CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,610 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
151,182 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-2396 EXP | PHP remote file inclusion vulnerability in index.php in Wajox Software microSSys CMS 1.5 and earlier, when register_globals is enabled, allows remote… | Patch early | 7.5 high | 2.5% | 2008-05-21 |
| CVE-2008-2297 EXP | The admin.php file in Rantx allows remote attackers to bypass authentication and gain privileges by setting the logininfo cookie to "<?php" or "?>", w… | Patch early | 7.5 high | 2.5% | 2008-05-18 |
| CVE-2008-6001 EXP | index.php in ADN Forum 1.0b and earlier allows remote attackers to bypass authentication and gain sysop access via a fpusuario cookie composed of an i… | Patch early | 7.5 high | 2.5% | 2009-01-28 |
| CVE-2008-6291 EXP | Acc PHP eMail 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the NEWSLETTERLOGIN cookie to "admin". | Patch early | 7.5 high | 2.5% | 2009-02-26 |
| CVE-2008-6963 EXP | admin.php in TurnkeyForms Text Link Sales allows remote attackers to bypass authentication and gain administrative privileges via a direct request. | Patch early | 7.5 high | 2.5% | 2009-08-13 |
| CVE-2017-7851 EXP | D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substr… | Patch early | 8.8 high | 2.5% | 2017-11-15 |
| CVE-2009-1752 EXP | exJune Office Message System 1 does not properly restrict access to (1) configure.asp and (2) addmessage2.asp, which allows remote attackers to gain p… | Patch early | 7.5 high | 2.5% | 2009-05-22 |
| CVE-2008-4649 EXP | Session fixation vulnerability in Elxis CMS 2008.1 revision 2204 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter. | Patch early | 7.5 high | 2.4% | 2008-10-22 |
| CVE-2007-3582 EXP | SQL injection vulnerability in index.php in SuperCali PHP Event Calendar 0.4.0 allows remote attackers to execute arbitrary SQL commands via the o par… | Patch early | 7.5 high | 2.4% | 2007-07-05 |
| CVE-2007-3292 EXP | Unrestricted file upload vulnerability in LiveCMS 3.4 and earlier allows remote attackers to upload and execute arbitrary PHP code by specifying a PHP… | Patch early | 7.5 high | 2.4% | 2007-06-20 |
| CVE-2005-0343 EXP | SQL injection vulnerability in PerlDesk 1.x allows remote attackers to inject arbitrary SQL commands via the view parameter. | Patch early | 7.5 high | 2.4% | 2005-05-02 |
| CVE-2005-0786 EXP | SQL injection vulnerability in gb_new.inc in SimpGB allows remote attackers to execute arbitrary SQL commands via the quote parameter to guestbook.php… | Patch early | 7.5 high | 2.4% | 2005-03-14 |
| CVE-2005-1833 EXP | Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 allow remote attackers to execute arbitrary SQL commands via the (1) eid par… | Patch early | 7.5 high | 2.4% | 2005-05-31 |
| CVE-2008-2349 EXP | Zomplog 3.8.2 and earlier allows remote attackers to gain administrative access by creating an admin account via a direct request to install/newuser.p… | Patch early | 7.5 high | 2.4% | 2008-05-20 |
| CVE-2008-6613 EXP | uploader.php in minimal-ablog 0.4 does not properly restrict access, which allows remote attackers to gain administrative privileges via a direct requ… | Patch early | 7.5 high | 2.4% | 2009-04-06 |
| CVE-2009-3702 EXP | Multiple absolute path traversal vulnerabilities in PHP-Calendar 1.1 allow remote attackers to include and execute arbitrary local files via a full pa… | Patch early | 7.5 high | 2.4% | 2009-12-22 |
| CVE-2001-0402 EXP | IPFilter 3.4.16 and earlier does not include sufficient session information in its cache, which allows remote attackers to bypass access restrictions… | Patch early | 7.5 high | 2.4% | 2001-06-18 |
| CVE-2006-6212 EXP | PHP remote file inclusion vulnerability in centre.php in Site News (site_news) 2.00, and possibly earlier, allows remote attackers to execute arbitrar… | Patch early | 7.5 high | 2.4% | 2006-12-01 |
| CVE-2004-1406 EXP | SQL injection vulnerability in ikonboard.cgi in Ikonboard 3.1.0 through 3.1.3 allows remote attackers to inject arbitrary SQL commands via the (1) st… | Patch early | 7.5 high | 2.4% | 2004-12-31 |
| CVE-2004-1580 EXP | SQL injection vulnerability in index.php in CubeCart 2.0.1 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter. | Patch early | 7.5 high | 2.4% | 2004-12-31 |
| CVE-2004-2218 EXP | SQL injection vulnerability in pmwh.php in PHPMyWebHosting 0.3.4 and earlier allows remote attackers to modify SQL statements via the password paramet… | Patch early | 7.5 high | 2.4% | 2004-12-31 |
| CVE-2005-2000 EXP | Multiple SQL injection vulnerabilities in paFileDB 3.1 and earlier allow remote attackers to execute arbitrary SQL commands via the formname parameter… | Patch early | 7.5 high | 2.4% | 2005-06-15 |
| CVE-2009-2263 EXP | Directory traversal vulnerability in index.php in Awesome PHP Mega File Manager 1.0 allows remote attackers to include and execute arbitrary local fil… | Patch early | 7.5 high | 2.4% | 2009-06-30 |
| CVE-2007-1707 EXP | PHP remote file inclusion vulnerability in index.php in Net Side Content Management System (Net-Side.net CMS) allows remote attackers to execute arbit… | Patch early | 7.5 high | 2.4% | 2007-03-27 |
| CVE-2007-1715 EXP | PHP remote file inclusion vulnerability in frontpage.php in Free Image Hosting 2.0 and earlier allows remote attackers to execute arbitrary PHP code v… | Patch early | 7.5 high | 2.4% | 2007-03-27 |
| CVE-2007-2044 EXP | PHP remote file inclusion vulnerability in mod_weather.php in the Antonis Ventouris Weather module for Mambo and Joomla! allows remote attackers to ex… | Patch early | 7.5 high | 2.4% | 2007-04-16 |
| CVE-2007-2143 EXP | PHP remote file inclusion vulnerability in index.php in the Be2004-2 template for Joomla! allows remote attackers to execute arbitrary PHP code via a… | Patch early | 7.5 high | 2.4% | 2007-04-19 |
| CVE-2007-2158 EXP | PHP remote file inclusion vulnerability in index.php in jGallery 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the G_JGALL[in… | Patch early | 7.5 high | 2.4% | 2007-04-19 |
| CVE-2007-4439 EXP | PHP remote file inclusion vulnerability in popup_window.php in Squirrelcart 1.x.x and earlier allows remote attackers to execute arbitrary PHP code vi… | Patch early | 7.5 high | 2.4% | 2007-08-21 |
| CVE-2007-6178 EXP | Multiple PHP remote file inclusion vulnerabilities in Easy Hosting Control Panel for Ubuntu (EHCP) 0.22.8 and earlier allow remote attackers to execut… | Patch early | 7.5 high | 2.4% | 2007-11-30 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt