CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,394 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
150,845 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2002-1884 EXP | index.php in Py-Membres 3.1 allows remote attackers to log in as an administrator by setting the pymembs parameter to "admin". | Patch early | 7.5 high | 2.7% | 2002-12-31 |
| CVE-2012-5231 EXP | miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted (1) pagename or (2) area variable containing an executable ext… | Patch early | 7.5 high | 2.7% | 2012-10-01 |
| CVE-2014-9115 EXP | SQL injection vulnerability in the rate_picture function in include/functions_rate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x befor… | Patch early | 7.5 high | 2.7% | 2014-12-23 |
| CVE-2009-1949 EXP | import_wbb1.php in Unclassified NewsBoard (UNB) 1.6.4 allows remote attackers to obtain sensitive information via a direct request, which reveals the… | Patch early | 7.8 high | 2.7% | 2009-06-05 |
| CVE-2013-7349 EXP | Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (1) news_id parameter to news/s… | Patch early | 7.5 high | 2.7% | 2014-04-01 |
| CVE-2008-4600 EXP | configure.php in PokerMax Poker League Tournament Script 0.13 allows remote attackers to bypass authentication and gain administrative access by setti… | Patch early | 7.5 high | 2.7% | 2008-10-18 |
| CVE-2008-5873 EXP | Yerba SACphp 6.3 and earlier allows remote attackers to bypass authentication and gain administrative access via a galleta[sesion] cookie that has a v… | Patch early | 7.5 high | 2.7% | 2009-01-08 |
| CVE-2005-0569 EXP | Multiple SQL injection vulnerabilities in PunBB 1.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) language parameter to regis… | Patch early | 7.5 high | 2.7% | 2005-05-02 |
| CVE-2004-2456 EXP | SQL injection vulnerability in index.php in miniBB 1.7f and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter i… | Patch early | 7.5 high | 2.7% | 2004-12-31 |
| CVE-2006-7021 EXP | PHP remote file inclusion vulnerability in manager/tools/link/dbinstall.php in Plume CMS 1.1.3 allows remote attackers to execute arbitrary PHP code v… | Patch early | 7.5 high | 2.7% | 2007-02-15 |
| CVE-2018-12912 EXP | An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/ope… | Patch early | 7.2 high | 2.6% | 2018-06-27 |
| CVE-2007-2565 EXP | Cdelia Software ImageProcessing allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted BMP file. | Patch early | 7.1 high | 2.6% | 2007-05-09 |
| CVE-2008-4644 EXP | hits.php in myWebland myStats allows remote attackers to bypass IP address restrictions via a modified X-Forwarded-For HTTP header. | Patch early | 7.5 high | 2.6% | 2008-10-22 |
| CVE-2008-6099 EXP | PHP remote file inclusion vulnerability in index.php in RPortal 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the… | Patch early | 7.5 high | 2.6% | 2009-02-10 |
| CVE-2002-2019 EXP | PHP remote file inclusion vulnerability in include_once.php in osCommerce (a.k.a. Exchange Project) 2.1 allows remote attackers to execute arbitrary P… | Patch early | 7.5 high | 2.6% | 2002-12-31 |
| CVE-2019-0881 EXP | An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration, aka 'Windows Kernel Elevation of Privilege… | Patch early | 7.8 high | 2.6% | 2019-05-16 |
| CVE-2004-2573 EXP | PHP remote file inclusion vulnerability in tables_update.inc.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to execute arbitrary P… | Patch early | 7.5 high | 2.6% | 2004-12-31 |
| CVE-2005-1117 EXP | PHP remote file inclusion vulnerability in index.php in All4WWW-Homepagecreator 1.0a allows remote attackers to execute arbitrary PHP code by modifyin… | Patch early | 7.5 high | 2.6% | 2005-05-02 |
| CVE-2008-5708 EXP | redirect.php in SlimCMS 1.0.0 does not require authentication, which allows remote attackers to create administrative users by using the newusername a… | Patch early | 7.5 high | 2.6% | 2008-12-24 |
| CVE-2009-4806 EXP | admin/save_user.asp in Digital Interchange Document Library 1.0.1 does not require administrative authentication, which allows remote attackers to rea… | Patch early | 7.5 high | 2.6% | 2010-04-23 |
| CVE-2007-5823 EXP | Directory traversal vulnerability in forum.php in Ben Ng Scribe 0.2 and earlier allows remote attackers to create or overwrite arbitrary files via a .… | Patch early | 7.5 high | 2.6% | 2007-11-05 |
| CVE-2003-1442 EXP | The web administration page for the Ericsson HM220dp ADSL modem does not require authentication, which could allow remote attackers to gain access fro… | Patch early | 7.5 high | 2.6% | 2003-12-31 |
| CVE-2009-3806 EXP | SQL injection vulnerability in feedback_js.php in DedeCMS 5.1 allows remote attackers to execute arbitrary SQL commands via the arcurl parameter. | Patch early | 7.5 high | 2.6% | 2009-10-27 |
| CVE-2014-2008 EXP | SQL injection vulnerability in confirm.php in the mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to execute arbitrary SQL com… | Patch early | 7.5 high | 2.6% | 2014-09-12 |
| CVE-2006-5411 EXP | Unrestricted file upload vulnerability in upload.php for Free Web Publishing System (FreeWPS), possibly 2.11 and earlier, allows remote attackers to u… | Patch early | 7.5 high | 2.6% | 2006-10-20 |
| CVE-2006-5180 EXP | PHP remote file inclusion vulnerability in include/main.inc.php in Sebastian Baumann and Philipp Wolfer Newswriter SW 1.42 and earlier allows remote a… | Patch early | 7.5 high | 2.6% | 2006-10-10 |
| CVE-2006-5433 EXP | PHP remote file inclusion vulnerability in modules/guestbook/index.php in ALiCE-CMS 0.1 allows remote attackers to execute arbitrary PHP code via a UR… | Patch early | 7.5 high | 2.6% | 2006-10-20 |
| CVE-2006-5434 EXP | PHP remote file inclusion vulnerability in p-news.php in P-News 1.16 and 1.17 allows remote attackers to execute arbitrary PHP code via a URL in the p… | Patch early | 7.5 high | 2.6% | 2006-10-20 |
| CVE-2006-5839 EXP | PHP remote file inclusion vulnerability in ad_main.php in PHPAdventure 1.1-Alpha and earlier allows remote attackers to execute arbitrary PHP code via… | Patch early | 7.5 high | 2.6% | 2006-11-10 |
| CVE-2008-2269 EXP | AustinSmoke GasTracker (AS-GasTracker) 1.0.0 allows remote attackers to bypass authentication and gain privileges by setting the gastracker_admin cook… | Patch early | 7.5 high | 2.6% | 2008-05-16 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt