CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,879 CVEs
1,739 on KEV
17,300 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-10
171,011 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-2302 EXP | Cross-site scripting (XSS) vulnerability in index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to inject arbitrary web scrip… | Patch early | 4.3 medium | 1.7% | 2009-07-02 |
| CVE-2009-3444 EXP | Cross-site scripting (XSS) vulnerability in email.php in e107 0.7.16 and earlier allows remote attackers to inject arbitrary web script or HTML via th… | Patch early | 4.3 medium | 1.7% | 2009-09-28 |
| CVE-2009-4823 EXP | Cross-site scripting (XSS) vulnerability in frontend/x3/files/fileop.html in cPanel 11.0 through 11.24.7 allows remote attackers to inject arbitrary w… | Patch early | 4.3 medium | 1.7% | 2010-04-27 |
| CVE-2011-4540 EXP | Multiple cross-site scripting (XSS) vulnerabilities in AtMail Open (aka AtMail Open-Source edition) 1.04 allow remote attackers to inject arbitrary we… | Patch early | 4.3 medium | 1.7% | 2011-12-01 |
| CVE-2007-4896 EXP | Multiple cross-site scripting (XSS) vulnerabilities in admin/header.php in Toms Gaestebuch 1.01 and earlier allow remote attackers to inject arbitrary… | Patch early | 4.3 medium | 1.7% | 2007-09-14 |
| CVE-2007-5724 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Omnistar Live allow remote attackers to inject arbitrary web script or HTML via (1) the categor… | Patch early | 4.3 medium | 1.7% | 2007-10-30 |
| CVE-2007-6633 EXP | Multiple cross-site scripting (XSS) vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to inject arbitrary web script… | Patch early | 4.3 medium | 1.7% | 2008-01-04 |
| CVE-2007-6641 EXP | Cross-site scripting (XSS) vulnerability in dir.php in milliscripts Redirection allows remote attackers to inject arbitrary web script or HTML via the… | Patch early | 4.3 medium | 1.7% | 2008-01-04 |
| CVE-2003-1506 EXP | Cross-site scripting (XSS) vulnerability in dansguardian.pl in Adelix CensorNet 3.0 through 3.2 allows remote attackers to execute arbitrary script as… | Patch early | 4.3 medium | 1.7% | 2003-12-31 |
| CVE-2005-4306 EXP | Multiple cross-site scripting (XSS) vulnerabilities in SiteNet BBS 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via t… | Patch early | 4.3 medium | 1.7% | 2005-12-17 |
| CVE-2005-4484 EXP | Multiple cross-site scripting (XSS) vulnerabilities in IntranetApp 3.3 and earlier allow remote attackers to inject arbitrary web script or HTML via t… | Patch early | 4.3 medium | 1.7% | 2005-12-22 |
| CVE-2005-2953 EXP | Cross-site scripting (XSS) vulnerability in merchant.mvc in MIVA Merchant 5 allows remote attackers to inject arbitrary web script or HTML via the Cus… | Patch early | 4.3 medium | 1.7% | 2005-09-16 |
| CVE-2005-3512 EXP | Cross-site scripting (XSS) vulnerability in index.php in VUBB alpha rc1 allows remote attackers to inject arbitrary web script or HTML via the t param… | Patch early | 4.3 medium | 1.7% | 2005-11-06 |
| CVE-2005-4671 EXP | Cross-site scripting (XSS) vulnerability in simple-upload-53.php in CityPost Simple PHP Upload 5.3 allows remote attackers to inject arbitrary web scr… | Patch early | 4.3 medium | 1.7% | 2005-12-31 |
| CVE-2002-1683 EXP | Cross-site scripting (XSS) vulnerability in BadBlue Personal Edition 1.7.3 allows remote attackers to execute arbitrary script as other users by injec… | Patch early | 4.3 medium | 1.7% | 2002-12-31 |
| CVE-2002-1702 EXP | Cross-site scripting vulnerability (XSS) in DeltaScripts PHP Classifieds 6.0.5 allows remote attackers to execute arbitrary script as other users via… | Patch early | 4.3 medium | 1.7% | 2002-12-31 |
| CVE-2002-1965 EXP | Cross-site scripting (XSS) vulnerability in Errors.gsl in Imatix Xitami 2.5b4 and 2.5b5 allows remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 1.7% | 2002-12-31 |
| CVE-2002-2171 EXP | Cross-site scripting (XSS) vulnerability in acWEB 1.8 and 1.14 allows remote attackers to insert arbitrary HTML and web script via a URL, possibly via… | Patch early | 4.3 medium | 1.7% | 2002-12-31 |
| CVE-2004-1867 EXP | Cross-site scripting (XSS) vulnerability in guest.cgi in Fresh Guest Book allows remote attackers to inject arbitrary web script or HTML via the Name… | Patch early | 4.3 medium | 1.7% | 2004-12-31 |
| CVE-2004-1913 EXP | Cross-site scripting (XSS) vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to inject arbitrary web sc… | Patch early | 4.3 medium | 1.7% | 2004-12-31 |
| CVE-2004-1996 EXP | Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 1.0 allows remote attackers to inject arbitrary web script via the size tag. | Patch early | 4.3 medium | 1.7% | 2004-05-05 |
| CVE-2004-2094 EXP | Cross-site scripting (XSS) vulnerability in WebcamXP 1.06.945 allows remote attackers to inject arbitrary HTML or web script as other users via a URL… | Patch early | 4.3 medium | 1.7% | 2004-12-31 |
| CVE-2005-1183 EXP | Cross-site scripting (XSS) vulnerability in mvnForum 1.0 RC4 allows remote attackers to inject arbitrary web script or HTML via the Search parameter. | Patch early | 4.3 medium | 1.7% | 2005-05-02 |
| CVE-2018-11403 EXP | DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter. | Patch early | 5.4 medium | 1.7% | 2018-05-24 |
| CVE-2013-4865 EXP | Cross-site request forgery (CSRF) vulnerability in upgrade_step2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to hijack th… | Patch early | 6.5 medium | 1.7% | 2020-01-28 |
| CVE-2008-7117 EXP | eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets (CSS) files via a certain request with t… | Patch early | 5.0 medium | 1.7% | 2009-08-28 |
| CVE-2009-2157 EXP | Multiple SQL injection vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to execute arbitrary SQL commands via (1) the or… | Patch early | 6.5 medium | 1.7% | 2009-06-22 |
| CVE-2007-4522 EXP | Multiple SQL injection vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote authenticated users to execute arbitrary SQL commands vi… | Patch early | 6.0 medium | 1.7% | 2007-08-25 |
| CVE-2007-5218 EXP | Cross-site scripting (XSS) vulnerability in index.php in Don Barnes DRBGuestbook 1.1.13 allows remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 1.7% | 2007-10-05 |
| CVE-2007-5429 EXP | Cross-site scripting (XSS) vulnerability in index.php in Nucleus 3.01 allows remote attackers to inject arbitrary web script or HTML via the archive p… | Patch early | 4.3 medium | 1.7% | 2007-10-12 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt