CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
399,661 CVEs
1,729 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-30
36,574 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-6792 EXP | Google Android prior to 4.4 has an APK Signature Security Bypass Vulnerability | Patch early | 9.8 critical | 3% | 2020-01-23 |
| CVE-2017-17581 EXP | FS Quibids Clone 1.0 has SQL Injection via the itechd.php productid parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17580 EXP | FS Linkedin Clone 1.0 has SQL Injection via the group.php grid parameter, profile.php fid parameter, or company_details.php id parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17576 EXP | FS Gigs Script 1.0 has SQL Injection via the browse-category.php cat parameter, browse-scategory.php sc parameter, or service-provider.php ser paramet… | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17643 EXP | FS Lynda Clone 1.0 has SQL Injection via the keywords parameter to tutorial/. | Patch early | 9.8 critical | 3% | 2017-12-18 |
| CVE-2018-6363 EXP | SQL Injection exists in Task Rabbit Clone 1.0 via the single_blog.php id parameter. | Patch early | 9.8 critical | 3% | 2018-01-29 |
| CVE-2017-17571 EXP | FS Foodpanda Clone 1.0 has SQL Injection via the /food keywords parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17586 EXP | FS Olx Clone 1.0 has SQL Injection via the subpage.php scat parameter or the message.php pid parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17583 EXP | FS Shutterstock Clone 1.0 has SQL Injection via the /Category keywords parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17589 EXP | FS Thumbtack Clone 1.0 has SQL Injection via the browse-category.php cat parameter or the browse-scategory.php sc parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17582 EXP | FS Grubhub Clone 1.0 has SQL Injection via the /food keywords parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17575 EXP | FS Groupon Clone 1.0 has SQL Injection via the item_details.php id parameter or the vendor_details.php id parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17585 EXP | FS Monster Clone 1.0 has SQL Injection via the Employer_Details.php id parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17572 EXP | FS Amazon Clone 1.0 has SQL Injection via the PATH_INFO to /VerAyari. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17578 EXP | FS Crowdfunding Script 1.0 has SQL Injection via the latest_news_details.php id parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17579 EXP | FS Freelancer Clone 1.0 has SQL Injection via the profile.php u parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17588 EXP | FS IMDB Clone 1.0 has SQL Injection via the movie.php f parameter, tvshow.php s parameter, or show_misc_video.php id parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17570 EXP | FS Expedia Clone 1.0 has SQL Injection via the pages.php or content.php id parameter, or the show-flight-result.php fl_orig or fl_dest parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17584 EXP | FS Makemytrip Clone 1.0 has SQL Injection via the show-flight-result.php fl_orig or fl_dest parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17587 EXP | FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or company/index.php c parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17625 EXP | Professional Service Script 1.0 has SQL Injection via the service-list city parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17577 EXP | FS Trademe Clone 1.0 has SQL Injection via the search_item.php search parameter or the general_item_details.php id parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-17574 EXP | FS Care Clone 1.0 has SQL Injection via the searchJob.php jobType or jobFrequency parameter. | Patch early | 9.8 critical | 3% | 2017-12-13 |
| CVE-2017-7312 EXP | An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can add a vendor account or read exis… | Patch early | 9.8 critical | 3% | 2017-06-07 |
| CVE-2023-48974 EXP | Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the se… | Patch early | 9.6 critical | 3% | 2024-02-08 |
| CVE-2017-6089 EXP | SQL injection vulnerability in PhpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) project or id paramet… | Patch early | 9.8 critical | 3% | 2017-10-03 |
| CVE-2026-7567 EXP | The Temporary Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.0.0. This is due to improper input v… | Patch early | 9.8 critical | 2.9% | 2026-05-01 |
| CVE-2017-14396 EXP | In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrat… | Patch early | 9.8 critical | 2.9% | 2017-09-12 |
| CVE-2008-1511 EXP | Multiple PHP remote file inclusion vulnerabilities in ooComments 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the PathToComme… | Patch early | 9.8 critical | 2.9% | 2008-03-25 |
| CVE-2017-15972 EXP | SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sender_id parameter, or the /… | Patch early | 9.8 critical | 2.9% | 2017-10-29 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt