Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
397,461 CVEs1,723 in CISA KEV17,253 with EPSS ≥ 10%25,049 with a public exploitUpdated 25 September 2026
25,049 results · page 214 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2009-3713 | SQL injection vulnerability in fichero.php in MorcegoCMS 1.7.6 and earlier allows remote attackers to execute arbitrary SQL commands via the query string. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 16 October 2009 |
| CVE-2009-3712 | Multiple SQL injection vulnerabilities in Ebay Clone 2009 allow remote attackers to execute arbitrary SQL commands via the (1) user_id parameter to feedback.php; and the item_id parameter to (2) view_full_size.php, (3) classifide_ad.php, and (4)… | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 16 October 2009 |
| CVE-2009-3711 | Stack-based buffer overflow in the h_handlepeer function in http.cpp in httpdx 1.4, and possibly 1.4.3, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request. | EXPLOIT ×2 ✓HIGH 10.0EPSS 63.9% | 16 October 2009 |
| CVE-2009-3710 | RioRey RIOS 4.6.6 and 4.7.0 uses an undocumented, hard-coded username (dbadmin) and password (sq!us3r) for an SSH tunnel, which allows remote attackers to gain privileges via port 8022. | EXPLOIT ✓HIGH 10.0EPSS 8.50% | 16 October 2009 |
| CVE-2009-3709 | Stack-based buffer overflow in the Meta Content Optimizer in Konae Technologies Alleycode HTML Editor 2.21 allows user-assisted remote attackers to execute arbitrary code via a long value in a TITLE tag. | EXPLOIT ×2 ✓HIGH 9.3EPSS 5.90% | 16 October 2009 |
| CVE-2009-3708 | Stack-based buffer overflow in the Meta Content Optimizer in Konae Technologies Alleycode HTML Editor 2.21 allows user-assisted remote attackers to execute arbitrary code via a long value in a (1) description or (2) keyword META tag. | EXPLOIT ×2 ✓HIGH 9.3EPSS 4.49% | 16 October 2009 |
| CVE-2009-3707 | VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459, VMware Player 3.0 before 3.0.1 build 227600 and 2.5.x before 2.5.4 build… | EXPLOIT ✓MEDIUM 5.0EPSS 11.1% | 16 October 2009 |
| CVE-2009-3705 | PHP remote file inclusion vulnerability in debugger.php in Achievo before 1.4.0 allows remote attackers to execute arbitrary PHP code via a URL in the config_atkroot parameter. | EXPLOIT ✓HIGH 7.5EPSS 9.81% | 16 October 2009 |
| CVE-2009-3281 | The vmx86 kernel extension in VMware Fusion before 2.0.6 build 196839 does not use correct file permissions, which allows host OS users to gain privileges on the host OS via unspecified vectors. | EXPLOIT ✓HIGH 7.2EPSS 0.93% | 16 October 2009 |
| CVE-2009-2734 | SQL injection vulnerability in the get_employee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter (aka user_id variable) to dispatch.php. | EXPLOIT ✓HIGH 7.5EPSS 1.26% | 16 October 2009 |
| CVE-2009-2733 | Multiple cross-site scripting (XSS) vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the scheduler title in the scheduler module, and the (2) atksearch[contractnumber], (3)… | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 2.26% | 16 October 2009 |
| CVE-2009-3699 | Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1 and earlier, allows remote attackers to execute arbitrary code via a long XDR string in the first argument to… | EXPLOIT ✓HIGH 10.0EPSS 62.3% | 15 October 2009 |
| CVE-2009-2532 | Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC do not properly process the command value in an SMB Multi-Protocol Negotiate Request packet, which allows remote attackers to execute arbitrary code via a… | EXPLOIT ×2HIGH 10.0EPSS 62.2% | 14 October 2009 |
| CVE-2009-2526 | Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows remote attackers to cause a denial of service (infinite loop and system hang) via a crafted packet to the Server… | EXPLOIT ×2HIGH 7.8EPSS 81.9% | 14 October 2009 |
| CVE-2009-2511 | Integer overflow in the CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows man-in-the-middle attackers to… | EXPLOIT ✓HIGH 7.5EPSS 13.0% | 14 October 2009 |
| CVE-2009-1547 | Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted data stream header that triggers memory corruption, aka "Data Stream Header Corruption Vulnerability." | EXPLOIT ×2 ✓HIGH 8.8EPSS 37.4% | 14 October 2009 |
| CVE-2009-3694 | Directory traversal vulnerability in config/config.php in ezRecipe-Zee 91, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 1.90% | 13 October 2009 |
| CVE-2009-3693 | Directory traversal vulnerability in the Persits.XUpload.2 ActiveX control (XUpload.ocx) in HP LoadRunner 9.5 allows remote attackers to create arbitrary files via \.. | EXPLOIT ×2 ✓HIGH 9.3EPSS 41.6% | 13 October 2009 |
| CVE-2009-3692 | Unspecified vulnerability in the VBoxNetAdpCtl configuration tool in Sun VirtualBox 3.0.x before 3.0.8 on Solaris x86, Linux, and Mac OS X allows local users to gain privileges via unknown vectors. | EXPLOIT ✓HIGH 7.2EPSS 0.73% | 13 October 2009 |
| CVE-2009-3691 | Multiple integer overflows in setnet32.exe 3.50.0.13752 in IBM Informix Client SDK 3.0 and 3.50 and Informix Connect Runtime 3.x allow remote attackers to execute arbitrary code via a .nfx file with a crafted (1) HostSize, and possibly (2) ProtoSize and… | EXPLOIT ✓HIGH 9.3EPSS 7.04% | 13 October 2009 |
| CVE-2009-3459 | Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability | KEVEXPLOIT ×2 ✓HIGH 8.8EPSS 86.6% | 13 October 2009 |
| CVE-2009-2898 | Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc… | EXPLOIT ✓LOW 3.5EPSS 1.83% | 13 October 2009 |
| CVE-2009-2684 | Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1)… | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 2.23% | 13 October 2009 |
| CVE-2009-3670 | Stack-based buffer overflow in KSP Sound Player 2009 R2 and R2.1 allows remote attackers to execute arbitrary code via a long string in a .m3u playlist file. | EXPLOIT ✓HIGH 9.3EPSS 5.79% | 11 October 2009 |
| CVE-2009-3669 | SQL injection vulnerability in the foobla Suggestions (com_foobla_suggestions) component 1.5.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the idea_id parameter to index.php. | EXPLOIT ✓HIGH 7.5EPSS 0.95% | 11 October 2009 |
| CVE-2009-3667 | SQL injection vulnerability in admin/index.php in AdsDX 3.05 allows remote attackers to execute arbitrary SQL commands via the Username. | EXPLOIT ✓HIGH 7.5EPSS 0.92% | 11 October 2009 |
| CVE-2009-3666 | Cross-site scripting (XSS) vulnerability in index.php in Nullam Blog 0.1.2 allows remote attackers to inject arbitrary web script or HTML via the e parameter in an error action. | EXPLOIT ✓MEDIUM 4.3EPSS 2.97% | 11 October 2009 |
| CVE-2009-3665 | Multiple SQL injection vulnerabilities in index.php in Nullam Blog 0.1.2 allow remote attackers to execute arbitrary SQL commands via the (1) i parameter or (2) v parameters in a register action. | EXPLOIT ✓HIGH 7.5EPSS 2.08% | 11 October 2009 |
| CVE-2009-3664 | Multiple directory traversal vulnerabilities in index.php in Nullam Blog 0.1.2 allow remote attackers to include or execute arbitrary files via a .. | EXPLOIT ✓HIGH 7.5EPSS 5.97% | 11 October 2009 |
| CVE-2009-3663 | Format string vulnerability in the h_readrequest function in http.c in httpdx Web Server 1.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in the Host header. | EXPLOIT ✓HIGH 10.0EPSS 14.6% | 11 October 2009 |
| CVE-2009-3662 | FileCopa FTP Server 5.01 allows remote attackers to cause a denial of service (server hang) via a large number of crafted NOOP commands. | EXPLOIT ✓MEDIUM 5.0EPSS 2.65% | 11 October 2009 |
| CVE-2009-3661 | Multiple SQL injection vulnerabilities in the DJ-Catalog (com_djcatalog) component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a showItem action and (2) cid parameter in a show action to index.php. | EXPLOIT ✓MEDIUM 6.8EPSS 0.93% | 11 October 2009 |
| CVE-2009-3660 | PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 1.86% | 11 October 2009 |
| CVE-2009-3659 | SQL injection vulnerability in file/stats.php in BS Counter 2.5.3 allows remote attackers to execute arbitrary SQL commands via the page parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.93% | 11 October 2009 |
| CVE-2009-3658 | Use-after-free vulnerability in the Sb.SuperBuddy.1 ActiveX control (sb.dll) in America Online (AOL) 9.5.0.1 allows remote attackers to trigger memory corruption or possibly execute arbitrary code via a malformed argument to the SetSuperBuddy method. | EXPLOIT ✓HIGH 8.8EPSS 8.90% | 9 October 2009 |
| CVE-2009-3647 | Cross-site scripting (XSS) vulnerability in emaullinks.php in YABSoft Mega File Hosting Script (aka MFH or MFHS) 1.2 allows remote attackers to inject arbitrary web script or HTML via the moudi parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.19% | 9 October 2009 |
| CVE-2009-3646 | InterVations NaviCOPA Web Server 3.01 allows remote attackers to obtain the source code for a web page via an HTTP request with the addition of ::$DATA after the HTML file name. | EXPLOIT ✓MEDIUM 5.0EPSS 5.89% | 9 October 2009 |
| CVE-2009-3645 | SQL injection vulnerability in the JoomlaCache CB Resume Builder (com_cbresumebuilder) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the group_id parameter in a group_members action to index.php. | EXPLOIT ✓HIGH 7.5EPSS 1.13% | 9 October 2009 |
| CVE-2009-3644 | SQL injection vulnerability in the Soundset (com_soundset) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to index.php. | EXPLOIT ✓HIGH 7.5EPSS 0.95% | 9 October 2009 |
| CVE-2009-3643 | Dxmsoft XM Easy Personal FTP Server 5.8.0 allows remote attackers to cause a denial of service via a long argument to the (1) LIST and (2) NLST commands, a differnt issue than CVE-2008-5626 and CVE-2006-5728. | EXPLOIT ✓MEDIUM 5.0EPSS 6.35% | 9 October 2009 |
| CVE-2009-3642 | Multiple SQL injection vulnerabilities in the Call Logging feature in FrontRange HEAT 8.01 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters. | EXPLOIT ✓HIGH 7.5EPSS 1.10% | 9 October 2009 |
| CVE-2009-3601 | Cross-site scripting (XSS) vulnerability in demo_page.php in Scriptsez Ultimate Poll allows remote attackers to inject arbitrary web script or HTML via the clr parameter in a vote action. | EXPLOIT ✓MEDIUM 4.3EPSS 3.03% | 8 October 2009 |
| CVE-2009-3599 | Cross-site scripting (XSS) vulnerability in single_winner1.php in HUBScript 1.0 allows remote attackers to inject arbitrary web script or HTML via the bid_id parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.50% | 8 October 2009 |
| CVE-2009-3598 | Cross-site scripting (XSS) vulnerability in survey_result.php in eCardMAX FormXP 2007 allows remote attackers to inject arbitrary web script or HTML via the sid parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.50% | 8 October 2009 |
| CVE-2009-3597 | Digitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for autoconfig.dd. | EXPLOIT ✓MEDIUM 5.0EPSS 3.21% | 8 October 2009 |
| CVE-2009-3596 | JoxTechnology Ajox Poll does not properly restrict access to admin/managepoll.php, which allows remote attackers to bypass authentication and gain administrative access via a direct request. | EXPLOIT ✓HIGH 7.5EPSS 2.33% | 8 October 2009 |
| CVE-2009-3595 | SQL injection vulnerability in results.php in VS PANEL 7.5.5 allows remote attackers to execute arbitrary SQL commands via the Cat_ID parameter, a different vector than CVE-2009-3590. | EXPLOIT ✓HIGH 7.5EPSS 1.04% | 8 October 2009 |
| CVE-2009-3593 | Multiple cross-site scripting (XSS) vulnerabilities in Freelancers 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to placebid.php and (2) jobid parameter to post_resume.php. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.54% | 8 October 2009 |
| CVE-2009-3592 | Cross-site scripting (XSS) vulnerability in customer/home.php in Qualiteam X-Cart allows remote attackers to inject arbitrary web script or HTML via the email parameter in a subscribed action, a different vector than CVE-2005-1823. | EXPLOIT ✓MEDIUM 4.3EPSS 1.47% | 8 October 2009 |
| CVE-2009-3591 | Dopewars 1.5.12 allows remote attackers to cause a denial of service (segmentation fault) via a REQUESTJET message with an invalid location. | EXPLOIT ×2 ✓MEDIUM 5.0EPSS 52.8% | 8 October 2009 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.