CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,406 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
208,352 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-3939 EXP | SQL injection vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) CMS 3.4 and earlier allows remote attackers to e… | Patch early | 6.8 medium | 2.1% | 2007-07-21 |
| CVE-2013-6275 EXP | Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php. | Patch early | 6.5 medium | 2.1% | 2019-11-05 |
| CVE-2006-2497 EXP | Multiple cross-site scripting (XSS) vulnerabilities in AspBB 0.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) action pa… | Patch early | 5.8 medium | 2.1% | 2006-05-20 |
| CVE-2020-8839 EXP | Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF_submask field. | Patch early | 6.1 medium | 2.1% | 2020-02-12 |
| CVE-2007-4057 EXP | Unrestricted file upload vulnerability in pfs.php in Neocrome Seditio 121 and earlier allows remote authenticated users to upload arbitrary PHP code v… | Patch early | 6.5 medium | 2.1% | 2007-07-30 |
| CVE-2007-6399 EXP | index.php in Flat PHP Board 1.2 and earlier allows remote authenticated users to obtain the password for the current user account by reading the passw… | Patch early | 6.5 medium | 2.1% | 2007-12-17 |
| CVE-2008-6282 EXP | SQL injection vulnerability in engine/users/users_edit_pub.inc in CMS Ortus 1.13 and earlier allows remote authenticated users to execute arbitrary SQ… | Patch early | 6.5 medium | 2.1% | 2009-02-25 |
| CVE-2006-5722 EXP | Multiple PHP remote file inclusion vulnerabilities in Segue CMS 1.5.9 and earlier, when magic_quotes_gpc is enabled, allow remote attackers to execute… | Patch early | 5.1 medium | 2.1% | 2006-11-04 |
| CVE-2008-2881 EXP | Relative Real Estate Systems 3.0 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sen… | Patch early | 5.0 medium | 2.1% | 2008-06-26 |
| CVE-2007-3429 EXP | Unrestricted file upload vulnerability in signup.php in e107 0.7.8 and earlier, when photograph upload is enabled, allows remote attackers to upload a… | Patch early | 6.8 medium | 2.1% | 2007-06-27 |
| CVE-2018-5479 EXP | FoxSash ImgHosting 1.5 (according to footer information) is vulnerable to XSS attacks. The affected function is its search engine via the search param… | Patch early | 6.1 medium | 2.1% | 2018-01-15 |
| CVE-2006-1828 EXP | SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary SQL commands and execute arbitrary code v… | Patch early | 5.1 medium | 2.1% | 2006-04-19 |
| CVE-2003-1436 EXP | PHP remote file inclusion vulnerability in nukebrowser.php in Nukebrowser 2.1 to 2.5 allows remote attackers to execute arbitrary PHP code via the fil… | Patch early | 6.8 medium | 2.1% | 2003-12-31 |
| CVE-2005-1051 EXP | SQL injection vulnerability in profile.php in PunBB 1.2.4 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in… | Patch early | 6.5 medium | 2.1% | 2005-05-02 |
| CVE-2013-5716 EXP | Gretech GOM Media Player 2.2.53.5169 and possibly earlier allows remote attackers to cause a denial of service (application crash) via a crafted WAV f… | Patch early | 4.3 medium | 2.1% | 2013-09-09 |
| CVE-2017-15959 EXP | Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-2007-6576. | Patch early | 9.8 critical | 2.1% | 2017-10-29 |
| CVE-2017-15963 EXP | iTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the service-provider.php ser parameter. | Patch early | 9.8 critical | 2.1% | 2017-10-29 |
| CVE-2017-15967 EXP | Mailing List Manager Pro 3.0 allows SQL Injection via the edit parameter to admin/users in a sort=login action, or the edit parameter to admin/templat… | Patch early | 9.8 critical | 2.1% | 2017-10-29 |
| CVE-2017-15968 EXP | MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter. | Patch early | 9.8 critical | 2.1% | 2017-10-29 |
| CVE-2017-15969 EXP | PG All Share Video 1.0 allows SQL Injection via the PATH_INFO to search/tag, friends/index, users/profile, or video_catalog/category. | Patch early | 9.8 critical | 2.1% | 2017-10-29 |
| CVE-2006-7100 EXP | PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBB Insert User 0.1.2 and earlier allows remote attackers to execute a… | Patch early | 6.8 medium | 2.1% | 2007-03-03 |
| CVE-2006-2459 EXP | SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to execute arbitrary SQL commands via… | Patch early | 6.4 medium | 2.1% | 2006-05-19 |
| CVE-2007-3267 EXP | Cross-site scripting (XSS) vulnerability in low.php in Fuzzylime Forum 1.01b and earlier allows remote attackers to inject arbitrary web script or HTM… | Patch early | 4.3 medium | 2.1% | 2007-06-19 |
| CVE-2006-2070 EXP | Cross-site scripting (XSS) vulnerability in member.php in DevBB 1.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via t… | Patch early | 4.3 medium | 2.1% | 2006-04-27 |
| CVE-2006-2228 EXP | Cross-site scripting (XSS) vulnerability in w-Agora (aka Web-Agora) 4.2.0 allows remote attackers to inject arbitrary web script or HTML via a post wi… | Patch early | 4.3 medium | 2.1% | 2006-05-05 |
| CVE-2011-4333 EXP | Multiple cross-site scripting (XSS) vulnerabilities in LabWiki 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (… | Patch early | 6.1 medium | 2.1% | 2017-10-23 |
| CVE-2006-1582 EXP | Cross-site scripting (XSS) vulnerability in index.php in Blank'N'Berg 0.2 allows remote attackers to inject arbitrary web script or HTML via the _path… | Patch early | 5.8 medium | 2.1% | 2006-04-02 |
| CVE-2008-6039 EXP | Session fixation vulnerability in BLUEPAGE CMS 2.5 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter. | Patch early | 6.8 medium | 2.1% | 2009-02-03 |
| CVE-2024-48840 EXP | Unauthorized Access vulnerabilities allow Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATR… | Patch early | 10.0 critical | 2.1% | 2024-12-05 |
| CVE-2017-14703 EXP | SQL injection vulnerability in Cash Back Comparison Script 1.0 allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to search/. | Patch early | 9.8 critical | 2.1% | 2017-09-26 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt