CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,366 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
152,321 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2015-2102 EXP | SQL injection vulnerability in view_item.php in ClipBucket 2.7 RC3 (2.7.0.4.v2929-rc3) allows remote attackers to execute arbitrary SQL commands via t… | Patch early | 7.5 high | 2.4% | 2015-02-27 |
| CVE-2015-2237 EXP | Multiple SQL injection vulnerabilities in Betster (aka PHP Betoffice) 1.0.4 allow remote attackers to execute arbitrary SQL commands via the id parame… | Patch early | 7.5 high | 2.4% | 2015-03-12 |
| CVE-2009-2331 EXP | Multiple static code injection vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to inject arbitrary PHP code (1) into settings.ph… | Patch early | 7.5 high | 2.4% | 2009-07-05 |
| CVE-2010-2685 EXP | siteadmin/adduser.php in Customer Paradigm PageDirector CMS does not properly restrict access, which allows remote attackers to bypass intended restri… | Patch early | 7.5 high | 2.4% | 2010-07-12 |
| CVE-2009-2117 EXP | uye_paneli.php in phPortal 1.0 allows remote attackers to bypass authentication and obtain administrative access by setting the kulladi cookie to a va… | Patch early | 7.5 high | 2.4% | 2009-06-18 |
| CVE-2015-1467 EXP | Multiple SQL injection vulnerabilities in Translations in Fork CMS before 3.8.6 allow remote authenticated users to execute arbitrary SQL commands via… | Patch early | 7.5 high | 2.4% | 2015-02-06 |
| CVE-2012-1047 EXP | Directory traversal vulnerability in the WWWHELP Service (js/html/wwhelp.htm) in Cyberoam Central Console (CCC) 2.00.2 allows remote attackers to incl… | Patch early | 7.5 high | 2.4% | 2012-02-12 |
| CVE-2025-47175 EXP | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. | Patch early | 7.8 high | 2.4% | 2025-06-10 |
| CVE-2018-11670 EXP | An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary PHP code via the content param… | Patch early | 8.8 high | 2.4% | 2018-06-01 |
| CVE-2018-11671 EXP | An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php?m=admin&c=access&a=adduserhan… | Patch early | 8.8 high | 2.4% | 2018-06-01 |
| CVE-2009-2313 EXP | Directory traversal vulnerability in index.php in Jinzora Media Jukebox 2.8 and earlier allows remote attackers to include and execute arbitrary local… | Patch early | 7.5 high | 2.4% | 2009-07-02 |
| CVE-2009-4499 EXP | SQL injection vulnerability in the get_history_lastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote attackers to e… | Patch early | 7.5 high | 2.4% | 2009-12-31 |
| CVE-2009-1479 EXP | Directory traversal vulnerability in client/desktop/default.htm in Boxalino before 09.05.25-0421 allows remote attackers to read arbitrary files via a… | Patch early | 7.5 high | 2.4% | 2009-10-22 |
| CVE-2008-1325 EXP | Multiple directory traversal vulnerabilities in index.php in Uberghey CMS 0.3.1 allow remote attackers to include and execute arbitrary local files vi… | Patch early | 7.5 high | 2.4% | 2008-03-13 |
| CVE-2004-1622 EXP | SQL injection vulnerability in dosearch.php in UBB.threads 3.4.x allows remote attackers to execute arbitrary SQL statements via the Name parameter. | Patch early | 7.5 high | 2.4% | 2004-10-21 |
| CVE-2005-1011 EXP | SQL injection vulnerability in content.asp in SiteEnable allows remote attackers to execute arbitrary SQL commands via the sortby parameter. | Patch early | 7.5 high | 2.4% | 2005-05-02 |
| CVE-2017-9418 EXP | SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the t… | Patch early | 8.8 high | 2.4% | 2017-06-12 |
| CVE-2007-1402 EXP | The Rediff Toolbar 2.0 ActiveX control in redifftoolbar.dll allows remote attackers to cause a denial of service via unspecified manipulations, possib… | Patch early | 7.5 high | 2.4% | 2007-03-10 |
| CVE-2009-1066 EXP | SQL injection vulnerability in the referral function in admin/lib/lib_logs.php in Pixie CMS 1.01a allows remote attackers to execute arbitrary SQL com… | Patch early | 7.5 high | 2.4% | 2009-03-26 |
| CVE-2008-7153 EXP | SQL injection vulnerability in the autoDetectRegion function in doceboCore/lib/lib.regset.php in Docebo 3.5.0.3 and earlier allows remote attackers to… | Patch early | 7.5 high | 2.4% | 2009-09-02 |
| CVE-2009-3542 EXP | Directory traversal vulnerability in ls.php in LittleSite (aka LS or LittleSite.php) 0.1 allows remote attackers to include and execute arbitrary loca… | Patch early | 7.5 high | 2.4% | 2009-10-02 |
| CVE-2001-1106 EXP | The default configuration of Sambar Server 5 and earlier uses a symmetric key that is compiled into the binary program for encrypting passwords, which… | Patch early | 7.5 high | 2.4% | 2001-07-25 |
| CVE-2018-18794 EXP | School Event Management System 1.0 allows CSRF via user/controller.php?action=edit. | Patch early | 8.8 high | 2.4% | 2018-11-16 |
| CVE-2018-18797 EXP | School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php. | Patch early | 8.8 high | 2.4% | 2018-11-16 |
| CVE-2018-18799 EXP | School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos. | Patch early | 8.8 high | 2.4% | 2018-11-16 |
| CVE-2007-5307 EXP | ELSEIF CMS Beta 0.6 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter… | Patch early | 7.5 high | 2.4% | 2007-10-09 |
| CVE-2007-5733 EXP | Unrestricted file upload vulnerability in upload/upload.php in Japanese PHP Gallery Hosting, when Open directory mode is enabled, allows remote attack… | Patch early | 7.5 high | 2.4% | 2007-10-30 |
| CVE-2007-5737 EXP | Unrestricted file upload vulnerability in component/upload.jsp in Korean GHBoard allows remote attackers to upload arbitrary files via unspecified vec… | Patch early | 7.5 high | 2.4% | 2007-10-30 |
| CVE-2006-6137 EXP | Multiple PHP remote file inclusion vulnerabilities in Sisfo Kampus 0.8 allow remote attackers to execute arbitrary PHP code via a URL in the (1) exec… | Patch early | 7.5 high | 2.4% | 2006-11-28 |
| CVE-2006-6812 EXP | Multiple PHP remote file inclusion vulnerabilities in myPHPCalendar 10.1 allow remote attackers to execute arbitrary PHP code via a URL in the cal_dir… | Patch early | 7.5 high | 2.4% | 2006-12-29 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt