Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
397,901 CVEs1,723 in CISA KEV17,253 with EPSS ≥ 10%25,049 with a public exploitUpdated 25 September 2026
25,049 results · page 235 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2009-1742 | code.php in PC4Arb Pc4 Uploader 9.0 and earlier makes it easier for remote attackers to conduct SQL injection attacks via crafted keyword sequences that are removed from a filter in the id parameter in a banner action, as demonstrated via the… | EXPLOIT ✓HIGH 7.5EPSS 1.34% | 20 May 2009 |
| CVE-2009-1741 | Multiple SQL injection vulnerabilities in login.php in DM FileManager 3.9.2, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields. | EXPLOIT ✓MEDIUM 6.8EPSS 1.94% | 20 May 2009 |
| CVE-2009-1739 | PAD Site Scripts 3.6 allows remote attackers to bypass authentication and gain privileges as other users, including administrative privileges, by setting the authuser cookie parameter to a valid username. | EXPLOIT ✓HIGH 7.5EPSS 2.77% | 20 May 2009 |
| CVE-2009-1736 | SQL injection vulnerability in the GridSupport (GS) Ticket System (com_gsticketsystem) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a viewCategory action to index.php. | EXPLOIT ✓HIGH 7.5EPSS 1.13% | 20 May 2009 |
| CVE-2009-1735 | Cross-site scripting (XSS) vulnerability in search.php in VidSharePro allows remote attackers to inject arbitrary web script or HTML via the searchtxt parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.69% | 20 May 2009 |
| CVE-2009-1734 | SQL injection vulnerability in listing_video.php in VidSharePro allows remote attackers to execute arbitrary SQL commands via the catid parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.13% | 20 May 2009 |
| CVE-2009-1730 | Multiple directory traversal vulnerabilities in NetMechanica NetDecision TFTP Server 4.2 allow remote attackers to read or modify arbitrary files via directory traversal sequences in the (1) GET or (2) PUT command. | EXPLOIT ✓HIGH 10.0EPSS 54.5% | 20 May 2009 |
| CVE-2009-1379 | Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS… | EXPLOIT ✓MEDIUM 5.0EPSS 18.2% | 19 May 2009 |
| CVE-2009-1678 | Directory traversal vulnerability in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allows remote attackers to create or overwrite arbitrary files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.43% | 18 May 2009 |
| CVE-2009-1677 | Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow (1) remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's… | EXPLOIT ✓MEDIUM 6.5EPSS 2.13% | 18 May 2009 |
| CVE-2009-1676 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. | EXPLOIT ✓UnscoredEPSS — | 18 May 2009 |
| CVE-2009-1675 | Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a long 227 reply to a PASV command. | EXPLOIT ✓HIGH 9.3EPSS 13.8% | 18 May 2009 |
| CVE-2009-1674 | Stack-based buffer overflow in Microchip MPLAB IDE 8.30 allows user-assisted remote attackers to execute arbitrary code via a long .cof pathname in a [TOOL_SETTINGS] section in a .mcp file, possibly a related issue to CVE-2009-1608. | EXPLOIT ✓HIGH 9.3EPSS 4.90% | 18 May 2009 |
| CVE-2009-1672 | The Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 13 allows remote attackers to (1) execute arbitrary code via a .jnlp URL in the argument to the launch method, and might allow remote… | EXPLOIT ✓HIGH 9.3EPSS 9.64% | 18 May 2009 |
| CVE-2009-1671 | Multiple buffer overflows in the Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 13 allow remote attackers to execute arbitrary code via a long string argument to the (1)… | EXPLOIT ✓HIGH 9.3EPSS 10.3% | 18 May 2009 |
| CVE-2009-1670 | user/index.php in TCPDB 3.8 does not require administrative authentication, which allows remote attackers to add admin accounts via unspecified vectors. | EXPLOIT ✓HIGH 7.5EPSS 6.87% | 18 May 2009 |
| CVE-2009-1669 | The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function. | EXPLOIT ✓HIGH 10.0EPSS 14.1% | 18 May 2009 |
| CVE-2009-1668 | TYPSoft FTP Server 1.11 allows remote attackers to cause a denial of service (CPU consumption) by sending an ABOR (abort) command without an active file transfer. | EXPLOIT ✓MEDIUM 4.0EPSS 6.00% | 18 May 2009 |
| CVE-2009-1667 | Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a long entry in a .m3u file, a different vector than CVE-2009-5137. | EXPLOIT ×4 ✓HIGH 9.3EPSS 21.4% | 18 May 2009 |
| CVE-2009-1665 | myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to remove arbitrary user accounts via a modified userid parameter without specifying any additional fields. | EXPLOIT ✓MEDIUM 6.4EPSS 2.33% | 18 May 2009 |
| CVE-2009-1664 | myaccount.php in Easy Scripts Answer and Question Script does not verify the original password before changing passwords, which allows remote attackers to change the password of other users and gain privileges via modified userid, txtpassword, and… | EXPLOIT ✓HIGH 7.5EPSS 2.05% | 18 May 2009 |
| CVE-2009-1663 | Unrestricted file upload vulnerability in myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in… | EXPLOIT ✓MEDIUM 6.8EPSS 2.85% | 18 May 2009 |
| CVE-2009-1662 | Multiple SQL injection vulnerabilities in admin/login.php in Wright Way Services Recipe Script 5 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) Password fields, as reachable from admin/index.php. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 18 May 2009 |
| CVE-2009-1661 | SQL injection vulnerability in admin/utopic.php in uTopic 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the rating parameter to index.php. | EXPLOIT ✓MEDIUM 6.8EPSS 1.21% | 18 May 2009 |
| CVE-2009-1660 | Stack-based buffer overflow in URUWorks ViPlay3 3.0 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long file entry in a .vpl file. | EXPLOIT ✓HIGH 9.3EPSS 5.83% | 18 May 2009 |
| CVE-2009-1659 | Unrestricted file upload vulnerability in admin/uploadimage.php in eLitius 1.0 allows remote attackers to bypass intended access restrictions and upload and execute arbitrary files via an avatar file with an accepted Content-Type such as image/gif, then… | EXPLOIT ✓MEDIUM 6.8EPSS 1.96% | 18 May 2009 |
| CVE-2009-1658 | Multiple SQL injection vulnerabilities in admin/admin.php in Realty Webware Technologies Realty Web-Base 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) user (username) and (2) password parameters. | EXPLOIT ✓HIGH 7.5EPSS 2.05% | 18 May 2009 |
| CVE-2008-6811 | Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct… | EXPLOIT ✓MEDIUM 6.8EPSS 7.10% | 18 May 2009 |
| CVE-2008-6810 | Multiple SQL injection vulnerabilities in admin/checklogin.php in Venalsur Booking Centre Booking System for Hotels Group 2.01 allow remote attackers to execute arbitrary SQL commands via the (1) myusername (username) and (2) password parameters. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 18 May 2009 |
| CVE-2008-6809 | SQL injection vulnerability in hotel_habitaciones.php in Venalsur Booking Centre Booking System for Hotels Group 2.01 allows remote attackers to execute arbitrary SQL commands via the HotelID parameter. | EXPLOIT ×2 ✓HIGH 7.5EPSS 0.98% | 18 May 2009 |
| CVE-2009-1655 | Multiple SQL injection vulnerabilities in myaccount.php in Easy Scripts Answer and Question Script allow remote authenticated users to execute arbitrary SQL commands via the (1) user name (userid parameter) and (2) password. | EXPLOIT ✓MEDIUM 6.5EPSS 1.75% | 16 May 2009 |
| CVE-2009-1654 | Cross-site scripting (XSS) vulnerability in questiondetail.php in Easy Scripts Answer and Question Script allows remote attackers to inject arbitrary web script or HTML via the questionid parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.48% | 16 May 2009 |
| CVE-2009-1653 | Directory traversal vulnerability in examples/tbs_us_examples_0view.php in TinyButStrong 3.4.0 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓HIGH 7.8EPSS 2.91% | 16 May 2009 |
| CVE-2009-1652 | admin/adminaddeditdetails.php in Business Community Script does not properly restrict access, which allows remote attackers to gain privileges and add administrators via a direct request. | EXPLOIT ✓HIGH 7.5EPSS 6.10% | 16 May 2009 |
| CVE-2009-1651 | SQL injection vulnerability in admin/member_details.php in 2daybiz Business Community Script allows remote attackers to execute arbitrary SQL commands via the mid parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.04% | 16 May 2009 |
| CVE-2009-1650 | Multiple SQL injection vulnerabilities in photos.php in Shutter 0.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) albumID, (2) tagID, and (3) photoID parameters to index.html. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 16 May 2009 |
| CVE-2009-1649 | Directory traversal vulnerability in arch.php in beLive 0.2.3 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.35% | 16 May 2009 |
| CVE-2009-1647 | Heap-based buffer overflow in popcorn.exe in Ultrafunk Popcorn 1.87 allows remote POP3 servers to cause a denial of service (application crash) via a long string in a +OK response. | EXPLOIT ✓HIGH 9.3EPSS 2.74% | 15 May 2009 |
| CVE-2009-1646 | Stack-based buffer overflow in Mini-stream RM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long rtsp URL in a .ram file. | EXPLOIT ×2 ✓HIGH 9.3EPSS 5.06% | 15 May 2009 |
| CVE-2009-1645 | Multiple stack-based buffer overflows in Mini-stream Easy RM-MP3 Converter 3.0.0.7 allow remote attackers to execute arbitrary code via (1) a long rtsp URL in a .ram file and (2) a long string in the HREF attribute of a REF element in a .asx file. | EXPLOIT ×2 ✓HIGH 9.3EPSS 7.09% | 15 May 2009 |
| CVE-2009-1644 | Stack-based buffer overflow in Sorinara Streaming Audio Player 0.9 allows remote attackers to execute arbitrary code via a crafted .pla file. | EXPLOIT ×2 ✓HIGH 9.3EPSS 5.82% | 15 May 2009 |
| CVE-2009-1643 | Stack-based buffer overflow in Sorinara Soritong MP3 Player 1.0 allows remote attackers to execute arbitrary code via a crafted .m3u file. | EXPLOIT ×2 ✓HIGH 9.3EPSS 5.82% | 15 May 2009 |
| CVE-2009-1642 | Multiple stack-based buffer overflows in Mini-stream ASX to MP3 Converter 3.0.0.7 allow remote attackers to execute arbitrary code via (1) a long rtsp URL in a .ram file and (2) a long string in the HREF attribute of a REF element in a .asx file. | EXPLOIT ×6 ✓HIGH 9.3EPSS 6.86% | 15 May 2009 |
| CVE-2009-1641 | Multiple stack-based buffer overflows in Mini-stream Ripper 3.0.1.1 allow remote attackers to execute arbitrary code via (1) a long rtsp URL in a .ram file and (2) a long string in the HREF attribute of a REF element in a .asx file. | EXPLOIT ×2 ✓HIGH 9.3EPSS 30.9% | 15 May 2009 |
| CVE-2009-1638 | Techno Dreams Job Career Package 3.0 allows remote attackers to bypass authentication and obtain administrative access by setting the JobCareerAdmin cookie to Login. | EXPLOIT ✓HIGH 7.5EPSS 2.61% | 15 May 2009 |
| CVE-2009-1637 | profile.php in Simple Customer 1.3 does not require administrative authentication, which allows remote attackers to change the admin e-mail address and password via the email and password parameters. | EXPLOIT ✓MEDIUM 6.4EPSS 2.25% | 15 May 2009 |
| CVE-2009-0714 | Unspecified vulnerability in the dpwinsup module (dpwinsup.dll) for dpwingad (dpwingad.exe) in HP Data Protector Express and Express SSE 3.x before build 47065, and Express and Express SSE 4.x before build 46537, allows remote attackers to cause a… | EXPLOIT ×2 ✓HIGH 7.2EPSS 51.6% | 14 May 2009 |
| CVE-2009-0162 | Cross-site scripting (XSS) vulnerability in Safari before 3.2.3, and 4 Public Beta, on Apple Mac OS X 10.5 before 10.5.7 and Windows allows remote attackers to inject arbitrary web script or HTML via a crafted feed: URL. | EXPLOIT ✓MEDIUM 4.3EPSS 5.35% | 13 May 2009 |
| CVE-2009-1627 | Stack-based buffer overflow in Streaming Download Project (SDP) Downloader 2.3.0 allows remote attackers to execute arbitrary code via a long .asf URL in the HREF attribute of a REF element in a .asx file. | EXPLOIT ×3 ✓HIGH 9.3EPSS 7.33% | 12 May 2009 |
| CVE-2009-1626 | SQL injection vulnerability in public/specific.php in EZ-Blog before Beta 2 20090427, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the category parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.13% | 12 May 2009 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.