Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
397,441 CVEs1,723 in CISA KEV17,397 with EPSS ≥ 10%25,049 with a public exploitUpdated 24 September 2026
25,049 results · page 203 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2009-4675 | admin/admin_info/index.php in the Mole Group Gastro Portal (Restaurant Directory) Script does not require administrative authentication, which allows remote attackers to change the admin password via an unspecified form submission. | EXPLOIT ✓HIGH 7.5EPSS 2.61% | 5 March 2010 |
| CVE-2009-4674 | admin/admin.php in Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script allows remote attackers to change an arbitrary password via a modified user_id field. | EXPLOIT ✓HIGH 7.5EPSS 2.42% | 5 March 2010 |
| CVE-2009-4673 | SQL injection vulnerability in profile.php in Mole Group Adult Portal Script allows remote attackers to execute arbitrary SQL commands via the user_id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 5 March 2010 |
| CVE-2009-4672 | Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 9.08% | 5 March 2010 |
| CVE-2009-4671 | Login.php in RoomPHPlanning 1.6 allows remote attackers to bypass authentication and obtain administrative access by setting the room_phplanning cookie to a value associated with the admin account. | EXPLOIT ✓HIGH 7.5EPSS 2.27% | 5 March 2010 |
| CVE-2009-4670 | admin/delitem.php in RoomPHPlanning 1.6 does not require authentication, which allows remote attackers to (1) delete arbitrary users via the user parameter or (2) delete arbitrary rooms via the room parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.27% | 5 March 2010 |
| CVE-2009-4669 | Multiple SQL injection vulnerabilities in RoomPHPlanning 1.6 allow remote attackers to execute arbitrary SQL commands via (1) the loginus parameter to Login.php or (2) the Old Password field to changepwd.php, and allow (3) remote authenticated… | EXPLOIT ✓HIGH 7.5EPSS 0.94% | 5 March 2010 |
| CVE-2009-4668 | Stack-based buffer overflow in JetCast.exe 2.0.4.1109 in jetAudio 7.5.2 and 7.5.3.15 allows remote attackers to execute arbitrary code via a long ID3 tag in an MP3 file. | EXPLOIT ✓HIGH 9.3EPSS 5.63% | 5 March 2010 |
| CVE-2009-4667 | SQL injection vulnerability in form.php in WebMember 1.0 allows remote authenticated users to execute arbitrary SQL commands via the formID parameter. | EXPLOIT ✓MEDIUM 6.5EPSS 0.89% | 5 March 2010 |
| CVE-2009-4666 | Multiple PHP remote file inclusion vulnerabilities in Webradev Download Protect 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[RootPath] parameter to (1) Framework/EmailTemplates.class.php, (2)… | EXPLOIT ✓HIGH 7.5EPSS 2.09% | 5 March 2010 |
| CVE-2009-4665 | Directory traversal vulnerability in CuteSoft_Client/CuteEditor/Load.ashx in CuteSoft Components Cute Editor for ASP.NET allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 6.53% | 5 March 2010 |
| CVE-2009-2754 | Integer signedness error in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3 and EMC… | EXPLOIT ✓HIGH 10.0EPSS 40.3% | 5 March 2010 |
| CVE-2009-2753 | Multiple buffer overflows in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3, allow… | EXPLOIT ✓HIGH 10.0EPSS 10.9% | 5 March 2010 |
| CVE-2009-4663 | Heap-based buffer overflow in the Quiksoft EasyMail Objects 6 ActiveX control allows remote attackers to execute arbitrary code via a long argument to the AddAttachment method. | EXPLOIT ✓HIGH 9.3EPSS 10.5% | 3 March 2010 |
| CVE-2009-4661 | Multiple buffer overflows in BigAnt Server 2.50 SP6 and earlier allow user-assisted remote attackers to cause a denial of service (application crash) via a crafted ZIP file that is not properly handled when the victim uses the (1) Update or (2) Plug-In… | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 2.11% | 3 March 2010 |
| CVE-2009-4660 | Stack-based buffer overflow in the AntServer Module (AntServer.exe) in BigAnt IM Server 2.50 allows remote attackers to execute arbitrary code via a long GET request to TCP port 6660. | EXPLOIT ×2 ✓HIGH 10.0EPSS 62.1% | 3 March 2010 |
| CVE-2009-4659 | Unspecified vulnerability in MP3-Cutter Ease Audio Cutter 1.20 allows user-assisted remote attackers to cause a denial of service (application crash) via a long string in a WAV file. | EXPLOIT ✓MEDIUM 4.3EPSS 1.88% | 3 March 2010 |
| CVE-2009-4658 | Xerver 4.32 allows remote authenticated users to cause a denial of service (daemon crash) via a non-numeric web port assignment in the management interface. | EXPLOIT ✓MEDIUM 4.0EPSS 1.81% | 3 March 2010 |
| CVE-2009-4657 | The administrator package for Xerver 4.32 does not require authentication, which allows remote attackers to alter application settings by connecting to the application on port 32123, as demonstrated by setting the action option to wizardStep1. | EXPLOIT ✓HIGH 7.5EPSS 2.17% | 3 March 2010 |
| CVE-2009-4656 | Stack-based buffer overflow in E-Soft DJ Studio Pro 4.2 including 4.2.2.7.5, and 5.x including 5.1.4.3.1, allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a playlist file… | EXPLOIT ×4 ✓HIGH 9.3EPSS 31.7% | 3 March 2010 |
| CVE-2010-0483 | vbscript.dll in VBScript 5.1, 5.6, 5.7, and 5.8 in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, allows user-assisted remote attackers to execute arbitrary code by referencing a (1) local pathname, (2)… | EXPLOIT ×2 ✓HIGH 7.6EPSS 86.4% | 3 March 2010 |
| CVE-2010-0804 | Cross-site scripting (XSS) vulnerability in index.php in iBoutique 4.0 allows remote attackers to inject arbitrary web script or HTML via the key parameter in a products action. | EXPLOIT ✓MEDIUM 4.3EPSS 1.48% | 2 March 2010 |
| CVE-2010-0803 | SQL injection vulnerability in the jVideoDirect (com_jvideodirect) component 1.1 RC3b for Joomla! allows remote attackers to execute arbitrary SQL commands via the v parameter to index.php. | EXPLOIT ✓HIGH 7.5EPSS 1.15% | 2 March 2010 |
| CVE-2010-0802 | SQL injection vulnerability in index.php in (nv2) Awards 1.1.0, a modification for Invision Power Board, allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action. | EXPLOITHIGH 7.5EPSS 0.97% | 2 March 2010 |
| CVE-2010-0801 | Directory traversal vulnerability in the AutartiTarot (com_autartitarot) component 1.0.3 for Joomla! allows remote authenticated users, with "Public Back-end" group permissions, to read arbitrary files via directory traversal sequences in the controller… | EXPLOIT ✓LOW 3.5EPSS 1.88% | 2 March 2010 |
| CVE-2010-0800 | SQL injection vulnerability in the Ossolution Team Documents Seller (aka DMS) (com_dms) component 2.5.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the category_id parameter in a view_category action to index.php. | EXPLOIT ✓HIGH 7.5EPSS 1.15% | 2 March 2010 |
| CVE-2010-0799 | Directory traversal vulnerability in misc/tell_a_friend/tell.php in phpunity.newsmanager allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 2.71% | 2 March 2010 |
| CVE-2010-0796 | SQL injection vulnerability in the JE Quiz (com_jequizmanagement) component 1.b01 for Joomla! allows remote attackers to execute arbitrary SQL commands via the eid parameter in a question action to index.php. | EXPLOIT ✓HIGH 7.5EPSS 1.16% | 2 March 2010 |
| CVE-2010-0795 | SQL injection vulnerability in the JE Event Calendars (com_jeeventcalendar) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the event_id parameter in an event action to index.php. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 2 March 2010 |
| CVE-2010-0788 | ncpfs 2.2.6 allows local users to cause a denial of service, obtain sensitive information, or possibly gain privileges via symlink attacks involving the (1) ncpmount and (2) ncpumount programs. | EXPLOIT ✓MEDIUM 4.4EPSS 0.67% | 2 March 2010 |
| CVE-2010-0765 | fipsForum 2.6 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for _database/forumFips.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.44% | 2 March 2010 |
| CVE-2010-0764 | SQL injection vulnerability in index.php in KuwaitPHP eSmile allows remote attackers to execute arbitrary SQL commands via the cid parameter in a show action. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 2 March 2010 |
| CVE-2010-0763 | SQL injection vulnerability in index.php in CommodityRentals Vacation Rental Software allows remote attackers to execute arbitrary SQL commands via the rental_id parameter in a CalendarView action. | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 2 March 2010 |
| CVE-2010-0762 | SQL injection vulnerability in index.php in CommodityRentals CD Rental Software allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a catalog action. | EXPLOIT ✓HIGH 7.5EPSS 1.21% | 2 March 2010 |
| CVE-2010-0761 | SQL injection vulnerability in index.php in CommodityRentals Books/eBooks Rentals Script allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a gamecatalog action. | EXPLOIT ✓HIGH 7.5EPSS 1.19% | 2 March 2010 |
| CVE-2010-0760 | Multiple directory traversal vulnerabilities in the Core Design Scriptegrator plugin 1.4.1 for Joomla! allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) file parameter to… | EXPLOIT ✓MEDIUM 6.8EPSS 1.86% | 27 February 2010 |
| CVE-2010-0759 | Directory traversal vulnerability in plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php in the Core Design Scriptegrator plugin 1.4.1 for Joomla! allows remote attackers to read, and possibly include and execute, arbitrary files via… | EXPLOIT ✓HIGH 7.5EPSS 15.2% | 27 February 2010 |
| CVE-2010-0758 | SQL injection vulnerability in news_desc.php in Softbiz Jobs allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 27 February 2010 |
| CVE-2010-0757 | Unrestricted file upload vulnerability in index.php/Attach in WikyBlog 1.7.3rc2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension using the uploadform action, then accessing it via a direct… | EXPLOIT ✓MEDIUM 6.5EPSS 3.15% | 27 February 2010 |
| CVE-2010-0756 | Session fixation vulnerability in WikyBlog 1.7.3 rc2 allows remote attackers to hijack web sessions by setting the jsessionid parameter to (1) index.php/Comment/Main, (2) index.php/Comment/Main/Home_Wiky, or (3) index.php/Edit/Main. | EXPLOIT ✓MEDIUM 5.8EPSS 1.83% | 27 February 2010 |
| CVE-2010-0755 | PHP remote file inclusion vulnerability in include/WBmap.php in WikyBlog 1.7.3 rc2 allows remote attackers to execute arbitrary PHP code via a URL in the langFile parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.47% | 27 February 2010 |
| CVE-2010-0754 | Cross-site scripting (XSS) vulnerability in index.php/Special/Main/Templates in WikyBlog 1.7.2 and 1.7.3 rc2 allows remote attackers to inject arbitrary web script or HTML via the which parameter in a copy action. | EXPLOIT ✓MEDIUM 4.3EPSS 2.17% | 27 February 2010 |
| CVE-2010-0753 | SQL injection vulnerability in the SQL Reports (com_sqlreport) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the user_id parameter to ajax/print.php. | EXPLOIT ✓HIGH 7.5EPSS 1.20% | 27 February 2010 |
| CVE-2010-0725 | Cross-site scripting (XSS) vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter. | EXPLOITMEDIUM 4.3EPSS 1.62% | 26 February 2010 |
| CVE-2010-0724 | SQL injection vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOITHIGH 7.5EPSS 1.12% | 26 February 2010 |
| CVE-2010-0723 | SQL injection vulnerability in news.php in Ero Auktion 2.0 and 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ×2 ✓HIGH 7.5EPSS 1.85% | 26 February 2010 |
| CVE-2010-0722 | SQL injection vulnerability in news.php in Php Auktion Pro allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 26 February 2010 |
| CVE-2010-0721 | SQL injection vulnerability in news.php in Auktionshaus Gelb 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 26 February 2010 |
| CVE-2010-0720 | SQL injection vulnerability in news.php in Erotik Auktionshaus allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.19% | 26 February 2010 |
| CVE-2010-0718 | Buffer overflow in Microsoft Windows Media Player 9 and 11.0.5721.5145 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted .mpg file. | EXPLOIT ✓MEDIUM 4.3EPSS 8.87% | 26 February 2010 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.