Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
397,901 CVEs1,725 in CISA KEV17,253 with EPSS ≥ 10%25,049 with a public exploitUpdated 25 September 2026
25,049 results · page 239 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2008-6745 | index.php in BlogPHP 2.0 allows remote attackers to gain administrator privileges via a crafted email parameter in a register2 action. | EXPLOIT ✓HIGH 7.5EPSS 5.94% | 23 April 2009 |
| CVE-2009-1370 | Stack-based buffer overflow in ape_plugin.plg in Xilisoft Video Converter 3.1.53.0704n and 5.1.23.0402 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .cue file. | EXPLOIT ✓HIGH 9.3EPSS 5.94% | 22 April 2009 |
| CVE-2009-1369 | moziloCMS 1.11 allows remote attackers to obtain sensitive information via the (1) gal[] parameter to gallery.php, (2) page[] and (3) cat[] parameter to index.php, or (4) file[] parameter to download.php, which reveals the installation path in an error… | EXPLOIT ✓MEDIUM 5.0EPSS 2.45% | 22 April 2009 |
| CVE-2009-1368 | Directory traversal vulnerability in index.php in moziloCMS 1.11 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓HIGH 7.5EPSS 6.16% | 22 April 2009 |
| CVE-2009-1367 | Cross-site scripting (XSS) vulnerability in index.php in moziloCMS 1.11 allows remote attackers to inject arbitrary web script or HTML via the query parameter in search action, a different issue than CVE-2008-6127.2a. | EXPLOIT ✓MEDIUM 4.3EPSS 1.48% | 22 April 2009 |
| CVE-2008-6743 | RSMScript 1.21 allows remote attackers to bypass authentication and gain administrative privileges by setting the verified cookie to an arbitrary value and performing a direct request to (1) delete.php, (2) edit-submit.php, (3) edit.php, (4) submit.php,… | EXPLOIT ✓HIGH 7.5EPSS 2.59% | 22 April 2009 |
| CVE-2009-1362 | SQL injection vulnerability in administration/index.php in chCounter 3.1.3 allows remote attackers to execute arbitrary SQL commands via the login_name parameter. | EXPLOIT ×2 ✓MEDIUM 6.8EPSS 0.82% | 22 April 2009 |
| CVE-2009-1361 | dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the host parameter. | EXPLOIT ✓HIGH 10.0EPSS 3.91% | 22 April 2009 |
| CVE-2009-1312 | Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or… | EXPLOIT ✓MEDIUM 4.3EPSS 5.56% | 22 April 2009 |
| CVE-2009-0307 | Cross-site scripting (XSS) vulnerability in the "Customize Statistics Page" (admin/statistics/ConfigureStatistics) in the MDS Connection Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) before 4.1.6 MR5 allows remote attackers to… | EXPLOIT ✓MEDIUM 4.3EPSS 3.49% | 22 April 2009 |
| CVE-2009-1337 | The exit_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the… | EXPLOIT ✓MEDIUM 4.4EPSS 1.26% | 22 April 2009 |
| CVE-2008-6742 | Foxy P2P software allows remote attackers to cause a denial of service (memory consumption) via a foxy URI with a download action and a large fs value. | EXPLOIT ✓MEDIUM 4.3EPSS 2.16% | 21 April 2009 |
| CVE-2008-6741 | SQL injection vulnerability in Load.php in Simple Machines Forum (SMF) 1.1.4 and earlier allows remote attackers to execute arbitrary SQL commands by setting the db_character_set parameter to a multibyte character set such as big5, which causes the… | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 21 April 2009 |
| CVE-2008-6740 | PHP remote file inclusion vulnerability in html/admin/modules/plugin_admin.php in HoMaP-CMS 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the _settings[pluginpath] parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 1.81% | 21 April 2009 |
| CVE-2008-6739 | Todd Woolums ASP Download management script 1.03 does not require authentication for setupdownload.asp, which allows remote attackers to gain administrator privileges via a direct request. | EXPLOIT ✓HIGH 7.5EPSS 2.25% | 21 April 2009 |
| CVE-2008-6738 | MyShoutPro 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin_access cookie to 1. | EXPLOIT ✓HIGH 7.5EPSS 2.56% | 21 April 2009 |
| CVE-2008-6737 | Crysis 1.21 and earlier allows remote attackers to obtain sensitive player information such as real IP addresses by sending a keyexchange packet without a previous join packet, which causes Crysis to send a disconnect packet that includes unrelated log… | EXPLOIT ✓HIGH 7.8EPSS 2.67% | 21 April 2009 |
| CVE-2008-6736 | Flat Calendar 1.1 does not properly restrict access to administrative functions, which allows remote attackers to (1) add new events via calAdd.php, as reachable from admin/add.php, or (2) delete events via admin/deleteEvent.php. | EXPLOIT ✓MEDIUM 6.4EPSS 2.20% | 21 April 2009 |
| CVE-2008-6735 | Directory traversal vulnerability in qc/index.php in ThaiQuickCart 3 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.8EPSS 1.85% | 21 April 2009 |
| CVE-2008-6734 | Directory traversal vulnerability in Public/index.php in Keller Web Admin CMS 0.94 Pro allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ×2 ✓HIGH 9.3EPSS 2.96% | 21 April 2009 |
| CVE-2009-1356 | Stack-based buffer overflow in Elecard AVC HD Player allows remote attackers to execute arbitrary code via a long MP3 filename in a playlist (.xpl) file. | EXPLOIT ✓HIGH 9.3EPSS 4.83% | 21 April 2009 |
| CVE-2009-1354 | Directory traversal vulnerability in Mongoose 2.4 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 4.0EPSS 2.27% | 21 April 2009 |
| CVE-2009-1353 | Buffer overflow in the http_parse_hex function in libz/misc.c in Zervit Webserver 0.02 allows remote attackers to cause a denial of service (daemon crash) via a long URI, related to http.c. | EXPLOIT ✓MEDIUM 5.0EPSS 7.79% | 21 April 2009 |
| CVE-2009-1352 | Stack-based buffer overflow in Dawningsoft PowerCHM 5.7 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an HTML file with a link to a long URL, as demonstrated by a .rar URL. | EXPLOIT ✓HIGH 9.3EPSS 5.55% | 21 April 2009 |
| CVE-2009-1351 | Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long URI in a playlist (.m3u) file. | EXPLOIT ✓HIGH 9.3EPSS 5.55% | 21 April 2009 |
| CVE-2009-1350 | Unspecified vulnerability in xtagent.exe in Novell NetIdentity Client before 1.2.4 allows remote attackers to execute arbitrary code by establishing an IPC$ connection to the XTIERRPCPIPE named pipe, and sending RPC messages that trigger a dereference… | EXPLOIT ✓HIGH 10.0EPSS 65.9% | 21 April 2009 |
| CVE-2009-1349 | Cross-site scripting (XSS) vulnerability in C2Net Stronghold 2.3 allows remote attackers to inject arbitrary web script or HTML via the URI. | EXPLOIT ✓MEDIUM 4.3EPSS 1.19% | 21 April 2009 |
| CVE-2009-1347 | Multiple SQL injection vulnerabilities in stats/index.php in chCounter 3.1.3 allow remote attackers to execute arbitrary SQL commands via (1) the login_name parameter (aka the username field) or (2) the login_pw parameter (aka the password field). | EXPLOIT ×2 ✓MEDIUM 6.8EPSS 0.96% | 20 April 2009 |
| CVE-2009-1346 | SQL injection vulnerability in publico/ficha.php in NetHoteles 3.0 allows remote attackers to execute arbitrary SQL commands via the id_establecimiento parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.04% | 20 April 2009 |
| CVE-2009-1345 | SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL commands via the id_document parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 20 April 2009 |
| CVE-2008-6731 | Unrestricted file upload vulnerability in submitlink.php in FlexPHPLink Pro 0.0.7 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the renamed file in… | EXPLOIT ✓HIGH 9.3EPSS 5.73% | 20 April 2009 |
| CVE-2008-6730 | Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPLink Pro 0.0.6 and 0.0.7, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the checkuser parameter (aka username field), or (2)… | EXPLOIT ✓MEDIUM 6.8EPSS 1.98% | 20 April 2009 |
| CVE-2008-6729 | Multiple cross-site request forgery (CSRF) vulnerabilities in password.php in PHPmotion 2.1 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that modify an account via the (1) password or (2) email_address… | EXPLOIT ✓MEDIUM 6.8EPSS 0.99% | 20 April 2009 |
| CVE-2008-6727 | Cross-site scripting (XSS) vulnerability in Ultimate PHP Board (UPB) 2.2.2, 2.2.1, and earlier 2.x versions allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header. | EXPLOIT ✓MEDIUM 4.3EPSS 1.50% | 20 April 2009 |
| CVE-2009-1335 | Microsoft Internet Explorer 7 and 8 on Windows XP and Vista allows remote attackers to cause a denial of service (application hang) via a large document composed of unprintable characters, aka MSRC 9011jr. | EXPLOIT ✓MEDIUM 4.3EPSS 15.7% | 17 April 2009 |
| CVE-2009-1334 | Cross-site scripting (XSS) vulnerability in login/FilepathLogin.html in IBM Tivoli Continuous Data Protection (CDP) for Files 3.1.4.0 allows remote attackers to inject arbitrary web script or HTML via the reason parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.77% | 17 April 2009 |
| CVE-2009-1331 | Integer overflow in Microsoft Windows Media Player (WMP) 11.0.5721.5260 allows remote attackers to cause a denial of service (application crash) via a crafted .mid file, as demonstrated by crash.mid. | EXPLOIT ✓HIGH 9.3EPSS 18.1% | 17 April 2009 |
| CVE-2009-1185 | udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space. | EXPLOIT ×3 ✓HIGH 7.2EPSS 81.5% | 17 April 2009 |
| CVE-2009-0039 | Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the… | EXPLOIT ✓MEDIUM 6.8EPSS 11.1% | 17 April 2009 |
| CVE-2009-0038 | Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4)… | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 18.0% | 17 April 2009 |
| CVE-2008-5518 | Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the… | EXPLOIT ✓HIGH 9.4EPSS 35.9% | 17 April 2009 |
| CVE-2009-1330 | Stack-based buffer overflow in Easy RM to MP3 Converter allows remote attackers to execute arbitrary code via a long filename in a playlist (.pls) file. | EXPLOIT ×10 ✓HIGH 9.3EPSS 21.7% | 17 April 2009 |
| CVE-2009-1329 | Stack-based buffer overflow in Mini-stream Shadow Stream Recorder 3.0.1.7 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file. | EXPLOIT ×6 ✓HIGH 9.3EPSS 5.85% | 17 April 2009 |
| CVE-2009-1328 | Stack-based buffer overflow in Mini-stream RM-MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file. | EXPLOIT ×7 ✓HIGH 9.3EPSS 7.13% | 17 April 2009 |
| CVE-2009-1327 | Stack-based buffer overflow in Mini-stream WM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file. | EXPLOIT ×6 ✓HIGH 9.3EPSS 6.03% | 17 April 2009 |
| CVE-2009-1326 | Stack-based buffer overflow in Mini-stream RM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file. | EXPLOIT ×7 ✓HIGH 9.3EPSS 7.13% | 17 April 2009 |
| CVE-2009-1325 | Stack-based buffer overflow in Mini-stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file. | EXPLOIT ×7 ✓HIGH 9.3EPSS 7.13% | 17 April 2009 |
| CVE-2009-1324 | Stack-based buffer overflow in Mini-stream ASX to MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file. | EXPLOIT ×7 ✓HIGH 9.3EPSS 16.5% | 17 April 2009 |
| CVE-2009-1323 | SQL injection vulnerability in body.asp in Web File Explorer 3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.04% | 17 April 2009 |
| CVE-2009-1322 | ASP Product Catalog 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for database/aspProductCatalog.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.29% | 17 April 2009 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.