Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
397,441 CVEs1,723 in CISA KEV17,397 with EPSS ≥ 10%25,049 with a public exploitUpdated 24 September 2026
25,049 results · page 202 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2010-0966 | PHP remote file inclusion vulnerability in inc/config.php in deV!L`z Clanportal (DZCP) 1.5.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 2.40% | 16 March 2010 |
| CVE-2010-0964 | SQL injection vulnerability in start.php in Eros Webkatalog allows remote attackers to execute arbitrary SQL commands via the id parameter in a rubrik action. | EXPLOIT ✓HIGH 7.5EPSS 1.16% | 16 March 2010 |
| CVE-2009-4717 | Multiple cross-site scripting (XSS) vulnerabilities in Gonafish WebStatCaffe allow remote attackers to inject arbitrary web script or HTML via the (1) host parameter to stat/host.php, nodayshow parameter to (2) mostvisitpage.php and (3)… | EXPLOIT ×6 ✓MEDIUM 4.3EPSS 1.30% | 15 March 2010 |
| CVE-2009-4714 | Cross-site scripting (XSS) vulnerability in the quiz module for XOOPS Celepar allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to cadastro_usuario.php. | EXPLOIT ✓MEDIUM 4.3EPSS 1.51% | 15 March 2010 |
| CVE-2009-4713 | Multiple cross-site scripting (XSS) vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to inject arbitrary web script or HTML via (1) the cod_categoria parameter to categoria.php, (2) the opcao parameter to index.php,… | EXPLOIT ✓MEDIUM 4.3EPSS 1.51% | 15 March 2010 |
| CVE-2009-4700 | Directory traversal vulnerability in index.php in SkaDate Dating allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 2.79% | 15 March 2010 |
| CVE-2009-4699 | Multiple cross-site scripting (XSS) vulnerabilities in SkaDate Dating allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) admin/auth.php and (2) file_uploader.php. | EXPLOIT ✓MEDIUM 4.3EPSS 3.38% | 15 March 2010 |
| CVE-2009-4698 | Multiple SQL injection vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to execute arbitrary SQL commands via the codigo parameter to (1) aviso.php and (2) imprimir.php, and the (3) cod_categoria parameter to… | EXPLOIT ×2 ✓HIGH 7.5EPSS 1.71% | 15 March 2010 |
| CVE-2010-0050 | Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an HTML document with improperly nested tags. | EXPLOIT ✓HIGH 8.8EPSS 11.6% | 15 March 2010 |
| CVE-2010-0049 | Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via HTML elements with right-to-left (RTL) text directionality. | EXPLOIT ✓HIGH 9.3EPSS 10.9% | 15 March 2010 |
| CVE-2010-0122 | Multiple SQL injection vulnerabilities in Employee Timeclock Software 0.99 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to (a) auth.php or (b) login_action.php. | EXPLOIT ✓HIGH 7.5EPSS 2.31% | 15 March 2010 |
| CVE-2010-0806 | Microsoft Internet Explorer Use-After-Free Vulnerability | KEVEXPLOIT ×2 ✓HIGH 8.8EPSS 82.2% | 10 March 2010 |
| CVE-2010-0265 | Buffer overflow in Microsoft Windows Movie Maker 2.1, 2.6, and 6.0, and Microsoft Producer 2003, allows remote attackers to execute arbitrary code via a crafted project (.MSWMM) file, aka "Movie Maker and Producer Buffer Overflow Vulnerability." | EXPLOIT ✓HIGH 9.3EPSS 26.6% | 10 March 2010 |
| CVE-2009-4697 | Multiple cross-site scripting (XSS) vulnerabilities in index.php in RadNICS Gold 5 allow remote attackers to inject arbitrary web script or HTML via the (1) order parameter in a ulist action and the (2) fid parameter in a view_forum action. | EXPLOIT ✓MEDIUM 4.3EPSS 1.51% | 10 March 2010 |
| CVE-2009-4696 | SQL injection vulnerability in index.php in RadNICS Gold 5 allows remote attackers to execute arbitrary SQL commands via the fid parameter in a view_forum action. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 10 March 2010 |
| CVE-2009-4695 | SQL injection vulnerability in index.php in RadScripts RadLance Gold 7.5 allows remote attackers to execute arbitrary SQL commands via the fid parameter in a view_forum action. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 10 March 2010 |
| CVE-2009-4694 | Cross-site scripting (XSS) vulnerability in index.php in RadScripts RadLance Gold 7.5 allows remote attackers to inject arbitrary web script or HTML via the fid parameter in a view_forum action. | EXPLOIT ✓MEDIUM 4.3EPSS 1.46% | 10 March 2010 |
| CVE-2009-4693 | Multiple PHP remote file inclusion vulnerabilities in GraFX MiniCWB 2.3.0 allow remote attackers to execute arbitrary PHP code via a URL in the LANG parameter to (1) en.inc.php, (2) hu.inc.php, (3) no.inc.php, (4) ro.inc.php, and (5) ru.inc.php in… | EXPLOIT ✓HIGH 7.5EPSS 2.30% | 10 March 2010 |
| CVE-2009-4692 | Cross-site scripting (XSS) vulnerability in index.php in RadScripts RadLance Gold 7.5 allows remote attackers to inject arbitrary web script or HTML via the pr parameter in a ulist action. | EXPLOIT ✓MEDIUM 4.3EPSS 1.51% | 10 March 2010 |
| CVE-2009-4691 | SQL injection vulnerability in addlink.php in Classified Linktrader Script allows remote attackers to execute arbitrary SQL commands via the slctCategories parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 10 March 2010 |
| CVE-2009-4690 | Multiple cross-site scripting (XSS) vulnerabilities in YourFreeWorld Programs Rating Script allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) rate.php and (2) postcomments.php. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.88% | 10 March 2010 |
| CVE-2009-4689 | SQL injection vulnerability in index.php in PHP Shopping Cart Selling Website Script allows remote attackers to execute arbitrary SQL commands via the cid parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 10 March 2010 |
| CVE-2009-4688 | Multiple cross-site scripting (XSS) vulnerabilities in index.php in PHP Shopping Cart Selling Website Script allow remote attackers to inject arbitrary web script or HTML via the (1) txtkeywords and (2) cid parameters. | EXPLOIT ✓MEDIUM 4.3EPSS 3.08% | 10 March 2010 |
| CVE-2009-4687 | SQL injection vulnerability in silentum_guestbook.php in Silentum Guestbook 2.0.2 allows remote attackers to execute arbitrary SQL commands via the messageid parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.94% | 10 March 2010 |
| CVE-2009-4686 | Cross-site scripting (XSS) vulnerability in account.php in phplemon AdQuick 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the red_url parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.51% | 10 March 2010 |
| CVE-2009-4685 | Cross-site scripting (XSS) vulnerability in celebrities.php in PHP Scripts Now Astrology allows remote attackers to inject arbitrary web script or HTML via the day parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.51% | 10 March 2010 |
| CVE-2009-4684 | Cross-site scripting (XSS) vulnerability in index.php in EZodiak allows remote attackers to inject arbitrary web script or HTML via the sign parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.51% | 10 March 2010 |
| CVE-2009-4683 | Directory traversal vulnerability in vote.php in Good/Bad Vote allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the id parameter in a dovote action. | EXPLOIT ✓HIGH 7.5EPSS 2.38% | 10 March 2010 |
| CVE-2009-4682 | Cross-site scripting (XSS) vulnerability in vote.php in Good/Bad Vote allows remote attackers to inject arbitrary web script or HTML via the id parameter in a vote action. | EXPLOIT ✓MEDIUM 4.3EPSS 1.45% | 10 March 2010 |
| CVE-2009-4681 | Cross-site scripting (XSS) vulnerability in search.php in phpDirectorySource 1.x allows remote attackers to inject arbitrary web script or HTML via the st parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.50% | 10 March 2010 |
| CVE-2009-4680 | SQL injection vulnerability in search.php in phpDirectorySource 1.x allows remote attackers to execute arbitrary SQL commands via the st parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 10 March 2010 |
| CVE-2010-0958 | Directory traversal vulnerability in modules/hayoo/index.php in Tribisur 2.1, 2.0, and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary files via directory traversal sequences in the theme parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 1.87% | 10 March 2010 |
| CVE-2010-0955 | SQL injection vulnerability in index.php in Bild Flirt Community 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ×2 ✓HIGH 7.5EPSS 1.21% | 10 March 2010 |
| CVE-2010-0953 | Directory traversal vulnerability in mod.php in phpCOIN 1.2.1 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 1.92% | 10 March 2010 |
| CVE-2010-0952 | SQL injection vulnerability in index.php in OneCMS 2.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter in an elite action. | EXPLOITMEDIUM 6.8EPSS 0.95% | 10 March 2010 |
| CVE-2010-0951 | SQL injection vulnerability in go_target.php in dev4u CMS allows remote attackers to execute arbitrary SQL commands via the kontent_id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 10 March 2010 |
| CVE-2010-0948 | SQL injection vulnerability in profil.php in Bigforum 4.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 1.09% | 10 March 2010 |
| CVE-2010-0926 | The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by… | EXPLOIT ×2 ✓LOW 3.5EPSS 30.5% | 10 March 2010 |
| CVE-2010-0103 | UsbCharger.dll in the Energizer DUO USB battery charger software contains a backdoor that is implemented through the Arucer.dll file in the %WINDIR%\system32 directory, which allows remote attackers to download arbitrary programs onto a Windows PC, and… | EXPLOIT ✓HIGH 9.3EPSS 27.4% | 10 March 2010 |
| CVE-2010-0946 | SQL injection vulnerability in the Keep It Simple Stupid (KISS) Software Advertiser (com_ksadvertiser) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter in a showcats action to index.php. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 8 March 2010 |
| CVE-2010-0945 | SQL injection vulnerability in the HotBrackets Tournament Brackets (com_hotbrackets) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. | EXPLOITHIGH 7.5EPSS 1.00% | 8 March 2010 |
| CVE-2010-0944 | Directory traversal vulnerability in the JCollection (com_jcollection) component for Joomla! allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 14.0% | 8 March 2010 |
| CVE-2010-0943 | Directory traversal vulnerability in the JA Showcase (com_jashowcase) component for Joomla! allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 15.9% | 8 March 2010 |
| CVE-2010-0942 | Directory traversal vulnerability in the jVideoDirect (com_jvideodirect) component for Joomla! allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 7.24% | 8 March 2010 |
| CVE-2010-0939 | Visialis ABB Forum 1.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for fpdb/abb.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.44% | 8 March 2010 |
| CVE-2010-0936 | Cross-site scripting (XSS) vulnerability in auth.asp on the D-LINK DKVM-IP8 with firmware 2282_dlinkA4_p8_20071213 allows remote attackers to inject arbitrary web script or HTML via the nickname parameter. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.52% | 8 March 2010 |
| CVE-2009-4679 | Directory traversal vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ×2 ✓HIGH 7.5EPSS 7.87% | 8 March 2010 |
| CVE-2009-4678 | Cross-site scripting (XSS) vulnerability in index.php in Winn Guestbook 2.4 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. | EXPLOIT ✓MEDIUM 4.3EPSS 1.53% | 8 March 2010 |
| CVE-2010-0425 | modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an… | EXPLOIT ×2 ✓HIGH 10.0EPSS 94.2% | 5 March 2010 |
| CVE-2009-4676 | Stack-based buffer overflow in JetCast.exe 2.0.4.1109 in jetAudio 7.5.2 and 7.5.3.15 allows remote attackers to execute arbitrary code via a long title in a FLAC file. | EXPLOIT ✓HIGH 9.3EPSS 4.04% | 5 March 2010 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.