CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,244 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
151,085 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2005-3952 EXP | SQL injection vulnerability in PHP Labs Top Auction allows remote attackers to execute arbitrary SQL commands via the (1) category and (2) type parame… | Patch early | 7.5 high | 2.5% | 2005-12-01 |
| CVE-2007-2672 EXP | SQL injection vulnerability in index.php in PHP Coupon Script 3.0 allows remote attackers to execute arbitrary SQL commands via the bus parameter in a… | Patch early | 7.5 high | 2.5% | 2007-05-14 |
| CVE-2006-3517 EXP | PHP remote file inclusion vulnerability in stats.php in RW::Download, when register_globals is enabled, allows remote attackers to execute arbitrary P… | Patch early | 7.5 high | 2.5% | 2006-07-11 |
| CVE-2006-3755 EXP | PHP remote file inclusion vulnerability in Include/editor/class.rich.php in FlushCMS 1.0.0-pre2 and earlier allows remote attackers to execute arbitra… | Patch early | 7.5 high | 2.5% | 2006-07-21 |
| CVE-2006-4678 EXP | PHP remote file inclusion vulnerability in News Evolution 3.0.3 allows remote attackers to execute arbitrary PHP code via the _NE[AbsPath] parameter i… | Patch early | 7.5 high | 2.5% | 2006-09-11 |
| CVE-2009-2003 EXP | Ascad Networks Password Protector SD 1.3.1 allows remote attackers to bypass authentication and gain administrative access by setting the (1) c7portal… | Patch early | 7.5 high | 2.5% | 2009-06-08 |
| CVE-2012-5874 EXP | Multiple SQL injection vulnerabilities in the (1) update_whosonline_reg and (2) update_whosonline_guest functions in Elite Bulletin Board before 2.1.2… | Patch early | 7.5 high | 2.5% | 2013-01-12 |
| CVE-2013-2690 EXP | SQL injection vulnerability in index.php in Synchroweb Technology SynConnect 2.0 allows remote attackers to execute arbitrary SQL commands via the log… | Patch early | 7.5 high | 2.5% | 2013-03-28 |
| CVE-2006-0962 EXP | SQL injection vulnerability in vuBB 0.2 allows remote attackers to execute arbitrary SQL commands via the pass parameter in a cookie. | Patch early | 7.5 high | 2.5% | 2006-03-02 |
| CVE-2006-6878 EXP | admin/uploads.php in PHP-Update 2.7 and earlier allows remote attackers to gain privileges by setting the rights[7] parameter to 1 during a login acti… | Patch early | 7.5 high | 2.5% | 2006-12-31 |
| CVE-2007-1932 EXP | Directory traversal vulnerability in scarnews.inc.php in ScarNews 1.2.1 allows remote attackers to include and execute arbitrary local files via a ..… | Patch early | 7.5 high | 2.5% | 2007-04-10 |
| CVE-2007-3403 EXP | Unrestricted file upload vulnerability in upload.php in dreamLog (aka dreamblog) 0.5 allows remote attackers to upload and execute arbitrary PHP code… | Patch early | 7.5 high | 2.5% | 2007-06-26 |
| CVE-2007-4932 EXP | admin.php in Shop-Script FREE 2.0 and earlier sends a redirect to the web browser but does not exit when administrative credentials are missing, which… | Patch early | 7.5 high | 2.5% | 2007-09-18 |
| CVE-2008-6664 EXP | action.php in SH-News 3.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the shuser and shpass cookies… | Patch early | 7.5 high | 2.5% | 2009-04-08 |
| CVE-2008-6855 EXP | Xigla Software Absolute News Feed 1.0 and possibly 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a ce… | Patch early | 7.5 high | 2.5% | 2009-07-14 |
| CVE-2008-6858 EXP | Absolute Banner Manager .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain valu… | Patch early | 7.5 high | 2.5% | 2009-07-14 |
| CVE-2008-6859 EXP | Xigla Software Absolute Control Panel XE 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a… | Patch early | 7.5 high | 2.5% | 2009-07-14 |
| CVE-2008-6861 EXP | Xigla Software Absolute Newsletter 6.0 and 6.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to… | Patch early | 7.5 high | 2.5% | 2009-07-14 |
| CVE-2008-6862 EXP | Absolute Content Rotator 6.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value. | Patch early | 7.5 high | 2.5% | 2009-07-14 |
| CVE-2008-6863 EXP | Xigla Software Absolute Form Processor .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to… | Patch early | 7.5 high | 2.5% | 2009-07-14 |
| CVE-2008-6864 EXP | Xigla Software Absolute Live Support .NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a… | Patch early | 7.5 high | 2.5% | 2009-07-14 |
| CVE-2008-6919 EXP | profileedit.php TaskDriver 1.3 and earlier allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie… | Patch early | 7.5 high | 2.5% | 2009-08-10 |
| CVE-2008-7051 EXP | AJ Square AJ Article allows remote attackers to bypass authentication and access administrator functionality via a direct request to (1) user.php, (2)… | Patch early | 7.5 high | 2.5% | 2009-08-24 |
| CVE-2012-4034 EXP | Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allow remote attackers to execute arbitrary SQL commands via the (1) username parameter to the… | Patch early | 7.5 high | 2.5% | 2012-08-12 |
| CVE-2008-5880 EXP | admin/auth.php in Gobbl CMS 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie to "ok". | Patch early | 7.5 high | 2.5% | 2009-01-08 |
| CVE-2007-1082 EXP | FTP Explorer 1.0.1 Build 047, and other versions before 1.0.1.52, allows remote servers to cause a denial of service (CPU consumption) via a long resp… | Patch early | 7.1 high | 2.5% | 2007-02-22 |
| CVE-2008-5322 EXP | Wysi Wiki Wyg 1.0 allows remote attackers to obtain system information via an invalid categup parameter to index.php, which calls the phpinfo function… | Patch early | 7.8 high | 2.5% | 2008-12-03 |
| CVE-2005-0860 EXP | PHP remote file inclusion vulnerability in TRG News Script 3.0 allows remote attackers to execute arbitrary PHP code via the dir parameter to (1) arti… | Patch early | 7.5 high | 2.5% | 2005-05-02 |
| CVE-2007-2942 EXP | SQL injection vulnerability in user.php in My Little Forum 1.7 and earlier allows remote attackers to execute arbitrary SQL commands via the id parame… | Patch early | 7.5 high | 2.5% | 2007-05-31 |
| CVE-2007-3052 EXP | SQL injection vulnerability in index.php in the PNphpBB2 1.2i and earlier module for PostNuke allows remote attackers to execute arbitrary SQL command… | Patch early | 7.5 high | 2.5% | 2007-06-06 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt