CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,621 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
208,453 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-15983 EXP | MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing. | Patch early | 9.8 critical | 2.7% | 2017-10-31 |
| CVE-2017-15984 EXP | Creative Management System (CMS) Lite 1.4 allows SQL Injection via the S parameter to index.php. | Patch early | 9.8 critical | 2.7% | 2017-10-31 |
| CVE-2017-15985 EXP | Basic B2B Script allows SQL Injection via the product_view1.php pid or id parameter. | Patch early | 9.8 critical | 2.7% | 2017-10-31 |
| CVE-2017-15986 EXP | CPA Lead Reward Script allows SQL Injection via the username parameter. | Patch early | 9.8 critical | 2.7% | 2017-10-31 |
| CVE-2017-15988 EXP | Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-2008-6525. | Patch early | 9.8 critical | 2.7% | 2017-10-31 |
| CVE-2017-15989 EXP | Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action. | Patch early | 9.8 critical | 2.7% | 2017-10-31 |
| CVE-2017-15991 EXP | Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter… | Patch early | 9.8 critical | 2.7% | 2017-10-31 |
| CVE-2017-15992 EXP | Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php. | Patch early | 9.8 critical | 2.7% | 2017-10-31 |
| CVE-2017-15993 EXP | Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter. | Patch early | 9.8 critical | 2.7% | 2017-10-31 |
| CVE-2018-7177 EXP | SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-7179 EXP | SQL Injection exists in the SquadManagement 1.0.3 component for Joomla! via the id parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-7312 EXP | SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-22 |
| CVE-2018-7315 EXP | SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, caste, or country parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-22 |
| CVE-2018-7477 EXP | SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parent_module/parent_login.php… | Patch early | 9.8 critical | 2.7% | 2018-02-28 |
| CVE-2018-5970 EXP | SQL Injection exists in the JGive 2.0.9 component for Joomla! via the filter_org_ind_type or campaign_countries parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-5971 EXP | SQL Injection exists in the MediaLibrary Free 4.0.12 component for Joomla! via the id parameter or the mid array parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-5974 EXP | SQL Injection exists in the SimpleCalendar 3.1.9 component for Joomla! via the catid array parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-5975 EXP | SQL Injection exists in the Smart Shoutbox 3.0.0 component for Joomla! via the shoutauthor parameter to the archive URI. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-5978 EXP | SQL Injection exists in Facebook Style Php Ajax Chat Zechat 1.5 via the login.php User field. | Patch early | 9.8 critical | 2.7% | 2018-01-24 |
| CVE-2018-5981 EXP | SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-5982 EXP | SQL Injection exists in the Advertisement Board 3.1.0 component for Joomla! via a task=show_rss_categories&catname= request. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-5983 EXP | SQL Injection exists in the JquickContact 1.3.2.2.1 component for Joomla! via a task=refresh&sid= request. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-5984 EXP | SQL Injection exists in the Tumder (An Arcade Games Platform) 2.1 component for Joomla! via the PATH_INFO to the category/ URI. | Patch early | 9.8 critical | 2.7% | 2018-01-24 |
| CVE-2018-5987 EXP | SQL Injection exists in the Pinterest Clone Social Pinboard 2.0 component for Joomla! via the pin_id or user_id parameter in a task=getlikeinfo action… | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-5990 EXP | SQL Injection exists in the AllVideos Reloaded 1.2.x component for Joomla! via the divid parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-5991 EXP | SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats request, a different vulnerabili… | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-5992 EXP | SQL Injection exists in the Staff Master through 1.0 RC 1 component for Joomla! via the name parameter in a view=staff request. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-5993 EXP | SQL Injection exists in the Aist through 2.0 component for Joomla! via the id parameter in a view=showvacancy request. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-5994 EXP | SQL Injection exists in the JS Jobs 1.1.9 component for Joomla! via the zipcode parameter in a newest-jobs request, or the ta parameter in a view_resu… | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-6004 EXP | SQL Injection exists in the File Download Tracker 3.0 component for Joomla! via the dynfield[phone] or sess parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt