CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,382 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
152,329 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-9650 EXP | An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and p… | Patch early | 7.8 high | 2.4% | 2017-08-25 |
| CVE-2007-5650 EXP | Directory traversal vulnerability in system.php in ReloadCMS 1.2.7 allows remote attackers to include and execute arbitrary local files via a .. (dot… | Patch early | 7.5 high | 2.4% | 2007-10-23 |
| CVE-2005-4011 EXP | SQL injection vulnerability in calendar.php in Codewalkers ltwCalendar (aka PHP Event Calendar) 4.2, 4.1.3, and earlier allows remote attackers to exe… | Patch early | 7.5 high | 2.4% | 2005-12-05 |
| CVE-2008-2970 EXP | Multiple session fixation vulnerabilities in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web ses… | Patch early | 7.5 high | 2.4% | 2008-07-02 |
| CVE-2013-5640 EXP | Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (1) answer_id or (2) question_i… | Patch early | 7.5 high | 2.4% | 2014-04-01 |
| CVE-2010-4980 EXP | SQL injection vulnerability in packagedetails.php in iScripts ReserveLogic 1.0 allows remote attackers to execute arbitrary SQL commands via the pid p… | Patch early | 7.5 high | 2.4% | 2011-11-01 |
| CVE-2013-3081 EXP | SQL injection vulnerability in the checkEmailFormat function in plugins/jojo_core/classes/Jojo.php in Jojo before 1.2.2 allows remote attackers to exe… | Patch early | 7.5 high | 2.4% | 2014-06-09 |
| CVE-2009-0766 EXP | Directory traversal vulnerability in default.php in Kipper 2.01 allows remote attackers to include and execute arbitrary local files via directory tra… | Patch early | 7.5 high | 2.4% | 2009-03-06 |
| CVE-2015-1372 EXP | SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p parameter in an update action… | Patch early | 7.5 high | 2.4% | 2015-01-27 |
| CVE-2008-4667 EXP | Directory traversal vulnerability in rss.php in ArabCMS 2.0 beta 1 allows remote attackers to include and execute arbitrary local files via a .. (dot… | Patch early | 7.5 high | 2.4% | 2008-10-22 |
| CVE-2008-4781 EXP | Directory traversal vulnerability in update.php in MyKtools 2.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot… | Patch early | 7.5 high | 2.4% | 2008-10-29 |
| CVE-2009-4683 EXP | Directory traversal vulnerability in vote.php in Good/Bad Vote allows remote attackers to include and execute arbitrary local files via directory trav… | Patch early | 7.5 high | 2.4% | 2010-03-10 |
| CVE-2009-4957 EXP | Directory traversal vulnerability in loadpanel.php in Interspire ActiveKB allows remote attackers to read arbitrary files and possibly have unspecifie… | Patch early | 7.5 high | 2.4% | 2010-07-22 |
| CVE-2010-1043 EXP | Directory traversal vulnerability in index.php in jaxCMS 1.0 allows remote attackers to include and execute arbitrary local files via directory traver… | Patch early | 7.5 high | 2.4% | 2010-03-23 |
| CVE-2007-6366 EXP | Multiple SQL injection vulnerabilities in SineCMS 2.3.4 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the id parameter… | Patch early | 7.5 high | 2.4% | 2007-12-15 |
| CVE-2018-12739 EXP | In BEESCMS 4.0, CSRF allows administrators to be added arbitrarily, a related issue to CVE-2018-10266. | Patch early | 8.8 high | 2.4% | 2018-07-05 |
| CVE-2007-5579 EXP | login.php in Pligg CMS 9.5 uses a guessable confirmation code when resetting a forgotten password, which allows remote attackers with knowledge of a u… | Patch early | 7.5 high | 2.4% | 2007-10-18 |
| CVE-2008-6608 EXP | Multiple SQL injection vulnerabilities in DevelopItEasy Events Calendar 1.2 allow remote attackers to execute arbitrary SQL commands via (1) the user_… | Patch early | 7.5 high | 2.4% | 2009-04-06 |
| CVE-2008-3240 EXP | SQL injection vulnerability in index.php in AlstraSoft Affiliate Network Pro allows remote attackers to execute arbitrary SQL commands via the pgm par… | Patch early | 7.5 high | 2.4% | 2008-07-21 |
| CVE-2008-3266 EXP | SQL injection vulnerability in picture_pic_bv.asp in SoftAcid Hotel Reservation System (HRS) Multi allows remote attackers to execute arbitrary SQL co… | Patch early | 7.5 high | 2.4% | 2008-07-24 |
| CVE-2008-3416 EXP | SQL injection vulnerability in modules/members.php in IceBB before 1.0-rc9.3 allows remote attackers to execute arbitrary SQL commands via the usernam… | Patch early | 7.5 high | 2.4% | 2008-07-31 |
| CVE-2008-4613 EXP | SQL injection vulnerability in forums.asp in PortalApp 4.0 allows remote attackers to execute arbitrary SQL commands via the sortby parameter. | Patch early | 7.5 high | 2.4% | 2008-10-20 |
| CVE-2008-5190 EXP | SQL injection vulnerability in index.php in eSHOP100 allows remote attackers to execute arbitrary SQL commands via the SUB parameter. | Patch early | 7.5 high | 2.4% | 2008-11-21 |
| CVE-2008-5574 EXP | SQL injection vulnerability in member.php in Webmaster Marketplace allows remote attackers to execute arbitrary SQL commands via the u parameter. | Patch early | 7.5 high | 2.4% | 2008-12-15 |
| CVE-2010-3893 EXP | The administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x does not restrict use of a session ID (aka SID) value to a single IP addres… | Patch early | 7.5 high | 2.4% | 2010-11-12 |
| CVE-2004-2754 EXP | SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 2.4% | 2004-12-31 |
| CVE-2008-6163 EXP | SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL commands via the bannerid parameter… | Patch early | 7.5 high | 2.4% | 2009-02-20 |
| CVE-2018-15845 EXP | There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add. | Patch early | 8.8 high | 2.4% | 2018-08-25 |
| CVE-2005-1822 EXP | Multiple SQL injection vulnerabilities in Qualiteam X-Cart 4.0.8 allow remote attackers to execute arbitrary SQL commands via the (1) cat or (2) print… | Patch early | 7.5 high | 2.4% | 2005-06-01 |
| CVE-2008-3311 EXP | PHP remote file inclusion vulnerability in config.php in Adam Scheinberg Flip 3.0 allows remote attackers to execute arbitrary PHP code via a URL in t… | Patch early | 7.5 high | 2.3% | 2008-07-25 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt