CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,406 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
12,663 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-3296 EXP | SQL injection vulnerability in view.php in Open Guestbook 0.5 allows remote attackers to execute arbitrary SQL commands via the offset parameter. | Patch early | 7.5 high | 1.3% | 2006-06-29 |
| CVE-2006-3662 EXP | SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter. NOTE: this i… | Patch early | 7.5 high | 1.3% | 2006-07-18 |
| CVE-2006-3959 EXP | SQL injection vulnerability in protect.php in X-Scripts X-Protection 1.10, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrar… | Patch early | 7.5 high | 1.3% | 2006-08-01 |
| CVE-2007-0052 EXP | SQL injection vulnerability in haberdetay.asp in Vizayn Haber allows remote attackers to execute arbitrary SQL commands via the id parameter. | Patch early | 7.5 high | 1.3% | 2007-01-04 |
| CVE-2007-3682 EXP | SQL injection vulnerability in index.php in OpenLD 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. | Patch early | 7.5 high | 1.3% | 2007-07-11 |
| CVE-2008-4524 EXP | SQL injection vulnerability in the "Check User" feature (includes/check_user.php) in AdaptCMS Lite and AdaptCMS Pro 1.3 allows remote attackers to exe… | Patch early | 7.5 high | 1.3% | 2008-10-09 |
| CVE-2018-6222 EXP | Arbitrary logs location in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to change location of log files and be manipulated to exec… | Patch early | 7.8 high | 1.2% | 2018-03-15 |
| CVE-2005-2113 EXP | SQL injection vulnerability in the loginUser function in the XMLRPC server in XOOPS 2.0.11 and earlier allows remote attackers to execute arbitrary SQ… | Patch early | 7.5 high | 1.2% | 2005-07-05 |
| CVE-2004-1330 EXP | Buffer overflow in paginit in AIX 5.1 through 5.3 allows local users to execute arbitrary code via a long username. | Patch early | 7.2 high | 1.2% | 2004-12-31 |
| CVE-2002-1457 EXP | SQL injection vulnerability in search.php for L-Forum 2.40 allows remote attackers to execute arbitrary SQL statements via the search parameter. | Patch early | 7.5 high | 1.2% | 2003-06-09 |
| CVE-2003-0215 EXP | SQL injection vulnerability in bttlxeForum 2.0 beta 3 and earlier allows remote attackers to bypass authentication via the (1) username and (2) passwo… | Patch early | 7.5 high | 1.2% | 2003-05-12 |
| CVE-2007-3000 EXP | Multiple SQL injection vulnerabilities in PHP JackKnife (PHPJK) allow remote attackers to execute arbitrary SQL commands via (1) the iCategoryUnq para… | Patch early | 7.5 high | 1.2% | 2007-06-04 |
| CVE-2006-1683 EXP | SQL injection vulnerability in admin/login.php in Chipmunk Guestbook allows remote attackers to execute arbitrary SQL commands and bypass login authen… | Patch early | 7.5 high | 1.2% | 2006-04-11 |
| CVE-2006-0906 EXP | SQL injection vulnerability in D3Jeeb Pro 3 allows remote attackers to execute arbitrary SQL commands via the catid parameter in (1) fastlinks.php and… | Patch early | 7.5 high | 1.2% | 2006-02-28 |
| CVE-2006-3580 EXP | SQL injection vulnerability in pages.asp in ASP Stats Generator before 2.1.2 allows remote attackers to execute arbitrary SQL commands via the order p… | Patch early | 7.5 high | 1.2% | 2006-07-13 |
| CVE-2005-3875 EXP | Multiple SQL injection vulnerabilities in Enterprise Connector 1.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via the mess… | Patch early | 7.5 high | 1.2% | 2005-11-29 |
| CVE-2005-4064 EXP | Multiple SQL injection vulnerabilities in A-FAQ 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) faqid parameter to faqDspItem… | Patch early | 7.5 high | 1.2% | 2005-12-07 |
| CVE-2005-4408 EXP | Multiple SQL injection vulnerabilities in Miraserver 1.0 RC4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) page par… | Patch early | 7.5 high | 1.2% | 2005-12-20 |
| CVE-2017-18019 EXP | In K7 Total Security before 15.1.0.305, user-controlled input to the K7Sentry device is not sufficiently sanitized: the user-controlled input can be u… | Patch early | 7.1 high | 1.2% | 2018-01-04 |
| CVE-2018-8979 EXP | Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the credentials URI. | Patch early | 8.8 high | 1.2% | 2018-03-25 |
| CVE-2012-0055 EXP | OverlayFS in the Linux kernel before 3.0.0-16.28, as used in Ubuntu 10.0.4 LTS and 11.10, is missing inode security checks which could allow attackers… | Patch early | 7.8 high | 1.2% | 2020-02-19 |
| CVE-2014-4194 EXP | SQL injection vulnerability in zero_transact_article.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL commands via the article_id p… | Patch early | 7.5 high | 1.2% | 2014-07-09 |
| CVE-2014-5192 EXP | SQL injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to execute arbitrary SQL commands via the filter parameter. | Patch early | 7.5 high | 1.2% | 2014-08-07 |
| CVE-2014-8306 EXP | SQL injection vulnerability in the sql_query function in cart.php in C97net Cart Engine before 4.0 allows remote attackers to execute arbitrary SQL co… | Patch early | 7.5 high | 1.2% | 2014-10-16 |
| CVE-2007-1845 EXP | SQL injection vulnerability in show_event.php in the Expanded Calendar (calendar_panel) 2.00 module for PHP-Fusion allows remote attackers to execute… | Patch early | 7.5 high | 1.2% | 2007-04-03 |
| CVE-2007-3646 EXP | SQL injection vulnerability in index.php in FlashGameScript 1.7 and earlier allows remote attackers to execute arbitrary SQL commands via the user par… | Patch early | 7.5 high | 1.2% | 2007-07-10 |
| CVE-2007-4603 EXP | Multiple SQL injection vulnerabilities in index.php in ACG News 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the aid parameter… | Patch early | 7.5 high | 1.2% | 2007-08-31 |
| CVE-2004-1647 EXP | SQL injection vulnerability in Password Protect allows remote attackers to execute arbitrary SQL statements and bypass authentication via (1) admin or… | Patch early | 7.5 high | 1.2% | 2004-08-30 |
| CVE-2000-0763 EXP | xlockmore and xlockf do not properly cleanse user-injected format strings, which allows local users to gain root privileges via the -d option. | Patch early | 7.2 high | 1.2% | 2000-10-20 |
| CVE-2009-3525 EXP | The pyGrub boot loader in Xen 3.0.3, 3.3.0, and Xen-3.3.1 does not support the password option in grub.conf for para-virtualized guests, which allows… | Patch early | 7.2 high | 1.2% | 2009-10-05 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt