CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,413 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-5586 EXP | SQL injection vulnerability in findoffice.php in Check Up New Generation (aka Check New) 4.52, when magic_quotes_gpc is disabled, allows remote attack… | Patch early | 6.8 medium | 0.9% | 2008-12-16 |
| CVE-2008-6165 EXP | SQL injection vulnerability in gestion.php in CSPartner 0.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL comma… | Patch early | 6.8 medium | 0.9% | 2009-02-19 |
| CVE-2012-6047 EXP | Cross-site request forgery (CSRF) vulnerability in X7 Chat 2.0.5.1 and earlier allows remote attackers to hijack the authentication of administrators… | Patch early | 6.8 medium | 0.9% | 2012-11-27 |
| CVE-2009-1409 EXP | SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magic_quotes_gpc is disabled, a… | Patch early | 5.1 medium | 0.9% | 2009-04-24 |
| CVE-2010-0411 EXP | Multiple integer signedness errors in the (1) __get_argv and (2) __get_compat_argv functions in tapset/aux_syscalls.stp in SystemTap 1.1 allow local u… | Patch early | 4.9 medium | 0.9% | 2010-02-08 |
| CVE-2012-0286 EXP | Cross-site request forgery (CSRF) vulnerability in Stoneware webNetwork before 6.0.8.0 allows remote attackers to hijack the authentication of unspeci… | Patch early | 6.8 medium | 0.9% | 2012-01-24 |
| CVE-2007-5458 EXP | SQL injection vulnerability in index.php in the newsletter module 1.0 for KwsPHP, when magic_quotes_gpc is disabled, allows remote attackers to execut… | Patch early | 6.8 medium | 0.9% | 2007-10-14 |
| CVE-2001-0906 EXP | teTeX filter before 1.0.7 allows local users to gain privileges via a symlink attack on temporary files that are produced when printing .dvi files usi… | Patch early | 6.2 medium | 0.9% | 2001-06-22 |
| CVE-2014-2534 EXP | /sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in… | Patch early | 4.9 medium | 0.9% | 2014-03-18 |
| CVE-2009-0831 EXP | SQL injection vulnerability in members.php in the Members CV (job) module 1.0 for PHP-Fusion, when magic_quotes_gpc is disabled, allows remote authent… | Patch early | 6.0 medium | 0.9% | 2009-03-05 |
| CVE-2009-4826 EXP | Cross-site request forgery (CSRF) vulnerability in hosting/admin_ac.php in ScriptsEz Mini Hosting Panel allows remote attackers to hijack the authenti… | Patch early | 6.8 medium | 0.9% | 2010-04-27 |
| CVE-2009-4827 EXP | Cross-site request forgery (CSRF) vulnerability in admin.php in Mail Manager Pro allows remote attackers to hijack the authentication of administrator… | Patch early | 6.8 medium | 0.9% | 2010-04-27 |
| CVE-2009-4828 EXP | Cross-site request forgery (CSRF) vulnerability in administration/admins.php in Ad Manager Pro (aka AdManagerPro) 3.0 allows remote attackers to hijac… | Patch early | 6.8 medium | 0.9% | 2010-04-27 |
| CVE-2009-4849 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to hi… | Patch early | 6.8 medium | 0.9% | 2010-05-07 |
| CVE-2009-4905 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Acc Statistics 1.1 allow remote attackers to hijack the authentication of a… | Patch early | 6.8 medium | 0.9% | 2010-06-25 |
| CVE-2025-10042 EXP | The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 due to insuff… | Patch early | 5.9 medium | 0.9% | 2025-09-17 |
| CVE-2010-0952 EXP | SQL injection vulnerability in index.php in OneCMS 2.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands v… | Patch early | 6.8 medium | 0.9% | 2010-03-10 |
| CVE-2010-1109 EXP | Multiple SQL injection vulnerabilities in index.php in phpMySport 1.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary… | Patch early | 6.8 medium | 0.9% | 2010-03-25 |
| CVE-2008-2484 EXP | SQL injection vulnerability in index.php in Xomol CMS 1.20071213, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL… | Patch early | 6.8 medium | 0.9% | 2008-05-28 |
| CVE-2008-3345 EXP | SQL injection vulnerability in staticpages/easyecards/index.php in MyioSoft EasyE-Cards 3.5 trial edition (tr) and 3.10a, when magic_quotes_gpc is dis… | Patch early | 6.8 medium | 0.9% | 2008-07-28 |
| CVE-2008-3783 EXP | Multiple SQL injection vulnerabilities in index.php in Matterdaddy Market 1.1, when magic_quotes_gpc is disabled, allow remote attackers to execute ar… | Patch early | 6.8 medium | 0.9% | 2008-08-26 |
| CVE-2008-6226 EXP | SQL injection vulnerability in moreinfo.php in Pre Projects PHP Auto Listings Script, when magic_quotes_gpc is disabled, allows remote attackers to ex… | Patch early | 6.8 medium | 0.9% | 2009-02-20 |
| CVE-2008-7058 EXP | Cross-site request forgery (CSRF) vulnerability in BandSite CMS 1.1.4 allows remote attackers to hijack the authentication of administrators and force… | Patch early | 6.8 medium | 0.9% | 2009-08-24 |
| CVE-2009-3321 EXP | SQL injection vulnerability in SaphpLesson 4.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the C… | Patch early | 6.8 medium | 0.9% | 2009-09-23 |
| CVE-2007-0687 EXP | SQL injection vulnerability in i-search.php in Michelle's L2J Dropcalc 4 and earlier allows remote authenticated users to execute arbitrary SQL comman… | Patch early | 6.5 medium | 0.9% | 2007-02-03 |
| CVE-2006-6911 EXP | SQL injection vulnerability in search.asp in Digitizing Quote And Ordering System 1.0 allows remote authenticated users to execute arbitrary SQL comma… | Patch early | 6.0 medium | 0.9% | 2006-12-31 |
| CVE-2014-3854 EXP | Cross-site request forgery (CSRF) vulnerability in admin/addScript.py in Pyplate 0.08 allows remote attackers to hijack the authentication of administ… | Patch early | 6.8 medium | 0.9% | 2014-08-07 |
| CVE-2009-3494 EXP | Multiple SQL injection vulnerabilities in index.php in T-HTB Manager 0.5, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitra… | Patch early | 6.8 medium | 0.9% | 2009-09-30 |
| CVE-2008-0129 EXP | SQL injection vulnerability in starnet/addons/slideshow_full.php in Site@School 2.3.10 and earlier allows remote attackers to execute arbitrary SQL co… | Patch early | 6.8 medium | 0.9% | 2008-01-08 |
| CVE-2008-0678 EXP | SQL injection vulnerability in index.php in BlogPHP 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a page actio… | Patch early | 6.8 medium | 0.9% | 2008-02-12 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt