CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,610 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
171,884 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2025-51397 EXP | A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scri… | Patch early | 5.4 medium | 1% | 2025-07-21 |
| CVE-2001-0594 EXP | kcms_configure as included with Solaris 7 and 8 allows a local attacker to gain additional privileges via a buffer overflow in a command line argument… | Patch early | 4.6 medium | 1% | 2001-08-02 |
| CVE-2010-5024 EXP | SQL injection vulnerability in manage/add_user.php in CuteSITE CMS 1.2.3 and 1.5.0 allows remote authenticated users, with Read privileges, to execute… | Patch early | 6.0 medium | 1% | 2011-11-02 |
| CVE-2008-6725 EXP | Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1)… | Patch early | 6.0 medium | 1% | 2009-04-17 |
| CVE-2011-1496 EXP | tmux 1.3 and 1.4 does not properly drop group privileges, which allows local users to gain utmp group privileges via a filename to the -S command-line… | Patch early | 4.6 medium | 1% | 2011-04-18 |
| CVE-2014-2851 EXP | Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service… | Patch early | 6.9 medium | 1% | 2014-04-14 |
| CVE-2008-6241 EXP | Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPSite 0.0.1 and 0.0.7, when magic_quotes_gpc is disabled, allow remote attacker… | Patch early | 6.8 medium | 1% | 2009-02-23 |
| CVE-2009-2018 EXP | SQL injection vulnerability in admin/index.php in Jared Eckersley MyCars, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitr… | Patch early | 6.8 medium | 1% | 2009-06-09 |
| CVE-2009-2023 EXP | SQL injection vulnerability in index.php in Shop-Script Pro 2.12, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL… | Patch early | 6.8 medium | 1% | 2009-06-09 |
| CVE-2009-2167 EXP | Multiple SQL injection vulnerabilities in cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier, when magic_quotes_gpc is disabled, allow rem… | Patch early | 6.8 medium | 1% | 2009-06-22 |
| CVE-2009-4732 EXP | SQL injection vulnerability in tt/index.php in TT Web Site Manager 0.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrar… | Patch early | 6.8 medium | 1% | 2010-03-18 |
| CVE-2010-4517 EXP | SQL injection vulnerability in the JExtensions JE Auto (com_jeauto) component 1.0 for Joomla!, when magic_quotes_gpc is disabled, allows remote attack… | Patch early | 6.8 medium | 1% | 2010-12-09 |
| CVE-2007-4602 EXP | SQL injection vulnerability in cms/revert-content.php in Implied by Design Micro CMS (Micro-CMS) 3.5 allows remote attackers to execute arbitrary SQL… | Patch early | 6.8 medium | 1% | 2007-08-31 |
| CVE-2010-0832 EXP | pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubun… | Patch early | 6.9 medium | 0.9% | 2010-07-12 |
| CVE-2009-3975 EXP | SQL injection vulnerability in index.php in Moa Gallery 1.1.0 and 1.2.0 allows remote attackers to execute arbitrary SQL commands via the gallery_id p… | Patch early | 6.8 medium | 0.9% | 2009-11-18 |
| CVE-2008-5000 EXP | SQL injection vulnerability in admin/includes/news.inc.php in PHPX 3.5.16, when magic_quotes_gpc is disabled, allows remote attackers to execute arbit… | Patch early | 6.8 medium | 0.9% | 2008-11-10 |
| CVE-2008-5586 EXP | SQL injection vulnerability in findoffice.php in Check Up New Generation (aka Check New) 4.52, when magic_quotes_gpc is disabled, allows remote attack… | Patch early | 6.8 medium | 0.9% | 2008-12-16 |
| CVE-2008-6165 EXP | SQL injection vulnerability in gestion.php in CSPartner 0.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL comma… | Patch early | 6.8 medium | 0.9% | 2009-02-19 |
| CVE-2011-3479 EXP | Symantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), uses world-writable perm… | Patch early | 6.8 medium | 0.9% | 2012-01-25 |
| CVE-2008-0714 EXP | SQL injection vulnerability in users.php in Mihalism Multi Host allows remote attackers to execute arbitrary SQL commands via the username parameter i… | Patch early | 6.8 medium | 0.9% | 2008-02-12 |
| CVE-2008-1911 EXP | SQL injection vulnerability in includes/system.php in 1024 CMS 1.4.2 beta and earlier, when magic_quotes_gpc is disabled, allows remote attackers to e… | Patch early | 6.8 medium | 0.9% | 2008-04-22 |
| CVE-2008-2479 EXP | Multiple SQL injection vulnerabilities in phpFix 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) kind parameter to fix/browse… | Patch early | 6.8 medium | 0.9% | 2008-05-28 |
| CVE-2008-2522 EXP | SQL injection vulnerability in members.php in Battle.net Clan Script for PHP 1.5.3 and earlier, when magic_quotes_gpc is disabled, allows remote attac… | Patch early | 6.8 medium | 0.9% | 2008-06-03 |
| CVE-2008-3133 EXP | SQL injection vulnerability in admin/index.php in BareNuked CMS 1.1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 0.9% | 2008-07-10 |
| CVE-2008-4091 EXP | SQL injection vulnerability in index.php in Web Directory Script 1.5.3 allows remote attackers to execute arbitrary SQL commands via the site paramete… | Patch early | 6.8 medium | 0.9% | 2008-09-15 |
| CVE-2012-6047 EXP | Cross-site request forgery (CSRF) vulnerability in X7 Chat 2.0.5.1 and earlier allows remote attackers to hijack the authentication of administrators… | Patch early | 6.8 medium | 0.9% | 2012-11-27 |
| CVE-2009-1409 EXP | SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magic_quotes_gpc is disabled, a… | Patch early | 5.1 medium | 0.9% | 2009-04-24 |
| CVE-2010-0411 EXP | Multiple integer signedness errors in the (1) __get_argv and (2) __get_compat_argv functions in tapset/aux_syscalls.stp in SystemTap 1.1 allow local u… | Patch early | 4.9 medium | 0.9% | 2010-02-08 |
| CVE-2012-0286 EXP | Cross-site request forgery (CSRF) vulnerability in Stoneware webNetwork before 6.0.8.0 allows remote attackers to hijack the authentication of unspeci… | Patch early | 6.8 medium | 0.9% | 2012-01-24 |
| CVE-2007-5458 EXP | SQL injection vulnerability in index.php in the newsletter module 1.0 for KwsPHP, when magic_quotes_gpc is disabled, allows remote attackers to execut… | Patch early | 6.8 medium | 0.9% | 2007-10-14 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt