CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
408,195 CVEs
1,745 on KEV
17,306 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-15
152,656 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-6649 EXP | SQL injection vulnerability in manager/image_details_editor.php in Ktools PhotoStore 2.5, 2.9.8, 3.1.0, and other versions through 3.5.2 allows remote… | Patch early | 7.5 high | 2% | 2009-04-07 |
| CVE-2009-4571 EXP | Multiple SQL injection vulnerabilities in index.php in PhpShop 0.8.1 allow remote attackers to execute arbitrary SQL commands via the (1) module_id pa… | Patch early | 7.5 high | 2% | 2010-01-05 |
| CVE-2005-3968 EXP | SQL injection vulnerability in auth.inc.php in PHPX 3.5.9 and earlier allows remote attackers to execute arbitrary SQL commands, bypass authentication… | Patch early | 7.5 high | 2% | 2005-12-03 |
| CVE-2007-0574 EXP | SQL injection vulnerability in rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.40 allows remote attackers to execu… | Patch early | 7.5 high | 2% | 2007-01-30 |
| CVE-2013-7043 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2.0.2r1262-090417 allow remote… | Patch early | 8.3 high | 2% | 2013-12-10 |
| CVE-2008-3491 EXP | SQL injection vulnerability in go.php in Scripts24 iPost 1.0.1 and iTGP 1.0.4 allows remote attackers to execute arbitrary SQL commands via the id par… | Patch early | 7.5 high | 2% | 2008-08-06 |
| CVE-2006-6111 EXP | Multiple SQL injection vulnerabilities in Alan Ward A-Cart Pro 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) productid para… | Patch early | 7.5 high | 2% | 2006-11-26 |
| CVE-2008-2510 EXP | SQL injection vulnerability in wp-uploadfile.php in the Upload File plugin for WordPress allows remote attackers to execute arbitrary SQL commands via… | Patch early | 7.5 high | 2% | 2008-05-29 |
| CVE-2008-6509 EXP | SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrary SQL commands via t… | Patch early | 7.5 high | 2% | 2009-03-23 |
| CVE-2007-3913 EXP | SQL injection vulnerability in Gforge before 3.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | Patch early | 7.5 high | 2% | 2007-09-06 |
| CVE-2006-2732 EXP | SQL injection vulnerability in Your_Account.asp in Mini-Nuke 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) yas… | Patch early | 7.5 high | 2% | 2006-06-01 |
| CVE-2006-3572 EXP | SQL injection vulnerability in forumthread.php in Papoo 3 RC3 and earlier allows remote attackers to execute arbitrary SQL commands via the msgid para… | Patch early | 7.5 high | 2% | 2006-07-13 |
| CVE-2009-4599 EXP | Multiple SQL injection vulnerabilities in the JS Jobs (com_jsjobs) component 1.0.5.6 for Joomla! allow remote attackers to execute arbitrary SQL comma… | Patch early | 7.5 high | 2% | 2010-01-12 |
| CVE-2008-2688 EXP | SQL injection vulnerability in pilot.asp in ASPilot Pilot Cart 7.3 allows remote attackers to execute arbitrary SQL commands via the article parameter… | Patch early | 7.5 high | 2% | 2008-06-13 |
| CVE-2008-4203 EXP | SQL injection vulnerability in cn_users.php in CzarNews 1.20 and earlier allows remote attackers to execute arbitrary SQL commands via a recook cookie… | Patch early | 7.5 high | 2% | 2008-09-24 |
| CVE-2008-5864 EXP | SQL injection vulnerability in the Top Hotel (com_tophotelmodule) component 1.0 in the Hotel Booking Reservation System (aka HBS) 1.0.0 for Joomla! al… | Patch early | 7.5 high | 2% | 2009-01-06 |
| CVE-2008-5208 EXP | SQL injection vulnerability in sub_votepic.php in the Datsogallery (com_datsogallery) module 1.6 for Joomla! allows remote attackers to execute arbitr… | Patch early | 7.5 high | 2% | 2008-11-24 |
| CVE-2008-6371 EXP | SQL injection vulnerability in login.asp in Ocean12 Membership Manager Pro allows remote attackers to execute arbitrary SQL commands via the username… | Patch early | 7.5 high | 2% | 2009-03-02 |
| CVE-2008-6653 EXP | SQL injection vulnerability in webhosting.php in the Webhosting Component (com_webhosting) module before 1.1 RC7 for Joomla! and Mambo allows remote a… | Patch early | 7.5 high | 2% | 2009-04-07 |
| CVE-2008-1919 EXP | SQL injection vulnerability in listtest.php in YourFreeWorld Apartment Search Script allows remote attackers to execute arbitrary SQL commands via the… | Patch early | 7.5 high | 2% | 2008-04-23 |
| CVE-2007-1510 EXP | SQL injection vulnerability in post.php in Particle Blogger 1.0.0 through 1.2.0 allows remote attackers to execute arbitrary SQL commands via the post… | Patch early | 7.5 high | 2% | 2007-03-20 |
| CVE-2006-1123 EXP | SQL injection vulnerability in D2KBlog 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the memName parameter in a cook… | Patch early | 10.0 high | 2% | 2006-03-09 |
| CVE-2009-3055 EXP | PHP remote file inclusion vulnerability in engine/api/api.class.php in DataLife Engine (DLE) 8.2 allows remote attackers to execute arbitrary PHP code… | Patch early | 7.5 high | 2% | 2009-09-03 |
| CVE-2009-3333 EXP | PHP remote file inclusion vulnerability in koesubmit.php in the koeSubmit (com_koesubmit) component 1.0 for Mambo allows remote attackers to execute a… | Patch early | 7.5 high | 2% | 2009-09-23 |
| CVE-2009-2777 EXP | SQL injection vulnerability in visitor/view.php in GarageSales Script allows remote attackers to execute arbitrary SQL commands via the key parameter. | Patch early | 7.5 high | 2% | 2009-08-14 |
| CVE-2009-3543 EXP | SQL injection vulnerability in _phenotype/admin/login.php in Phenotype CMS before 2.9 allows remote attackers to execute arbitrary SQL commands via th… | Patch early | 7.5 high | 2% | 2009-10-02 |
| CVE-2009-3718 EXP | SQL injection vulnerability in admin/authenticate.asp in Battle Blog 1.25 and 1.30 build 2 allows remote attackers to execute arbitrary SQL commands v… | Patch early | 7.5 high | 2% | 2009-10-16 |
| CVE-2009-4203 EXP | Multiple SQL injection vulnerabilities in admin/aclass/admin_func.php in Arab Portal 2.2 allow remote attackers to execute arbitrary SQL commands via… | Patch early | 7.5 high | 2% | 2009-12-04 |
| CVE-2008-2453 EXP | Multiple SQL injection vulnerabilities in PHP Classifieds Script allow remote attackers to execute arbitrary SQL commands via the fatherID parameter t… | Patch early | 7.5 high | 2% | 2008-05-27 |
| CVE-2008-5969 EXP | SQL injection vulnerability in popupproduct.php in Sunbyte e-Flower allows remote attackers to execute arbitrary SQL commands via the id parameter. | Patch early | 7.5 high | 2% | 2009-01-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt