CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
408,195 CVEs
1,745 on KEV
17,306 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-15
152,656 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-4943 EXP | Multiple PHP remote file inclusion vulnerabilities in Saurus CMS 4.7.0 allow remote attackers to execute arbitrary PHP code via a URL in the class_pat… | Patch early | 7.5 high | 2% | 2011-10-09 |
| CVE-2010-4948 EXP | PHP remote file inclusion vulnerability in libs/adodb/adodb.inc.php in PHP Free Photo Gallery script allows remote attackers to execute arbitrary PHP… | Patch early | 7.5 high | 2% | 2011-10-09 |
| CVE-2010-4967 EXP | SQL injection vulnerability in default.asp in ATCOM Netvolution 2.5.6 allows remote attackers to execute arbitrary SQL commands via the artID paramete… | Patch early | 7.5 high | 2% | 2011-10-21 |
| CVE-2010-5019 EXP | SQL injection vulnerability in view_photo.php in 2daybiz Online Classified Script allows remote attackers to execute arbitrary SQL commands via the al… | Patch early | 7.5 high | 2% | 2011-11-02 |
| CVE-2010-5053 EXP | SQL injection vulnerability in the XOBBIX (com_xobbix) component 1.0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the p… | Patch early | 7.5 high | 2% | 2011-11-23 |
| CVE-2011-0510 EXP | SQL injection vulnerability in cart.php in Advanced Webhost Billing System (AWBS) 2.9.2 and possibly earlier allows remote attackers to execute arbitr… | Patch early | 7.5 high | 2% | 2011-01-20 |
| CVE-2009-5094 EXP | SQL injection vulnerability in info.php in CMS Faethon 2.2.0 Ultimate allows remote attackers to execute arbitrary SQL commands via the item parameter… | Patch early | 7.5 high | 2% | 2011-09-12 |
| CVE-2014-4322 EXP | drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devi… | Patch early | 7.2 high | 2% | 2014-12-24 |
| CVE-2013-5030 EXP | Ruckus Wireless Zoneflex 2942 devices with firmware 9.6.0.0.267 allow remote attackers to bypass authentication, and subsequently access certain confi… | Patch early | 7.2 high | 2% | 2013-10-16 |
| CVE-2006-4064 EXP | SQL injection vulnerability in default.asp in YenerTurk Haber Script 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the… | Patch early | 7.5 high | 2% | 2006-08-10 |
| CVE-2007-6666 EXP | SQL injection vulnerability in rss.php in Zenphoto 1.1 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the albumnr paramet… | Patch early | 7.5 high | 2% | 2008-01-04 |
| CVE-2010-1583 EXP | SQL injection vulnerability in the loadByKey function in the TznDbConnection class in tzn_mysql.php in Tirzen (aka TZN) Framework 1.5, as used in Task… | Patch early | 7.5 high | 2% | 2010-05-06 |
| CVE-2009-1346 EXP | SQL injection vulnerability in publico/ficha.php in NetHoteles 3.0 allows remote attackers to execute arbitrary SQL commands via the id_establecimient… | Patch early | 7.5 high | 2% | 2009-04-20 |
| CVE-2007-1250 EXP | SQL injection vulnerability in section/default.asp in ANGEL Learning Management Suite (LMS) 7.1 allows remote attackers to execute arbitrary SQL comma… | Patch early | 7.5 high | 2% | 2007-03-03 |
| CVE-2005-3324 EXP | SQL injection vulnerability in chat.php in MWChat 6.8 allows remote attackers to execute arbitrary SQL commands via the username parameter. | Patch early | 7.5 high | 2% | 2005-10-27 |
| CVE-2010-2319 EXP | SQL injection vulnerability in index.php in IDevSpot TextAds 2.08 allows remote attackers to execute arbitrary SQL commands via the page parameter. | Patch early | 7.5 high | 2% | 2010-06-17 |
| CVE-2010-2142 EXP | SQL injection vulnerability in default.asp in Cyberhost allows remote attackers to execute arbitrary SQL commands via the id parameter. | Patch early | 7.5 high | 2% | 2010-06-02 |
| CVE-2009-0726 EXP | SQL injection vulnerability in the GigCalendar (com_gigcal) component 1.0 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL comma… | Patch early | 7.5 high | 2% | 2009-02-24 |
| CVE-2009-1508 EXP | SQL injection vulnerability in the xforum_validateUser function in Common.php in X-Forum 0.6.2 allows remote attackers to execute arbitrary SQL comman… | Patch early | 7.5 high | 2% | 2009-05-01 |
| CVE-2007-1297 EXP | SQL injection vulnerability in view_profile.php in AJDating 1.0 allows remote attackers to execute arbitrary SQL commands via the user_id parameter. | Patch early | 7.5 high | 2% | 2007-03-07 |
| CVE-2007-6458 EXP | SQL injection vulnerability in shop/mainfile.php in 123tkShop 0.9.1 allows remote attackers to execute arbitrary SQL commands via a base64-encoded val… | Patch early | 7.5 high | 2% | 2007-12-20 |
| CVE-2007-6665 EXP | SQL injection vulnerability in admin/login.asp in Netchemia oneSCHOOL allows remote attackers to execute arbitrary SQL commands via the txtLoginID par… | Patch early | 7.5 high | 2% | 2008-01-04 |
| CVE-2008-0442 EXP | PHP remote file inclusion vulnerability in inc/linkbar.php in Small Axe Weblog 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL i… | Patch early | 7.5 high | 2% | 2008-01-25 |
| CVE-2006-6066 EXP | Multiple SQL injection vulnerabilities in Dragon Calendar / Events Listing 2.x allow remote attackers to execute arbitrary SQL commands via the (1) us… | Patch early | 7.5 high | 2% | 2006-11-22 |
| CVE-2011-4026 EXP | SQL injection vulnerability in thanks.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. | Patch early | 7.5 high | 2% | 2011-10-21 |
| CVE-2015-5736 EXP | The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel privileges by setting the cal… | Patch early | 7.2 high | 2% | 2015-09-03 |
| CVE-2008-7075 EXP | Multiple SQL injection vulnerabilities in Kalptaru Infotech Ltd. Star Articles 6.0 allow remote attackers to inject arbitrary SQL commands via (1) the… | Patch early | 7.5 high | 2% | 2009-08-25 |
| CVE-2018-13989 EXP | Grundig Smart Inter@ctive TV 3.0 devices allow CSRF attacks via a POST request to TCP port 8085 containing a predictable ID value, as demonstrated by… | Patch early | 8.8 high | 2% | 2018-07-11 |
| CVE-2007-2641 EXP | SQL injection vulnerability in W1L3D4_bolum.asp in W1L3D4 Philboard 0.2 allows remote attackers to execute arbitrary SQL commands via the forumid para… | Patch early | 7.5 high | 2% | 2007-05-13 |
| CVE-2005-1779 EXP | SQL injection vulnerability in password.asp in MaxWebPortal 1.35, 1.36, 2.0, and 20050418 Next allows remote attackers to execute arbitrary SQL comman… | Patch early | 7.5 high | 2% | 2005-05-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt