CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
408,143 CVEs
1,741 on KEV
17,306 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
152,631 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2005-4170 EXP | SQL injection vulnerability in eFiction 1.1 allows remote attackers to execute arbitrary SQL commands via the uid parameter to viewuser.php. | Patch early | 7.5 high | 2.1% | 2005-12-11 |
| CVE-2007-6663 EXP | SQL injection vulnerability in (1) Puarcade.php and (2) PUarcade.html.php in Pragmatic Utopia PU Arcade (com_puarcade) 2.0.3, 2.1.2, and 2.1.3 Beta co… | Patch early | 7.5 high | 2.1% | 2008-01-04 |
| CVE-2006-7135 EXP | PHP remote file inclusion vulnerability in lib/functions.inc.php in PHP Poll Creator (phpPC) 1.04 allows remote attackers to execute arbitrary PHP cod… | Patch early | 7.5 high | 2.1% | 2007-03-07 |
| CVE-2007-0354 EXP | SQL injection vulnerability in email.php in MGB OpenSource Guestbook 0.5.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via… | Patch early | 7.5 high | 2.1% | 2007-01-19 |
| CVE-2008-6807 EXP | PHP remote file inclusion vulnerability in ListRecords.php in osprey 1.0a4.1 allows remote attackers to execute arbitrary PHP code via a URL in the xm… | Patch early | 7.5 high | 2.1% | 2009-05-12 |
| CVE-2008-7000 EXP | PHP remote file inclusion vulnerability in index.php in PHPAuction 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the lan para… | Patch early | 7.5 high | 2.1% | 2009-08-19 |
| CVE-2009-3220 EXP | PHP remote file inclusion vulnerability in cp_html2txt.php in All In One Control Panel (AIOCP) 1.4.001 allows remote attackers to execute arbitrary PH… | Patch early | 7.5 high | 2.1% | 2009-09-16 |
| CVE-2010-4914 EXP | PHP remote file inclusion vulnerability in tools/phpmailer/class.phpmailer.php in PHP Classifieds 7.3 allows remote attackers to execute arbitrary PHP… | Patch early | 7.5 high | 2.1% | 2011-10-08 |
| CVE-2002-0951 EXP | SQL injection vulnerability in Ruslan <Body>Builder allows remote attackers to gain administrative privileges via a "'--" sequence in the username and… | Patch early | 10.0 high | 2.1% | 2002-10-04 |
| CVE-2017-8928 EXP | mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF. | Patch early | 8.8 high | 2% | 2017-05-14 |
| CVE-2007-1550 EXP | Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the (1) image_id or (2) cat_id para… | Patch early | 7.5 high | 2% | 2007-03-20 |
| CVE-2009-0707 EXP | SQL injection vulnerability in admin/index.php in PowerClan 1.14a allows remote attackers to execute arbitrary SQL commands via the loginemail paramet… | Patch early | 7.5 high | 2% | 2009-02-23 |
| CVE-2009-1658 EXP | Multiple SQL injection vulnerabilities in admin/admin.php in Realty Webware Technologies Realty Web-Base 1.0 allow remote attackers to execute arbitra… | Patch early | 7.5 high | 2% | 2009-05-18 |
| CVE-2009-1664 EXP | myaccount.php in Easy Scripts Answer and Question Script does not verify the original password before changing passwords, which allows remote attacker… | Patch early | 7.5 high | 2% | 2009-05-18 |
| CVE-2016-5809 EXP | An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 seri… | Patch early | 8.8 high | 2% | 2017-02-13 |
| CVE-2010-2133 EXP | SQL injection vulnerability in contact.php in My Little Forum allows remote attackers to execute arbitrary SQL commands via the id parameter, a differ… | Patch early | 7.5 high | 2% | 2010-06-02 |
| CVE-2010-2141 EXP | SQL injection vulnerability in index.php in NITRO Web Gallery allows remote attackers to execute arbitrary SQL commands via the PictureId parameter in… | Patch early | 7.5 high | 2% | 2010-06-02 |
| CVE-2010-5037 EXP | SQL injection vulnerability in article.php in SenseSites CommonSense CMS allows remote attackers to execute arbitrary SQL commands via the article_id… | Patch early | 7.5 high | 2% | 2011-11-02 |
| CVE-2010-5059 EXP | SQL injection vulnerability in index.php in CMScout 2.0.8 allows remote attackers to execute arbitrary SQL commands via the album parameter in a photo… | Patch early | 7.5 high | 2% | 2011-11-23 |
| CVE-2010-5060 EXP | SQL injection vulnerability in Nus.php in NUs Newssystem 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter. | Patch early | 7.5 high | 2% | 2011-11-23 |
| CVE-2009-0421 EXP | SQL injection vulnerability in the Eventing (com_eventing) 1.6.x component for Joomla! allows remote attackers to execute arbitrary SQL commands via t… | Patch early | 7.5 high | 2% | 2009-02-05 |
| CVE-2009-1323 EXP | SQL injection vulnerability in body.asp in Web File Explorer 3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. | Patch early | 7.5 high | 2% | 2009-04-17 |
| CVE-2009-1651 EXP | SQL injection vulnerability in admin/member_details.php in 2daybiz Business Community Script allows remote attackers to execute arbitrary SQL commands… | Patch early | 7.5 high | 2% | 2009-05-16 |
| CVE-2009-2102 EXP | SQL injection vulnerability in the Jumi (com_jumi) component 2.0.3 and possibly other versions for Joomla allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 2% | 2009-06-17 |
| CVE-2009-2147 EXP | SQL injection vulnerability in fdown.php in phpWebThings 1.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parame… | Patch early | 7.5 high | 2% | 2009-06-22 |
| CVE-2011-5109 EXP | Multiple SQL injection vulnerabilities in Freelancer calendar 1.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the S… | Patch early | 7.5 high | 2% | 2012-08-23 |
| CVE-2006-5720 EXP | SQL injection vulnerability in modules/journal/search.php in the Journal module in Francisco Burzi PHP-Nuke 7.9 and earlier allows remote attackers to… | Patch early | 7.5 high | 2% | 2006-11-04 |
| CVE-2007-0316 EXP | Multiple SQL injection vulnerabilities in All In One Control Panel (AIOCP) 1.3.010 and earlier, when magic_quotes_gpc is disabled, allow remote attack… | Patch early | 7.5 high | 2% | 2007-01-18 |
| CVE-2010-4878 EXP | PHP remote file inclusion vulnerability in formmailer.php in Kontakt Formular 1.1 allows remote attackers to execute arbitrary PHP code via a URL in t… | Patch early | 7.5 high | 2% | 2011-10-07 |
| CVE-2010-4939 EXP | PHP remote file inclusion vulnerability in index.php in MailForm 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the theme para… | Patch early | 7.5 high | 2% | 2011-10-09 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt