Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
397,891 CVEs1,723 in CISA KEV17,253 with EPSS ≥ 10%25,049 with a public exploitUpdated 25 September 2026
25,049 results · page 233 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2009-1951 | Cross-site scripting (XSS) vulnerability in index.php in PropertyMax Pro FREE 0.3 allows remote attackers to inject arbitrary web script or HTML via the pl parameter in a mi action. | EXPLOIT ✓MEDIUM 4.3EPSS 1.27% | 5 June 2009 |
| CVE-2009-1950 | SQL injection vulnerability in yorum.asp in WebEyes Guest Book 3 allows remote attackers to execute arbitrary SQL commands via the mesajid parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 5 June 2009 |
| CVE-2009-1949 | import_wbb1.php in Unclassified NewsBoard (UNB) 1.6.4 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message. | EXPLOIT ✓HIGH 7.8EPSS 2.66% | 5 June 2009 |
| CVE-2009-1948 | Multiple directory traversal vulnerabilities in forum.php in Unclassified NewsBoard (UNB) 1.6.4, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to (1) read arbitrary recently-modified files via a .. | EXPLOIT ✓MEDIUM 5.1EPSS 2.02% | 5 June 2009 |
| CVE-2009-1947 | SQL injection vulnerability in the UnbDbEncode function in unb_lib/database.lib.php in Unclassified NewsBoard (UNB) 1.6.4 allows remote attackers to execute arbitrary SQL commands via the Query parameter in a search action to forum.php, a different… | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 5 June 2009 |
| CVE-2009-1946 | PHP remote file inclusion vulnerability in latestposts.php in AdaptBB 1.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the forumspath parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 1.86% | 5 June 2009 |
| CVE-2009-1945 | SQL injection vulnerability in webCal3_detail.asp in WebCal 3.04 allows remote attackers to execute arbitrary SQL commands via the event_id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 5 June 2009 |
| CVE-2009-1944 | Stack-based buffer overflow in AIMP 2.51 build 330 allows remote attackers to execute arbitrary code via an MP3 file with a long ID3 tag. | EXPLOIT ✓HIGH 9.3EPSS 10.4% | 5 June 2009 |
| CVE-2009-1943 | Stack-based buffer overflow in the IKE service (ireIke.exe) in SafeNet SoftRemote before 10.8.6 allows remote attackers to execute arbitrary code via a long request to UDP port 62514. | EXPLOIT ✓HIGH 10.0EPSS 72.2% | 5 June 2009 |
| CVE-2008-6825 | Directory traversal vulnerability in user/index.php in Fonality trixbox CE 2.6.1 and earlier allows remote attackers to include and execute arbitrary files via a .. | EXPLOIT ×3 ✓MEDIUM 6.8EPSS 20.3% | 5 June 2009 |
| CVE-2009-1941 | PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for dbbackup.txt. | EXPLOIT ✓MEDIUM 5.0EPSS 2.29% | 5 June 2009 |
| CVE-2009-1938 | Cross-site scripting (XSS) vulnerability in Joomla! | EXPLOIT ✓MEDIUM 4.3EPSS 4.30% | 5 June 2009 |
| CVE-2009-1936 | _functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass a protection mechanism to conduct remote file inclusion and directory traversal attacks,… | EXPLOIT ✓CRITICAL 9.8EPSS 42.2% | 5 June 2009 |
| CVE-2009-0580 | Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords,… | EXPLOIT ✓MEDIUM 4.3EPSS 94.4% | 5 June 2009 |
| CVE-2009-1916 | dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the ns parameter. | EXPLOIT ✓HIGH 10.0EPSS 10.3% | 4 June 2009 |
| CVE-2009-1915 | Stack-based buffer overflow in the URL Search Hook (ICQToolBar.dll) in ICQ 6.5 allows remote attackers to cause a denial of service (persistent crash) and possibly execute arbitrary code via an Internet shortcut .URL file containing a long URL… | EXPLOIT ✓MEDIUM 4.3EPSS 4.95% | 4 June 2009 |
| CVE-2009-1914 | The pci_register_iommu_region function in arch/sparc/kernel/pci_common.c in the Linux kernel before 2.6.29 on the sparc64 platform allows local users to cause a denial of service (system crash) by reading the /proc/iomem file, related to uninitialized… | EXPLOIT ✓MEDIUM 4.9EPSS 0.67% | 4 June 2009 |
| CVE-2009-1913 | SQL injection vulnerability in manager.php in LuxBum 0.5.5, when magic_quotes_gpc is disabled and dotclear authentication is used, allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action. | EXPLOIT ✓MEDIUM 5.1EPSS 0.98% | 4 June 2009 |
| CVE-2009-1912 | Directory traversal vulnerability in src/func/language.php in webSPELL 4.2.0e and earlier allows remote attackers to include and execute arbitrary local .php files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 3.18% | 4 June 2009 |
| CVE-2009-1911 | Directory traversal vulnerability in .include/init.php (aka admin/_include/init.php) in QuiXplorer 2.3.2 and earlier, as used in TinyWebGallery (TWG) 1.7.6 and earlier, allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 2.52% | 4 June 2009 |
| CVE-2009-1910 | SQL injection vulnerability in index.php in RTWebalbum 1.0.462 allows remote attackers to execute arbitrary SQL commands via the AlbumId parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.21% | 4 June 2009 |
| CVE-2009-1907 | Cross-site scripting (XSS) vulnerability in claroline/linker/notfound.php in Claroline 1.8.11 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header. | EXPLOIT ✓MEDIUM 4.3EPSS 1.83% | 4 June 2009 |
| CVE-2009-1386 | ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello. | EXPLOIT ✓MEDIUM 5.0EPSS 80.1% | 4 June 2009 |
| CVE-2008-6824 | The management interface on the A-LINK WL54AP3 and WL54AP2 access points has a blank default password for the admin account, which makes it easier for remote attackers to obtain access. | EXPLOIT ✓HIGH 10.0EPSS 3.57% | 4 June 2009 |
| CVE-2008-6823 | Multiple cross-site request forgery (CSRF) vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2 access points before firmware 1.4.2-eng1 allow remote attackers to hijack the authentication of administrators for requests that (1)… | EXPLOIT ✓MEDIUM 6.8EPSS 1.54% | 4 June 2009 |
| CVE-2008-6822 | Unrestricted file upload vulnerability in uploadp.php in New Earth Programming Team (NEPT) imgupload (aka Image Uploader) 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension and a modified content type,… | EXPLOIT ✓HIGH 7.5EPSS 4.34% | 4 June 2009 |
| CVE-2009-1902 | The multipart processor in ModSecurity before 2.5.9 allows remote attackers to cause a denial of service (crash) via a multipart form datapost request with a missing part header name, which triggers a NULL pointer dereference. | EXPLOIT ✓MEDIUM 5.0EPSS 13.7% | 3 June 2009 |
| CVE-2009-0955 | Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted image description atoms in an Apple video file, related to a "sign extension issue." | EXPLOIT ✓HIGH 9.3EPSS 9.50% | 2 June 2009 |
| CVE-2009-0950 | Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an itms: URL with a long URL component after a colon. | EXPLOIT ×4 ✓HIGH 9.3EPSS 28.8% | 2 June 2009 |
| CVE-2009-1854 | Million Dollar Text Links 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the userid cookie to 1. | EXPLOIT ✓HIGH 7.5EPSS 2.43% | 1 June 2009 |
| CVE-2009-1853 | Multiple SQL injection vulnerabilities in index.php in Kensei Board 2.0 BETA (aka 2.0.0b) and earlier allow remote attackers to execute arbitrary SQL commands via the (1) f and (2) t parameters in a showforum action. | EXPLOIT ✓HIGH 7.5EPSS 0.95% | 1 June 2009 |
| CVE-2009-1852 | Multiple SQL injection vulnerabilities in Graphiks MyForum 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 1 June 2009 |
| CVE-2009-1850 | SQL injection vulnerability in index.php in phpBugTracker 1.0.3 allows remote attackers to execute arbitrary SQL commands via the password parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 1 June 2009 |
| CVE-2009-1848 | SQL injection vulnerability in the JoomlaMe AgoraGroups (aka AG or com_agoragroup) component 0.3.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a groupdetail action to index.php. | EXPLOIT ✓HIGH 7.5EPSS 0.95% | 1 June 2009 |
| CVE-2009-1847 | Directory traversal vulnerability in index.php in Easy PX 41 CMS 9.0 B1 allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.35% | 1 June 2009 |
| CVE-2009-1846 | Multiple directory traversal vulnerabilities in SiteX 0.7.4 Build 418 and earlier allow remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.30% | 1 June 2009 |
| CVE-2009-1845 | Cross-site scripting (XSS) vulnerability in ajax/updatecheck.php in Lussumo Vanilla 1.1.5 and 1.1.7 allows remote attackers to inject arbitrary web script or HTML via the RequestName parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.51% | 1 June 2009 |
| CVE-2009-1843 | Multiple SQL injection vulnerabilities in Flash Quiz Beta 2 allow remote attackers to execute arbitrary SQL commands via the (1) quiz parameter to (a) num_questions.php, (b) answers.php, (c) high_score.php, (d) high_score_web.php, (e)… | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 1 June 2009 |
| CVE-2009-1842 | SQL injection vulnerability in main/tracking/userLog.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header. | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 1 June 2009 |
| CVE-2009-1831 | The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute arbitrary code via a crafted MAKI file, which triggers an incorrect sign extension, an integer overflow, and a stack-based buffer… | EXPLOIT ×5 ✓HIGH 9.3EPSS 36.3% | 29 May 2009 |
| CVE-2009-1830 | Stack-based buffer overflow in Soulseek 156 and 157 NS allows remote attackers to execute arbitrary code via a long search query. | EXPLOIT ×3 ✓HIGH 10.0EPSS 8.57% | 29 May 2009 |
| CVE-2009-1828 | Mozilla Firefox 3.0.10 allows remote attackers to cause a denial of service (infinite loop, application hang, and memory consumption) via a KEYGEN element in conjunction with (1) a META element specifying automatic page refresh or (2) a JavaScript… | EXPLOIT ✓MEDIUM 5.0EPSS 8.78% | 29 May 2009 |
| CVE-2009-1827 | The SVG component in Mozilla Firefox 3.0.4 allows remote attackers to cause a denial of service (application hang) via a large value in the r (aka Radius) attribute of a circle element, related to an "unclamped loop." | EXPLOIT ✓MEDIUM 5.0EPSS 3.94% | 29 May 2009 |
| CVE-2009-1826 | modules/admuser.php in myGesuad 0.9.14 (aka 0.9) does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find action. | EXPLOIT ✓MEDIUM 6.5EPSS 2.09% | 29 May 2009 |
| CVE-2009-1825 | modules/admuser.php in myColex 1.4.2 does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find action. | EXPLOIT ✓MEDIUM 4.0EPSS 2.42% | 29 May 2009 |
| CVE-2009-1824 | The ps_drv.sys kernel driver in ArcaBit ArcaVir 2009 Antivirus Protection 9.4.3201.9 and earlier, ArcaVir 2009 Internet Security 9.4.3202.9 and earlier, ArcaVir 2009 System Protection 9.4.3203.9 and earlier, and ArcaBit 2009 Home Protection 9.4.3204.9… | EXPLOIT ✓HIGH 7.2EPSS 0.96% | 29 May 2009 |
| CVE-2009-1822 | Multiple PHP remote file inclusion vulnerabilities in the InterJoomla ArtForms (com_artforms) component 2.1b7 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) imgcaptcha.php or… | EXPLOIT ✓HIGH 7.5EPSS 2.10% | 29 May 2009 |
| CVE-2009-1821 | DMXReady Registration Manager 1.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for databases/webblogmanager.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.62% | 29 May 2009 |
| CVE-2009-1820 | Cross-site scripting (XSS) vulnerability in product.php in 2daybiz Custom T-shirt Design Script allows remote attackers to inject arbitrary web script or HTML via the id parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.48% | 29 May 2009 |
| CVE-2009-1819 | SQL injection vulnerability in product.php in 2daybiz Custom T-shirt Design Script allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 29 May 2009 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.