CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,516 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
209,620 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-4631 EXP | Multiple cross-site scripting (XSS) vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1… | Patch early | 4.3 medium | 1.8% | 2010-12-30 |
| CVE-2010-4873 EXP | Cross-site scripting (XSS) vulnerability in confirm.php in WeBid 0.8.5 P1 allows remote attackers to inject arbitrary web script or HTML via the id pa… | Patch early | 4.3 medium | 1.8% | 2011-10-07 |
| CVE-2010-5010 EXP | Cross-site scripting (XSS) vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers to inject arbitrary web script… | Patch early | 4.3 medium | 1.8% | 2011-11-02 |
| CVE-2010-5027 EXP | Cross-site scripting (XSS) vulnerability in winners.php in Science Fair In A Box (SFIAB) 2.0.6 and 2.2.0 allows remote attackers to inject arbitrary w… | Patch early | 4.3 medium | 1.8% | 2011-11-02 |
| CVE-2010-5035 EXP | Cross-site scripting (XSS) vulnerability in search.php in iScripts eSwap 2.0 allows remote attackers to inject arbitrary web script or HTML via the tx… | Patch early | 4.3 medium | 1.8% | 2011-11-02 |
| CVE-2008-0359 EXP | Multiple cross-site scripting (XSS) vulnerabilities in BLOG:CMS 4.2.1b allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO… | Patch early | 4.3 medium | 1.8% | 2008-01-18 |
| CVE-2008-1414 EXP | Cross-site scripting (XSS) vulnerability in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 1.8% | 2008-03-20 |
| CVE-2008-1991 EXP | Cross-site scripting (XSS) vulnerability in admin_colors_swatch.asp in Acidcat CMS 3.4.1 allows remote attackers to inject arbitrary web script or HTM… | Patch early | 4.3 medium | 1.8% | 2008-04-27 |
| CVE-2006-6887 EXP | Unrestricted file upload vulnerability in logahead UNU 1.0 allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors re… | Patch early | 6.8 medium | 1.8% | 2006-12-31 |
| CVE-2006-6198 EXP | Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated users to inject arbitrary web scr… | Patch early | 6.0 medium | 1.8% | 2006-12-01 |
| CVE-2003-1536 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Codeworx Technologies DCP-Portal 5.3.1 allow remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 1.8% | 2003-12-31 |
| CVE-2004-2725 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Aztek Forum 4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the searc… | Patch early | 4.3 medium | 1.8% | 2004-12-31 |
| CVE-2008-0190 EXP | Multiple cross-site scripting (XSS) vulnerabilities in templates/example_template.php in AwesomeTemplateEngine allow remote attackers to inject arbitr… | Patch early | 4.3 medium | 1.8% | 2008-01-10 |
| CVE-2009-1334 EXP | Cross-site scripting (XSS) vulnerability in login/FilepathLogin.html in IBM Tivoli Continuous Data Protection (CDP) for Files 3.1.4.0 allows remote at… | Patch early | 4.3 medium | 1.8% | 2009-04-17 |
| CVE-2011-0005 EXP | Cross-site scripting (XSS) vulnerability in the com_search module for Joomla! 1.0.x through 1.0.15 allows remote attackers to inject arbitrary web scr… | Patch early | 4.3 medium | 1.8% | 2011-01-11 |
| CVE-2006-2390 EXP | Cross-site scripting (XSS) vulnerability in OZJournals 1.2 allows remote attackers to inject arbitrary web script or HTML via the vname parameter in t… | Patch early | 5.8 medium | 1.8% | 2006-05-16 |
| CVE-2021-30030 EXP | Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php. | Patch early | 5.4 medium | 1.8% | 2021-04-13 |
| CVE-2021-30034 EXP | Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php. | Patch early | 5.4 medium | 1.8% | 2021-04-13 |
| CVE-2021-30039 EXP | Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-report.php. | Patch early | 5.4 medium | 1.8% | 2021-04-13 |
| CVE-2021-30042 EXP | Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Clinic Name", "Clinic Address", "Clinic City", or "Clinic Contact" field on clinics/register… | Patch early | 5.4 medium | 1.8% | 2021-04-13 |
| CVE-2021-30044 EXP | Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php. | Patch early | 5.4 medium | 1.8% | 2021-04-13 |
| CVE-2006-3974 EXP | Cross-site scripting (XSS) vulnerability in cgi-bin/admin in 3Com OfficeConnect Secure Router with firmware 1.04-168 allows remote attackers to inject… | Patch early | 4.3 medium | 1.8% | 2007-06-11 |
| CVE-2005-0857 EXP | Cross-site scripting (XSS) vulnerability in avatar.php for CoolForum 0.8 and earlier allows remote attackers to inject arbitrary web script or HTML vi… | Patch early | 4.3 medium | 1.8% | 2005-05-02 |
| CVE-2003-1271 EXP | Cross-site scripting vulnerability (XSS) in AN HTTP 1.41e allows remote attackers to execute arbitrary web script or HTML as other users via a URL con… | Patch early | 4.3 medium | 1.8% | 2003-12-31 |
| CVE-2007-4334 EXP | Cross-site scripting (XSS) vulnerability in whois.php in Php-stats 0.1.9.2 allows remote attackers to inject arbitrary web script or HTML via the IP p… | Patch early | 4.3 medium | 1.8% | 2007-08-14 |
| CVE-2006-5983 EXP | Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users to inject arbitrary web scrip… | Patch early | 6.0 medium | 1.8% | 2006-11-20 |
| CVE-2007-2908 EXP | Cross-site scripting (XSS) vulnerability in calendar.php in Jelsoft vBulletin before 3.6.6 allows remote attackers to inject arbitrary web script or H… | Patch early | 4.3 medium | 1.8% | 2007-05-30 |
| CVE-2026-24421 EXP | phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint… | Patch early | 6.5 medium | 1.8% | 2026-01-24 |
| CVE-2005-2588 EXP | Multiple cross-site scripting (XSS) vulnerabilities in DVBBS 7.1 SP2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1)… | Patch early | 4.3 medium | 1.8% | 2005-08-17 |
| CVE-2007-2013 EXP | Cross-site scripting (XSS) vulnerability in index.php in JEx-Treme Einfacher Passworschutz allows remote attackers to inject arbitrary web script or H… | Patch early | 4.3 medium | 1.8% | 2007-04-12 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt