CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,615 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
152,416 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-6739 EXP | Todd Woolums ASP Download management script 1.03 does not require authentication for setupdownload.asp, which allows remote attackers to gain administ… | Patch early | 7.5 high | 2.3% | 2009-04-21 |
| CVE-2007-6557 EXP | Multiple SQL injection vulnerabilities in MeGaCheatZ 1.1 allow remote attackers to execute arbitrary SQL commands via the ItemID parameter to (1) comm… | Patch early | 7.5 high | 2.3% | 2007-12-28 |
| CVE-2008-0391 EXP | inc/elementz.php in aliTalk 1.9.1.1 does not properly verify authentication, which allows remote attackers to add an arbitrary user account via a modi… | Patch early | 7.5 high | 2.3% | 2008-01-23 |
| CVE-2008-1893 EXP | PHP remote file inclusion vulnerability in index.php in W2B Online Banking allows remote attackers to execute arbitrary PHP code via a URL in the ilan… | Patch early | 7.5 high | 2.3% | 2008-04-18 |
| CVE-2002-2319 EXP | Static code injection vulnerability in users.php in MySimpleNews allows remote attackers to inject arbitrary PHP code and HTML via the (1) LOGIN, (2)… | Patch early | 7.5 high | 2.3% | 2002-12-31 |
| CVE-2005-1237 EXP | SQL injection vulnerability in news.php in FlexPHPNews 0.0.3 allows remote attackers to execute arbitrary SQL commands via the newsid parameter. | Patch early | 7.5 high | 2.2% | 2005-05-02 |
| CVE-2008-0745 EXP | Directory traversal vulnerability in aides/index.php in DomPHP 0.82 allows remote attackers to include and execute arbitrary local files via a .. (dot… | Patch early | 7.5 high | 2.2% | 2008-02-13 |
| CVE-2009-1510 EXP | Multiple directory traversal vulnerabilities in KoschtIT Image Gallery 1.82 allow remote attackers to include and execute arbitrary local files via di… | Patch early | 7.5 high | 2.2% | 2009-05-01 |
| CVE-2008-3313 EXP | Multiple PHP remote file inclusion vulnerabilities in CreaCMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) cfg[docume… | Patch early | 7.5 high | 2.2% | 2008-07-25 |
| CVE-2018-13032 EXP | ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/pl_web.cgi/util_configlogin_act URI. | Patch early | 8.8 high | 2.2% | 2018-07-01 |
| CVE-2018-19138 EXP | WSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.html URI. | Patch early | 8.8 high | 2.2% | 2018-11-09 |
| CVE-2017-7571 EXP | public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impact is obtaining admin privileges. | Patch early | 8.0 high | 2.2% | 2017-04-06 |
| CVE-2008-0830 EXP | The Digital Photo Access Protocol (DPAP) server for iPhoto 4.0.3 allows remote attackers to cause a denial of service (crash) via a malformed dpap: UR… | Patch early | 7.5 high | 2.2% | 2008-02-19 |
| CVE-2012-4927 EXP | SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL c… | Patch early | 7.5 high | 2.2% | 2012-09-15 |
| CVE-2026-24486 EXP | Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default con… | Patch early | 8.6 high | 2.2% | 2026-01-27 |
| CVE-2009-4060 EXP | SQL injection vulnerability in includes/content/viewProd.inc.php in CubeCart before 4.3.7 remote attackers to execute arbitrary SQL commands via the p… | Patch early | 7.5 high | 2.2% | 2009-11-24 |
| CVE-2014-4307 EXP | SQL injection vulnerability in categories-x.php in WebTitan before 4.04 allows remote attackers to execute arbitrary SQL commands via the sortkey para… | Patch early | 7.5 high | 2.2% | 2014-06-18 |
| CVE-2014-4852 EXP | SQL injection vulnerability in admin/uploads.php in The Digital Craft AtomCMS, possibly 2.0, allows remote attackers to execute arbitrary SQL commands… | Patch early | 7.5 high | 2.2% | 2014-07-10 |
| CVE-2010-5047 EXP | SQL injection vulnerability in page.php in V-EVA Press Release Script allows remote attackers to execute arbitrary SQL commands via the id parameter. | Patch early | 7.5 high | 2.2% | 2011-11-23 |
| CVE-2015-5591 EXP | SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands. | Patch early | 7.2 high | 2.2% | 2019-12-31 |
| CVE-2013-3536 EXP | SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and earlier for WHMCS allows remote… | Patch early | 7.5 high | 2.2% | 2013-05-13 |
| CVE-2011-5222 EXP | SQL injection vulnerability in rub2_w.php in PHP Flirt-Projekt 4.8 and possibly earlier allows remote attackers to execute arbitrary SQL commands via… | Patch early | 7.5 high | 2.2% | 2012-10-25 |
| CVE-2011-5230 EXP | Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster_core/application/models/LoginModel.php in Seotoaster 1.9… | Patch early | 7.5 high | 2.2% | 2012-10-25 |
| CVE-2011-5218 EXP | SQL injection vulnerability in DotA OpenStats 1.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to inde… | Patch early | 7.5 high | 2.2% | 2012-10-25 |
| CVE-2008-5730 EXP | Multiple CRLF injection vulnerabilities in AIST NetCat 3.12 and earlier allow remote attackers to have an unknown impact via unspecified vectors invol… | Patch early | 7.5 high | 2.2% | 2008-12-26 |
| CVE-2018-8908 EXP | An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious user can craft… | Patch early | 8.8 high | 2.2% | 2018-03-31 |
| CVE-2008-1466 EXP | Multiple PHP remote file inclusion vulnerabilities in W-Agora 4.0 allow remote attackers to execute arbitrary PHP code via a URL in the bn_dir_default… | Patch early | 7.5 high | 2.2% | 2008-03-24 |
| CVE-2011-5229 EXP | SQL injection vulnerability in quickstart/profile/index.php in the Forum module in appRain CMF 0.1.5 allows remote attackers to execute arbitrary SQL… | Patch early | 7.5 high | 2.2% | 2012-10-25 |
| CVE-2012-4282 EXP | SQL injection vulnerability in photo.php in Trombinoscope 3.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. | Patch early | 7.5 high | 2.2% | 2012-08-13 |
| CVE-2013-3531 EXP | SQL injection vulnerability in meneger.php in RadioCMS 2.2 allows remote attackers to execute arbitrary SQL commands via the playlist_id parameter. | Patch early | 7.5 high | 2.2% | 2013-05-10 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt