Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
396,416 CVEs1,721 in CISA KEV17,395 with EPSS ≥ 10%25,049 with a public exploitUpdated 23 September 2026
25,049 results · page 156 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2012-1467 | Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in Open Journal Systems before 2.3.7, allow remote authenticated users to (1) delete or (2) rename arbitrary files via a .. | EXPLOIT ✓MEDIUM 6.5EPSS 3.00% | 6 September 2012 |
| CVE-2006-7247 | SQL injection vulnerability in the Weblinks (com_weblinks) component for Joomla! and Mambo 1.0.9 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.12% | 6 September 2012 |
| CVE-2012-1112 | Directory traversal vulnerability in Open-Realty CMS 2.5.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 2.83% | 6 September 2012 |
| CVE-2012-1110 | Multiple cross-site scripting (XSS) vulnerabilities in Etano 1.22 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user, (2) email, (3) email2, (4) f17_zip, or (5) agree parameter to join.php; (6) PATH_INFO, (7) st,… | EXPLOIT ×3 ✓MEDIUM 4.3EPSS 2.71% | 6 September 2012 |
| CVE-2012-4870 | Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) context parameter to panel/index_amp.php or (2) panel/dhtml/index.php; (3) clid or (4) clidname… | EXPLOIT ✓MEDIUM 4.3EPSS 2.00% | 6 September 2012 |
| CVE-2012-4869 | The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action. | EXPLOIT ×3 ✓HIGH 7.5EPSS 70.3% | 6 September 2012 |
| CVE-2012-4867 | Directory traversal vulnerability in modules/com_vtiger_workflow/sortfieldsjson.php in vtiger CRM 5.1.0 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 3.84% | 6 September 2012 |
| CVE-2012-4865 | Buffer overflow in Oreans Themida 2.1.8.0 allows remote attackers to execute arbitrary code via a crafted .TMD file. | EXPLOITHIGH 9.3EPSS 6.28% | 6 September 2012 |
| CVE-2012-4864 | Oreans WinLicense 2.1.8.0 allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via a crafted xml file. | EXPLOITHIGH 9.3EPSS 5.63% | 6 September 2012 |
| CVE-2012-2741 | Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a reconcileusers action. | EXPLOIT ✓MEDIUM 4.3EPSS 2.86% | 6 September 2012 |
| CVE-2012-2740 | SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action. | EXPLOIT ✓HIGH 7.5EPSS 3.33% | 6 September 2012 |
| CVE-2011-5155 | Untrusted search path vulnerability in Help & Manual 5.5.1 Build 1296 allows local users to gain privileges via a Trojan horse ijl15.dll file in the current working directory, as demonstrated by a directory that contains a .hmxz, .hmxp, .hmskin, .hmx,… | EXPLOIT ✓MEDIUM 6.3EPSS 0.71% | 6 September 2012 |
| CVE-2010-5195 | Untrusted search path vulnerability in Roxio MyDVD 9 allows local users to gain privileges via a Trojan horse HomeUtils9.dll file in the current working directory, as demonstrated by a directory that contains a .dmsd or .dmsm file. | EXPLOITMEDIUM 6.9EPSS 0.89% | 6 September 2012 |
| CVE-2012-3551 | Cross-site scripting (XSS) vulnerability in crowbar_framework/app/views/support/index.html.haml in the Crowbar barclamp in Crowbar, possibly 1.4 and earlier, allows remote attackers to inject arbitrary web script or HTML via the file parameter to /utils. | EXPLOIT ✓MEDIUM 4.3EPSS 3.32% | 5 September 2012 |
| CVE-2011-4452 | Cross-site request forgery (CSRF) vulnerability in the AdminUsers component in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to hijack the authentication of administrators for requests that remove arbitrary user accounts via a delete operation, as… | EXPLOITMEDIUM 6.8EPSS 2.30% | 5 September 2012 |
| CVE-2011-4451 | libs/Wakka.class.php in WikkaWiki 1.3.1 and 1.3.2, when the spam_logging option is enabled, allows remote attackers to write arbitrary PHP code to the spamlog_path file via the User-Agent HTTP header in an addcomment request. | EXPLOITMEDIUM 4.3EPSS 14.2% | 5 September 2012 |
| CVE-2011-4450 | Directory traversal vulnerability in handlers/files.xml/files.xml.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to read or delete arbitrary files via a non-initial .. | EXPLOITMEDIUM 6.4EPSS 7.48% | 5 September 2012 |
| CVE-2011-4449 | actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANET_MODE is enabled, supports file uploads for file extensions that are typically absent from an Apache HTTP Server TypesConfig file, which makes it easier for remote attackers to execute… | EXPLOIT ×2 ✓MEDIUM 6.8EPSS 4.14% | 5 September 2012 |
| CVE-2011-4448 | SQL injection vulnerability in actions/usersettings/usersettings.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to execute arbitrary SQL commands via the default_comment_display parameter in an update action. | EXPLOITHIGH 7.5EPSS 1.94% | 5 September 2012 |
| CVE-2012-2109 | SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attackers to execute arbitrary SQL commands via the page parameter in an activity_widget_filter action. | EXPLOIT ✓HIGH 7.5EPSS 3.36% | 4 September 2012 |
| CVE-2012-1614 | Coppermine Photo Gallery before 1.5.20 allows remote attackers to obtain sensitive information via (1) a direct request to plugins/visiblehookpoints/index.php, an invalid (2) page or (3) cat parameter to thumbnails.php, an invalid (4) page parameter to… | EXPLOIT ✓MEDIUM 5.0EPSS 8.71% | 4 September 2012 |
| CVE-2012-1613 | Cross-site scripting (XSS) vulnerability in edit_one_pic.php in Coppermine Photo Gallery before 1.5.20 allows remote authenticated users with certain privileges to inject arbitrary web script or HTML via the keywords parameter. | EXPLOIT ✓LOW 3.5EPSS 2.19% | 4 September 2012 |
| CVE-2012-2288 | Format string vulnerability in the nsrd RPC service in EMC NetWorker 7.6.3 and 7.6.4 before 7.6.4.1, and 8.0 before 8.0.0.1, allows remote attackers to execute arbitrary code via format string specifiers in a message. | EXPLOIT ✓HIGH 9.3EPSS 33.1% | 4 September 2012 |
| CVE-2012-4746 | Cross-site request forgery (CSRF) vulnerability in accessaccount.cgi in ZTE ZXDSL 831IIV7.5.0a_Z29_OV allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysPassword parameter. | EXPLOIT ×2MEDIUM 6.8EPSS 1.09% | 31 August 2012 |
| CVE-2012-4745 | Cross-site scripting (XSS) vulnerability in admin/login.asp in Acuity CMS 2.6.2 allows remote attackers to inject arbitrary web script or HTML via the UserName parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.64% | 31 August 2012 |
| CVE-2011-5150 | Multiple cross-site scripting (XSS) vulnerabilities in SpamTitan 5.07 and possibly earlier allow remote attackers or authenticated users to inject arbitrary web script or HTML via the (1) ipaddress or (2) domain parameter to setup-network.php, different… | EXPLOIT ✓MEDIUM 4.3EPSS 1.46% | 31 August 2012 |
| CVE-2011-5149 | Multiple cross-site scripting (XSS) vulnerabilities in SpamTitan 5.08 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) testaddr or (2) testpass parameter to auth-settings.php; (3) hostname, (4) domainname, or (5)… | EXPLOIT ✓MEDIUM 4.3EPSS 2.08% | 31 August 2012 |
| CVE-2011-5148 | Multiple incomplete blacklist vulnerabilities in the Simple File Upload (mod_simplefileuploadv1.3) module before 1.3.5 for Joomla! allow remote attackers to execute arbitrary code by uploading a file with a (1) php5, (2) php6, or (3) double (e.g.… | EXPLOITMEDIUM 6.8EPSS 4.84% | 31 August 2012 |
| CVE-2011-5147 | Static code injection vulnerability in ajax_save_name.php in the Ajax File Manager module in the tinymce plugin in FreeWebshop 2.2.9 R2 and earlier allows remote attackers to inject arbitrary PHP code into data.php via the selected document, as… | EXPLOIT ✓MEDIUM 5.0EPSS 2.29% | 31 August 2012 |
| CVE-2011-5140 | Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the (1) start parameter to (a) tags.php, (b) list.php, (c) index.php, (d) main_index.php, (e) viewpost.php, (f)… | EXPLOIT ✓HIGH 7.5EPSS 1.80% | 31 August 2012 |
| CVE-2011-5139 | SQL injection vulnerability in page.php in Pre Studio Business Cards Designer allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.11% | 31 August 2012 |
| CVE-2010-5194 | Stack-based buffer overflow in the Image2PDF function in the SCRIBBLE.ScribbleCtrl.1 ActiveX control (ImageViewer2.ocx) in Viscom Image Viewer CP Pro 8.0, Gold 5.5, Gold 6.0, and earlier allows remote attackers to execute arbitrary code via a long… | EXPLOIT ×2 ✓HIGH 9.3EPSS 6.34% | 31 August 2012 |
| CVE-2010-5193 | Stack-based buffer overflow in the TIFMergeMultiFiles function in the SCRIBBLE.ScribbleCtrl.1 ActiveX control (ImageViewer2.ocx) in Viscom Image Viewer CP Pro 8.0 and Gold 6.0 allows remote attackers to execute arbitrary code via a long strDelimit… | EXPLOIT ×2 ✓HIGH 9.3EPSS 32.0% | 31 August 2012 |
| CVE-2012-4739 | Multiple cross-site scripting (XSS) vulnerabilities in Barracuda SSL VPN before 2.2.2.203 (2012-07-05) allow remote attackers to inject arbitrary web script or HTML via the (1) policyLaunching, (2) resourcePrefix, or (3) actionPath parameter in… | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 3.29% | 31 August 2012 |
| CVE-2012-4600 | Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.14, 3.0.x before 3.0.16, and 3.1.x before 3.1.10, when Firefox or Opera is used, allows remote attackers to inject arbitrary web script or HTML via… | EXPLOIT ×2 ✓LOW 2.6EPSS 6.35% | 31 August 2012 |
| CVE-2012-4170 | Buffer overflow in Adobe Photoshop CS6 13.x before 13.0.1 allows remote attackers to execute arbitrary code via a crafted file. | EXPLOIT ✓HIGH 9.3EPSS 11.0% | 31 August 2012 |
| CVE-2012-0547 | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier, and 6 Update 34 and earlier, has no impact and remote attack vectors involving AWT and "a security-in-depth issue that is not directly… | EXPLOIT ✓LOW 0.0EPSS 12.5% | 30 August 2012 |
| CVE-2011-5135 | Multiple SQL injection vulnerabilities in the save_connection function in lib/lib.iotask.php in the iotask module in DoceboLMS 4.0.4 and earlier allow remote authenticated users with admin or teacher privileges to execute arbitrary SQL commands via the… | EXPLOIT ✓MEDIUM 6.0EPSS 0.92% | 30 August 2012 |
| CVE-2011-5130 | dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter. | EXPLOIT ×2 ✓MEDIUM 6.8EPSS 36.5% | 30 August 2012 |
| CVE-2011-5129 | Heap-based buffer overflow in XChat 2.8.9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long response string. | EXPLOIT ✓MEDIUM 5.0EPSS 7.70% | 30 August 2012 |
| CVE-2011-1398 | The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a… | EXPLOIT ✓MEDIUM 4.3EPSS 10.2% | 30 August 2012 |
| CVE-2011-2777 | samples/powerbtn/powerbtn.sh in acpid (aka acpid2) 2.0.16 and earlier uses the pidof program incorrectly, which allows local users to gain privileges by running a program with the name kded4 and a DBUS_SESSION_BUS_ADDRESS environment variable containing… | EXPLOITMEDIUM 4.4EPSS 0.61% | 29 August 2012 |
| CVE-2012-3579 | Symantec Messaging Gateway (SMG) before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers to obtain privileged access via an SSH session. | EXPLOIT ✓HIGH 7.9EPSS 40.2% | 29 August 2012 |
| CVE-2012-0308 | Cross-site request forgery (CSRF) vulnerability in Symantec Messaging Gateway (SMG) before 10.0 allows remote attackers to hijack the authentication of administrators. | EXPLOITMEDIUM 6.8EPSS 1.92% | 29 August 2012 |
| CVE-2011-4926 | Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 10.9% | 29 August 2012 |
| CVE-2011-4918 | Multiple cross-site scripting (XSS) vulnerabilities in Elxis CMS 2009.2, 2009.3 and 2009.3 Aphrodite before revision 2684 allow remote attackers to inject arbitrary web script or HTML via the (1) task parameter to elxis/index.php, and (2) PATH_INFO to… | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 2.11% | 29 August 2012 |
| CVE-2012-4686 | SQL injection vulnerability in announcement.php in vBulletin 4.1.10 allows remote attackers to execute arbitrary SQL commands via the announcementid parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.11% | 28 August 2012 |
| CVE-2012-4685 | Cross-site scripting (XSS) vulnerability in Arbor Networks Peakflow SP 5.1.1 before patch 6, 5.5 before patch 4, and 5.6.0 before patch 1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index. | EXPLOIT ✓MEDIUM 4.3EPSS 1.82% | 28 August 2012 |
| CVE-2012-3539 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. | EXPLOIT ✓UnscoredEPSS — | 28 August 2012 |
| CVE-2012-4681 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | KEVEXPLOIT ✓CRITICAL 9.8EPSS 98.5% | 28 August 2012 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.