.1% | 2009-05-11 |
| CVE-2010-3481 EXP | Multiple SQL injection vulnerabilities in login.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allow remote attackers to execute… | Patch early | 6.8 medium | 1.1% | 2010-09-22 |
| CVE-2010-4784 EXP | Multiple SQL injection vulnerabilities in member.php in PHP Web Scripts Easy Banner Free 2009.05.18, when magic_quotes_gpc is disabled, allow remote a… | Patch early | 6.8 medium | 1.1% | 2011-04-07 |
| CVE-2011-0443 EXP | SQL injection vulnerability in inc/tinybb-settings.php in tinyBB 1.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 1.1% | 2011-01-13 |
| CVE-2015-4659 EXP | Cross-site request forgery (CSRF) vulnerability in ClickHeat 1.14 and earlier allows remote attackers to hijack the authentication of administrators f… | Patch early | 6.8 medium | 1.1% | 2015-06-18 |
| CVE-2014-10032 EXP | SQL injection vulnerability in news_popup.php in Taboada MacroNews 1.0 allows remote authenticated users to execute arbitrary SQL commands via the id… | Patch early | 6.5 medium | 1.1% | 2015-01-13 |
| CVE-2000-0552 EXP | ICQwebmail client for ICQ 2000A creates a world readable temporary file during login and does not delete it, which allows local users to obtain sensit… | Patch early | 5.5 medium | 1.1% | 2000-06-06 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt