CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,394 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
208,344 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-1425 EXP | Cross-site scripting (XSS) vulnerability in track.php in phpmyfamily 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the name… | Patch early | 4.3 medium | 2.1% | 2006-03-28 |
| CVE-2005-4053 EXP | Cross-site scripting (XSS) vulnerability in coWiki 0.3.4 allows remote attackers to inject arbitrary web script or HTML via the q parameter, as demons… | Patch early | 4.3 medium | 2.1% | 2005-12-07 |
| CVE-2008-1229 EXP | Cross-site scripting (XSS) vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to inject arbitrary web script or HTML via… | Patch early | 4.3 medium | 2.1% | 2008-03-10 |
| CVE-2003-1350 EXP | List Site Pro 2.0 allows remote attackers to hijack user accounts by inserting a "|" (pipe), which is used as a field delimiter, into the bannerurl fi… | Patch early | 4.3 medium | 2.1% | 2003-12-31 |
| CVE-2012-5702 EXP | Multiple cross-site scripting (XSS) vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the (… | Patch early | 4.3 medium | 2.1% | 2014-10-21 |
| CVE-2011-5149 EXP | Multiple cross-site scripting (XSS) vulnerabilities in SpamTitan 5.08 and earlier allow remote attackers to inject arbitrary web script or HTML via th… | Patch early | 4.3 medium | 2.1% | 2012-08-31 |
| CVE-2004-2030 EXP | Multiple cross-site scripting (XSS) vulnerabilities in index.jsp for Liferay before 2.2.0 release 10/1/2004 allow remote attackers to inject arbitrary… | Patch early | 4.3 medium | 2.1% | 2004-05-22 |
| CVE-2017-17737 EXP | The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network_diagnostics.html or /storage_info.… | Patch early | 6.1 medium | 2.1% | 2017-12-18 |
| CVE-2010-2025 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with fir… | Patch early | 6.8 medium | 2.1% | 2010-05-26 |
| CVE-2006-5239 EXP | Multiple cross-site scripting (XSS) vulnerabilities in eXpBlog 0.3.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1)… | Patch early | 4.3 medium | 2.1% | 2006-10-12 |
| CVE-2018-10109 EXP | Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the content section of a ne… | Patch early | 4.8 medium | 2.1% | 2018-04-16 |
| CVE-2006-2210 EXP | Cross-site scripting (XSS) vulnerability in index.php in 321soft PhP-Gallery 0.9 allows remote attackers to inject arbitrary web script or HTML via th… | Patch early | 5.8 medium | 2.1% | 2006-05-05 |
| CVE-2003-1149 EXP | Cross-site scripting (XSS) vulnerability in Symantec Norton Internet Security 2003 6.0.4.34 allows remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 2.1% | 2003-10-27 |
| CVE-2006-2249 EXP | Multiple cross-site scripting (XSS) vulnerabilities in search.php in CuteNews 1.4.1 and earlier, and possibly 1.4.5, allow remote attackers to inject… | Patch early | 4.3 medium | 2.1% | 2006-05-09 |
| CVE-2006-2425 EXP | Multiple cross-site scripting (XSS) vulnerabilities in PRV.php in PhpRemoteView, possibly 2003-10-23 and earlier, allow remote attackers to inject arb… | Patch early | 4.3 medium | 2.1% | 2006-05-17 |
| CVE-2006-4668 EXP | Cross-site scripting (XSS) vulnerability in index.php in Rob Hensley AckerTodo 4.0 allows remote attackers to inject arbitrary web script or HTML via… | Patch early | 4.3 medium | 2.1% | 2006-09-09 |
| CVE-2012-6555 EXP | Cross-site scripting (XSS) vulnerability in the LatestComment plugin 1.1 for Vanilla Forums allows remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 2.1% | 2013-05-23 |
| CVE-2007-4886 EXP | Incomplete blacklist vulnerability in index.php in AuraCMS 1.x and probably 2.x allows remote attackers to execute arbitrary PHP code via a (1) UNC sh… | Patch early | 6.8 medium | 2.1% | 2007-09-14 |
| CVE-2007-5138 EXP | PHP remote file inclusion vulnerability in forum/forum.php in lustig.cms BETA 2.5 allows remote attackers to execute arbitrary PHP code via a URL in t… | Patch early | 6.8 medium | 2.1% | 2007-09-28 |
| CVE-2007-5139 EXP | PHP remote file inclusion vulnerability in admin/include/header.php in chupix 0.2.3, when register_globals is enabled, allows remote attackers to exec… | Patch early | 6.8 medium | 2.1% | 2007-09-28 |
| CVE-2007-5409 EXP | PHP remote file inclusion vulnerability in admin/nuseo_admin_d.php in NuSEO PHP Enterprise 1.6 (NuSEO.PHP), when register_globals is enabled, allows r… | Patch early | 6.8 medium | 2.1% | 2007-10-12 |
| CVE-2007-5627 EXP | PHP remote file inclusion vulnerability in content/fnc-readmail3.php in SocketMail 2.2.8 allows remote attackers to execute arbitrary PHP code via a U… | Patch early | 6.8 medium | 2.1% | 2007-10-23 |
| CVE-2007-5754 EXP | PHP remote file inclusion vulnerability in urlinn_includes/config.php in phpFaber URLInn 2.0.5 allows remote attackers to execute arbitrary PHP code v… | Patch early | 6.8 medium | 2.1% | 2007-10-31 |
| CVE-2007-5784 EXP | PHP remote file inclusion vulnerability in index.php in CaupoShop Pro 2.x allows remote attackers to execute arbitrary PHP code via a URL in the actio… | Patch early | 6.8 medium | 2.1% | 2007-11-01 |
| CVE-2007-6027 EXP | PHP remote file inclusion vulnerability in admin.jjgallery.php in the Carousel Flash Image Gallery (com_jjgallery) component for Joomla! allows remote… | Patch early | 6.8 medium | 2.1% | 2007-11-20 |
| CVE-2007-6139 EXP | PHP remote file inclusion vulnerability in index.php in Mp3 ToolBox 1.0 beta 5 allows remote attackers to execute arbitrary PHP code via a URL in the… | Patch early | 6.8 medium | 2.1% | 2007-11-27 |
| CVE-2007-6464 EXP | Multiple PHP remote file inclusion vulnerabilities in Form tools 1.5.0b allow remote attackers to execute arbitrary PHP code via a URL in the g_root_d… | Patch early | 6.8 medium | 2.1% | 2007-12-20 |
| CVE-2006-5057 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Ktools.net PhotoStore allow remote attackers to inject arbitrary web script or HTML via the (1)… | Patch early | 5.1 medium | 2.1% | 2006-09-28 |
| CVE-2006-5064 EXP | Multiple cross-site scripting (XSS) vulnerabilities in BirdBlog 1.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the… | Patch early | 5.1 medium | 2.1% | 2006-09-28 |
| CVE-2006-5066 EXP | Multiple cross-site scripting (XSS) vulnerabilities in DanPHPSupport 0.5, and other versions before 1.0, allow remote attackers to inject arbitrary we… | Patch early | 5.1 medium | 2.1% | 2006-09-28 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt