CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,366 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
152,321 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2005-2049 EXP | Multiple SQL injection vulnerabilities in DUware DUclassmate 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) iState parameter… | Patch early | 7.5 high | 2.4% | 2005-06-22 |
| CVE-2005-2788 EXP | Multiple SQL injection vulnerabilities in Land Down Under (LDU) 801 and earlier allow remote attackers to execute arbitrary SQL commands via the c par… | Patch early | 7.5 high | 2.4% | 2005-09-02 |
| CVE-2015-1400 EXP | SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL commands via the query parameter. | Patch early | 7.5 high | 2.4% | 2015-02-03 |
| CVE-2012-1225 EXP | Multiple SQL injection vulnerabilities in Dolibarr CMS 3.2.0 Alpha and earlier allow remote authenticated users to execute arbitrary SQL commands via… | Patch early | 7.5 high | 2.4% | 2012-02-21 |
| CVE-2011-4674 EXP | SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbit… | Patch early | 7.5 high | 2.4% | 2011-12-02 |
| CVE-2007-1432 EXP | Grayscale Blog 0.8.0, and possibly earlier versions, allows remote attackers to gain privileges via direct requests with modified arguments in (1) the… | Patch early | 7.5 high | 2.4% | 2007-03-13 |
| CVE-2007-2851 EXP | A certain ActiveX control in LeadTools Raster Variant Object Library (LTRVR14e.dll) 14.5.0.44 allows remote attackers to overwrite arbitrary files via… | Patch early | 7.5 high | 2.4% | 2007-05-24 |
| CVE-2005-0411 EXP | Directory traversal vulnerability in index.php for CitrusDB 0.3.6 and earlier allows remote attackers and local users to include arbitrary PHP files v… | Patch early | 7.5 high | 2.4% | 2005-02-14 |
| CVE-2005-2683 EXP | Multiple SQL injection vulnerabilities in PHPKit 1.6.1 allow remote attackers to execute arbitrary SQL commands via the (1) letter parameter to login/… | Patch early | 7.5 high | 2.4% | 2005-08-23 |
| CVE-2006-0064 EXP | PHP remote file include vulnerability in includes/orderSuccess.inc.php in CubeCart allows remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 7.5 high | 2.4% | 2006-01-03 |
| CVE-2006-1094 EXP | SQL injection vulnerability in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allows remote attackers to execute arbitrary SQL commands via t… | Patch early | 7.5 high | 2.4% | 2006-03-09 |
| CVE-2000-1244 EXP | Computer Associates InoculateIT Agent for Exchange Server does not recognize an e-mail virus attachment if the SMTP header is missing the "From" field… | Patch early | 7.5 high | 2.4% | 2000-12-31 |
| CVE-2012-0973 EXP | Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to… | Patch early | 7.5 high | 2.4% | 2012-09-25 |
| CVE-2009-3824 EXP | Directory traversal vulnerability in include/processor.php in Greenwood PHP Content Manager 0.3.2 allows remote attackers to include and execute arbit… | Patch early | 7.5 high | 2.4% | 2009-10-28 |
| CVE-2009-4205 EXP | Directory traversal vulnerability in admin.php in Flashlight Free Edition allows remote attackers to include and execute arbitrary local files via a .… | Patch early | 7.5 high | 2.4% | 2009-12-04 |
| CVE-2008-2534 EXP | Directory traversal vulnerability in admin/admin_frame.php in Phoenix View CMS Pre Alpha2 and earlier allows remote attackers to include and execute a… | Patch early | 7.5 high | 2.4% | 2008-06-03 |
| CVE-2008-5132 EXP | SQL injection vulnerability in inc/ajax/ajax_rating.php in MemHT Portal 4.0.1 allows remote attackers to execute arbitrary SQL commands via the X-Forw… | Patch early | 7.5 high | 2.4% | 2008-11-18 |
| CVE-2008-5993 EXP | Directory traversal vulnerability in image.php in Barcode Generator 1D (barcodegen) 2.0.0 and earlier allows remote attackers to include and execute a… | Patch early | 7.5 high | 2.4% | 2009-01-28 |
| CVE-2009-3064 EXP | Directory traversal vulnerability in debugger/debug_php.php in Ve-EDIT 0.1.4 allows remote attackers to include and execute arbitrary local files via… | Patch early | 7.5 high | 2.4% | 2009-09-03 |
| CVE-2012-2952 EXP | SQL injection vulnerability in add_ons.php in Jaow 2.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the add_ons paramet… | Patch early | 7.5 high | 2.4% | 2012-05-29 |
| CVE-2006-7063 EXP | Directory traversal vulnerability in profile.php in TinyPHPforum 3.6 and earlier allows remote attackers to include and execute arbitrary files via ".… | Patch early | 7.5 high | 2.4% | 2007-02-24 |
| CVE-2008-0137 EXP | PHP remote file inclusion vulnerability in config.inc.php in SNETWORKS PHP CLASSIFIEDS 5.0 allows remote attackers to execute arbitrary PHP code via a… | Patch early | 7.5 high | 2.4% | 2008-01-08 |
| CVE-2001-0425 EXP | AdLibrary.pm in AdCycle 0.78b allows remote attackers to gain privileges to AdCycle via a malformed Agent: header in the HTTP request, which is insert… | Patch early | 7.5 high | 2.4% | 2001-06-27 |
| CVE-2013-2581 EXP | cgi-bin/firmwareupgrade in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P1… | Patch early | 7.8 high | 2.4% | 2013-10-11 |
| CVE-2016-6187 EXP | The apparmor_setprocattr function in security/apparmor/lsm.c in the Linux kernel before 4.6.5 does not validate the buffer size, which allows local us… | Patch early | 7.8 high | 2.4% | 2016-08-06 |
| CVE-2014-9096 EXP | Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the… | Patch early | 7.5 high | 2.4% | 2014-11-26 |
| CVE-2015-1476 EXP | Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL commands via the (1) productbycat pa… | Patch early | 7.5 high | 2.4% | 2015-02-04 |
| CVE-2015-1477 EXP | SQL injection vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! allows remote attackers to execute arbitrary SQL commands via… | Patch early | 7.5 high | 2.4% | 2015-02-04 |
| CVE-2015-1518 EXP | SQL injection vulnerability in the search_post function in includes/search.php in Redaxscript before 2.3.0 allows remote attackers to execute arbitrar… | Patch early | 7.5 high | 2.4% | 2015-02-11 |
| CVE-2015-2070 EXP | SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitrary SQL commands via the catId… | Patch early | 7.5 high | 2.4% | 2015-02-24 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt