Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
397,461 CVEs1,723 in CISA KEV17,253 with EPSS ≥ 10%25,049 with a public exploitUpdated 25 September 2026
25,049 results · page 215 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2009-3590 | SQL injection vulnerability in showcat.php in VS PANEL 7.3.6 allows remote attackers to execute arbitrary SQL commands via the Cat_ID parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 8 October 2009 |
| CVE-2009-3527 | Race condition in the Pipe (IPC) close function in FreeBSD 6.3 and 6.4 allows local users to cause a denial of service (crash) or gain privileges via vectors related to kqueues, which triggers a use after free, leading to a NULL pointer dereference or… | EXPLOIT ✓MEDIUM 6.9EPSS 0.55% | 6 October 2009 |
| CVE-2009-3574 | Tuniac 090517c allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long File1 argument in a .pls playlist file, possibly a buffer overflow. | EXPLOIT ✓HIGH 9.3EPSS 4.80% | 6 October 2009 |
| CVE-2009-3573 | Multiple insecure method vulnerabilities in the PDIControl.PDI.1 ActiveX control (PDIControl.dll) 2.2.3160.0 in EMC Captiva PixTools Distributed Imaging 2.2 allow remote attackers to create or overwrite arbitrary files via the (1) SetLogFileName and (2)… | EXPLOIT ✓HIGH 9.3EPSS 5.72% | 6 October 2009 |
| CVE-2009-3562 | Cross-site scripting (XSS) vulnerability in Xerver HTTP Server 4.32 allows remote attackers to inject arbitrary web script or HTML via the currentPath parameter in a chooseDirectory action. | EXPLOIT ✓LOW 2.6EPSS 1.49% | 5 October 2009 |
| CVE-2009-3561 | Directory traversal vulnerability in Xerver HTTP Server 4.32 allows remote attackers to read arbitrary files via a full pathname with a drive letter in the currentPath parameter in a chooseDirectory action. | EXPLOIT ✓MEDIUM 5.0EPSS 2.80% | 5 October 2009 |
| CVE-2009-3545 | DataWizard Technologies FtpXQ FTP Server 3.0 allows remote authenticated users to cause a denial of service (crash) via a long ABOR command. | EXPLOIT ✓MEDIUM 4.0EPSS 2.19% | 5 October 2009 |
| CVE-2009-3544 | Xerver HTTP Server 4.32 allows remote attackers to obtain the source code for a web page via an HTTP request with the addition of ::$DATA after the HTML file name. | EXPLOIT ✓MEDIUM 5.0EPSS 2.59% | 5 October 2009 |
| CVE-2009-3525 | The pyGrub boot loader in Xen 3.0.3, 3.3.0, and Xen-3.3.1 does not support the password option in grub.conf for para-virtualized guests, which allows attackers with access to the para-virtualized guest console to boot the guest or modify the guest's… | EXPLOIT ✓HIGH 7.2EPSS 1.24% | 5 October 2009 |
| CVE-2009-3543 | SQL injection vulnerability in _phenotype/admin/login.php in Phenotype CMS before 2.9 allows remote attackers to execute arbitrary SQL commands via the user parameter (aka the login name). | EXPLOIT ✓HIGH 7.5EPSS 2.00% | 2 October 2009 |
| CVE-2009-3542 | Directory traversal vulnerability in ls.php in LittleSite (aka LS or LittleSite.php) 0.1 allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.39% | 2 October 2009 |
| CVE-2009-3541 | PHP remote file inclusion vulnerability in CoupleDB.php in PHPGenealogy 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the DataDirectory parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.10% | 2 October 2009 |
| CVE-2009-3539 | Multiple cross-site scripting (XSS) vulnerabilities in YourFreeWorld Ultra Classifieds Pro allow remote attackers to inject arbitrary web script or HTML via the (1) cname parameter to subclass.php and the (2) sn parameter to listads.php. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.52% | 2 October 2009 |
| CVE-2009-3536 | Multiple stack-based buffer overflows in EpicDJSoftware EpicVJ 1.2.8.0 and 1.3.1.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a (1) .m3u or (2) .mpl playlist file. | EXPLOIT ✓HIGH 9.3EPSS 5.86% | 2 October 2009 |
| CVE-2009-3535 | Directory traversal vulnerability in image.php in Clear Content 1.1 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 4.3EPSS 4.83% | 2 October 2009 |
| CVE-2009-3534 | Directory traversal vulnerability in index.php in LionWiki 3.0.3, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 4.07% | 2 October 2009 |
| CVE-2009-3531 | SQL injection vulnerability in vnews.php in Universe CMS 1.0.6 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.02% | 2 October 2009 |
| CVE-2009-3530 | Cross-site scripting (XSS) vulnerability in storefront.php in RadScripts RadBids Gold 4 allows remote attackers to inject arbitrary web script or HTML via the mode parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.51% | 2 October 2009 |
| CVE-2009-3529 | SQL injection vulnerability in index.php in RadScripts RadBids Gold 4 allows remote attackers to execute arbitrary SQL commands via the fid parameter in a view_forum action, a different vector than CVE-2005-1074. | EXPLOIT ✓MEDIUM 6.8EPSS 0.85% | 2 October 2009 |
| CVE-2009-3528 | SQL injection vulnerability in Profile.php in MyMsg 1.0.3 allows remote authenticated users to execute arbitrary SQL commands via the uid parameter in a show action. | EXPLOIT ✓MEDIUM 6.5EPSS 0.85% | 2 October 2009 |
| CVE-2009-3523 | Home and Professional for Windows before 4.8.1356 does not properly validate input to IOCTLs (1) 0xb2d6000c and (2) 0xb2d60034, which allows local users to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption,… | EXPLOIT ✓MEDIUM 6.9EPSS 0.78% | 1 October 2009 |
| CVE-2009-3522 | Stack-based buffer overflow in aswMon2.sys in avast! | EXPLOIT ✓HIGH 7.2EPSS 0.95% | 1 October 2009 |
| CVE-2009-3518 | Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and Rational Team Concert, allows remote attackers to load arbitrary DLL files via the -vm option, as… | EXPLOIT ✓HIGH 9.3EPSS 5.48% | 1 October 2009 |
| CVE-2009-3515 | Directory traversal vulnerability in dnet_admin/index.php in d.net CMS allows remote authenticated administrators to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.5EPSS 1.97% | 1 October 2009 |
| CVE-2009-3514 | Multiple SQL injection vulnerabilities in d.net CMS allow remote attackers to execute arbitrary SQL commands via (1) the page parameter to index.php; and allow remote authenticated administrators to execute arbitrary SQL commands via the (2) edit_id and… | EXPLOIT ✓MEDIUM 6.5EPSS 0.84% | 1 October 2009 |
| CVE-2009-3513 | Multiple cross-site scripting (XSS) vulnerabilities in Pilot Group (PG) eTraining allow remote attackers to inject arbitrary web script or HTML via (1) the cat_id parameter to courses_login.php, the id parameter to (2) news_read.php or (3)… | EXPLOIT ×3 ✓MEDIUM 4.3EPSS 1.50% | 1 October 2009 |
| CVE-2009-3512 | Multiple cross-site scripting (XSS) vulnerabilities in MyWeight 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) date parameter to user_addfood.php, info parameter to (2) user_forgot_pwd_form.php and (3) user_login.php, and… | EXPLOIT ×3 ✓MEDIUM 4.3EPSS 1.77% | 1 October 2009 |
| CVE-2009-3511 | Multiple PHP remote file inclusion vulnerabilities in justVisual 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the fs_jVroot parameter to (1) sites/site/pages/index.php, (2) sites/test/pages/contact.php, (3)… | EXPLOIT ✓HIGH 7.5EPSS 2.14% | 1 October 2009 |
| CVE-2009-3510 | SQL injection vulnerability in viewListing.php in linkSpheric 0.74 Beta 6 allows remote attackers to execute arbitrary SQL commands via the listID parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.95% | 1 October 2009 |
| CVE-2009-3509 | Cross-site scripting (XSS) vulnerability in admin/admin_index.php in CJ Dynamic Poll PRO 2.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. | EXPLOIT ✓MEDIUM 4.3EPSS 1.51% | 1 October 2009 |
| CVE-2009-3508 | Multiple directory traversal vulnerabilities in MUJE CMS 1.0.4.34 allow remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.0EPSS 1.64% | 1 October 2009 |
| CVE-2009-3507 | Directory traversal vulnerability in modules.php in CMSphp 0.21 allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.35% | 1 October 2009 |
| CVE-2009-3506 | Multiple cross-site scripting (XSS) vulnerabilities in CMSphp 0.21 allow remote attackers to inject arbitrary web script or HTML via the (1) cook_user parameter to index.php and the (2) name parameter to modules.php. | EXPLOIT ✓MEDIUM 4.3EPSS 1.27% | 1 October 2009 |
| CVE-2009-3504 | SQL injection vulnerability in offers_buy.php in Alibaba Clone 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.27% | 30 September 2009 |
| CVE-2009-3503 | Multiple SQL injection vulnerabilities in search.aspx in BPowerHouse BPHolidayLettings 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) rid and (2) tid parameters. | EXPLOIT ✓HIGH 7.5EPSS 1.11% | 30 September 2009 |
| CVE-2009-3502 | SQL injection vulnerability in music.php in BPowerHouse BPMusic 1.0 allows remote attackers to execute arbitrary SQL commands via the music_id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 30 September 2009 |
| CVE-2009-3500 | Multiple SQL injection vulnerabilities in BPowerHouse BPGames 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) cat_id parameter to main.php and (2) game_id parameter to game.php. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 30 September 2009 |
| CVE-2009-3499 | SQL injection vulnerability in employee.aspx in BPowerHouse BPLawyerCaseDocuments 1.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 30 September 2009 |
| CVE-2009-3496 | Cross-site scripting (XSS) vulnerability in view_mag.php in Vastal I-Tech DVD Zone allows remote attackers to inject arbitrary web script or HTML via the mag_id parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.45% | 30 September 2009 |
| CVE-2009-3495 | SQL injection vulnerability in view_mag.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL commands via the mag_id parameter, a different vector than CVE-2008-4465. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 30 September 2009 |
| CVE-2009-3494 | Multiple SQL injection vulnerabilities in index.php in T-HTB Manager 0.5, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in a delete_category action, (2) the name parameter in an… | EXPLOIT ✓MEDIUM 6.8EPSS 0.94% | 30 September 2009 |
| CVE-2009-3493 | Multiple cross-site scripting (XSS) vulnerabilities in Zenas PaoBacheca Guestbook 2.1 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) scrivi.php and (2) index.php. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.56% | 30 September 2009 |
| CVE-2009-3492 | Multiple PHP remote file inclusion vulnerabilities in Loggix Project 9.4.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pathToIndex parameter to (1) Calendar.php, (2) Comment.php, (3) Rss.php and (4) Trackback.php in… | EXPLOIT ✓HIGH 7.5EPSS 2.10% | 30 September 2009 |
| CVE-2009-3491 | SQL injection vulnerability in the Kinfusion SportFusion (com_sportfusion) component 0.2.2 through 0.2.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid[0] parameter in a teamdetail action to index.php. | EXPLOIT ✓HIGH 7.5EPSS 1.13% | 30 September 2009 |
| CVE-2009-3489 | Adobe Photoshop Elements 8.0 installs the Adobe Active File Monitor V8 service with an insecure security descriptor, which allows local users to (1) stop the service via the stop command, (2) execute arbitrary commands as SYSTEM by using the config… | EXPLOIT ×2 ✓HIGH 7.8EPSS 1.95% | 30 September 2009 |
| CVE-2009-3487 | Multiple cross-site scripting (XSS) vulnerabilities in the J-Web interface in Juniper JUNOS 8.5R1.14 allow remote authenticated users to inject arbitrary web script or HTML via (1) the JEXEC_OUTID parameter in a JEXEC_MODE_RELAY_OUTPUT action to the… | EXPLOIT ×2 ✓LOW 3.5EPSS 1.25% | 30 September 2009 |
| CVE-2009-3486 | Multiple cross-site scripting (XSS) vulnerabilities in the J-Web interface in Juniper JUNOS 8.5R1.14 allow remote authenticated users to inject arbitrary web script or HTML via the host parameter to (1) the pinghost program, reachable through the… | EXPLOIT ×2 ✓LOW 3.5EPSS 1.25% | 30 September 2009 |
| CVE-2009-3485 | Cross-site scripting (XSS) vulnerability in the J-Web interface in Juniper JUNOS 8.5R1.14 and 9.0R1.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI. | EXPLOIT ✓MEDIUM 4.3EPSS 1.45% | 30 September 2009 |
| CVE-2009-3484 | Stack-based buffer overflow in Core FTP 2.1 build 1612 allows user-assisted remote attackers to execute arbitrary code via a long hostname in an FTP server entry in a site backup file. | EXPLOIT ✓HIGH 9.3EPSS 5.64% | 30 September 2009 |
| CVE-2009-3469 | Cross-site scripting (XSS) vulnerability in profiles/html/simpleSearch.do in IBM Lotus Connections 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 3.75% | 29 September 2009 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.