CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,492 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
150,855 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-4716 EXP | PHP remote file inclusion vulnerability in demarrage.php in Fire Soft Board (FSB) RC3 and earlier allows remote attackers to execute arbitrary PHP cod… | Patch early | 7.5 high | 2.5% | 2006-09-12 |
| CVE-2006-4770 EXP | PHP remote file inclusion vulnerability in menu.php in MiniPort@l 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in t… | Patch early | 7.5 high | 2.5% | 2006-09-13 |
| CVE-2006-2570 EXP | PHP remote file inclusion vulnerability in CaLogic Calendars 1.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS["CLP… | Patch early | 7.5 high | 2.5% | 2006-05-24 |
| CVE-2006-2819 EXP | PHP remote file inclusion vulnerability in Wiki.php in Barnraiser Igloo 0.1.9 and earlier allows remote attackers to execute arbitrary PHP code via a… | Patch early | 7.5 high | 2.5% | 2006-06-05 |
| CVE-2006-3422 EXP | PHP remote file inclusion vulnerability in WonderEdit Pro CMS allows remote attackers to execute arbitrary PHP code via the config[template_path] para… | Patch early | 7.5 high | 2.5% | 2006-07-07 |
| CVE-2017-0412 EXP | An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context… | Patch early | 7.8 high | 2.5% | 2017-02-08 |
| CVE-2006-5311 EXP | PHP remote file inclusion vulnerability in includes/archive/archive_topic.php in Buzlas 2006-1 Full allows remote attackers to execute arbitrary PHP c… | Patch early | 7.5 high | 2.5% | 2006-10-17 |
| CVE-2008-2821 EXP | Directory traversal vulnerability in the FTP client in Glub Tech Secure FTP before 2.5.16 on Windows allows remote FTP servers to create or overwrite… | Patch early | 9.3 high | 2.5% | 2008-06-23 |
| CVE-2008-5175 EXP | Directory traversal vulnerability in the FTP client in AceFTP Freeware 3.80.3 and AceFTP Pro 3.80.3 allows remote FTP servers to create or overwrite a… | Patch early | 9.3 high | 2.5% | 2008-11-19 |
| CVE-2023-23399 EXP | Microsoft Excel Remote Code Execution Vulnerability | Patch early | 7.8 high | 2.5% | 2023-03-14 |
| CVE-2003-1406 EXP | PHP remote file inclusion vulnerability in D-Forum 1.00 through 1.11 allows remote attackers to execute arbitrary PHP code via a URL in the (1) my_hea… | Patch early | 7.5 high | 2.5% | 2003-12-31 |
| CVE-2010-3742 EXP | Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Free Simple CMS 1.0 allow remote attackers to execute arbitrary PHP… | Patch early | 7.5 high | 2.5% | 2010-10-05 |
| CVE-2012-1496 EXP | Local file inclusion in WebCalendar before 1.2.5. | Patch early | 8.8 high | 2.5% | 2020-01-27 |
| CVE-2003-0395 EXP | Ultimate PHP Board (UPB) 1.9 allows remote attackers to execute arbitrary PHP code with UPB administrator privileges via an HTTP request containing th… | Patch early | 7.5 high | 2.5% | 2003-07-02 |
| CVE-2007-0760 EXP | EQdkp 1.3.1 and earlier authenticates administrative requests by verifying that the HTTP Referer header specifies an admin/ URL, which allows remote a… | Patch early | 7.5 high | 2.5% | 2007-02-06 |
| CVE-2008-7069 EXP | All Club CMS (ACCMS) 0.0.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers… | Patch early | 7.5 high | 2.5% | 2009-08-25 |
| CVE-2012-2924 EXP | PHP remote file inclusion vulnerability in admin/setup.inc.php in Hypermethod eLearning Server 4G allows remote attackers to execute arbitrary PHP cod… | Patch early | 7.5 high | 2.5% | 2012-05-21 |
| CVE-2008-6775 EXP | HTC Touch Pro and HTC Touch Cruise vCard allows remote attackers to cause denial of service (CPU consumption, SMS consumption, and connectivity loss)… | Patch early | 7.1 high | 2.5% | 2009-05-01 |
| CVE-2012-1934 EXP | SQL injection vulnerability in admin/country/edit.php in Newscoop before 3.5.5 and 4.x before 4 RC4 allows remote attackers to execute arbitrary SQL c… | Patch early | 7.5 high | 2.5% | 2012-08-27 |
| CVE-2008-2682 EXP | _RealmAdmin/login.asp in Realm CMS 2.3 and earlier allows remote attackers to bypass authentication and access admin pages via certain modified cookie… | Patch early | 7.5 high | 2.5% | 2008-06-12 |
| CVE-2008-3454 EXP | JnSHosts PHP Hosting Directory 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the "adm" cookie value t… | Patch early | 7.5 high | 2.5% | 2008-08-04 |
| CVE-2008-3557 EXP | Free Hosting Manager 1.2 and 2.0 allows remote attackers to bypass authentication and gain administrative access by setting both the adminuser and log… | Patch early | 7.5 high | 2.5% | 2008-08-08 |
| CVE-2008-6279 EXP | RakhiSoftware Price Comparison Script (aka Shopping Cart) allows remote attackers to obtain sensitive information via an invalid PHPSESSID cookie, whi… | Patch early | 7.8 high | 2.5% | 2009-02-25 |
| CVE-2010-3307 EXP | Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Free Simple CMS 1.0 and earlier allow remote attackers to execute ar… | Patch early | 7.5 high | 2.5% | 2010-10-05 |
| CVE-2005-1181 EXP | NOTE: this issue has been disputed by the vendor. PHP remote code injection vulnerability in loader.php for Ariadne CMS 2.4 allows remote attackers t… | Patch early | 7.5 high | 2.5% | 2005-05-02 |
| CVE-2008-1784 EXP | Prozilla Topsites 1.0 allows remote attackers to perform administrative actions via a direct request to (1) addu.php, (2) editu.php, and (3) uidx.php… | Patch early | 7.5 high | 2.5% | 2008-04-15 |
| CVE-2008-6860 EXP | Xigla Software Absolute Poll Manager XE 4.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a c… | Patch early | 7.5 high | 2.5% | 2009-07-14 |
| CVE-2006-3957 EXP | PHP remote file inclusion vulnerability in payment.php in BosDev BosDates allows remote attackers to execute arbitrary PHP code via a URL in the insPa… | Patch early | 7.5 high | 2.5% | 2006-08-01 |
| CVE-2006-4366 EXP | PHP remote file inclusion vulnerability in index.php in RedBLoG 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the root_path p… | Patch early | 7.5 high | 2.5% | 2006-08-26 |
| CVE-2006-5837 EXP | Static code injection vulnerability in chat_panel.php in the SimpleChat 1.0.0 module for iWare Professional CMS allows remote attackers to inject arbi… | Patch early | 7.5 high | 2.5% | 2006-11-10 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt