Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
397,948 CVEs1,725 in CISA KEV17,253 with EPSS ≥ 10%25,049 with a public exploitUpdated 25 September 2026
25,049 results · page 242 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2008-6615 | SQL injection vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to execute arbitrary SQL commands via the keyword parameter in the advanced_search_result page. | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 6 April 2009 |
| CVE-2009-1248 | Multiple PHP remote file inclusion vulnerabilities in Acute Control Panel 1.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the theme_directory parameter to (1) container.php and (2) header.php in themes/. | EXPLOIT ✓HIGH 7.5EPSS 2.46% | 6 April 2009 |
| CVE-2009-1247 | SQL injection vulnerability in login.php in Acute Control Panel 1.0.0 allows remote attackers to execute arbitrary SQL commands via the username parameter. | EXPLOIT ✓HIGH 7.5EPSS 13.7% | 6 April 2009 |
| CVE-2009-1246 | Multiple directory traversal vulnerabilities in Blogplus 1.0 allow remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.86% | 6 April 2009 |
| CVE-2008-6613 | uploader.php in minimal-ablog 0.4 does not properly restrict access, which allows remote attackers to gain administrative privileges via a direct request. | EXPLOIT ✓HIGH 7.5EPSS 2.45% | 6 April 2009 |
| CVE-2008-6612 | Unrestricted file upload vulnerability in admin/uploader.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in img/. | EXPLOIT ✓MEDIUM 6.8EPSS 3.37% | 6 April 2009 |
| CVE-2008-6611 | SQL injection vulnerability in index.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.15% | 6 April 2009 |
| CVE-2008-6609 | Cross-site scripting (XSS) vulnerability in phpcksec.php in Stefan Ott phpcksec 0.2 allows remote attackers to inject arbitrary web script or HTML via the path parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.46% | 6 April 2009 |
| CVE-2008-6608 | Multiple SQL injection vulnerabilities in DevelopItEasy Events Calendar 1.2 allow remote attackers to execute arbitrary SQL commands via (1) the user_name parameter (aka user field) to admin/index.php, (2) the user_pass parameter (aka pass field) to… | EXPLOIT ✓HIGH 7.5EPSS 2.35% | 6 April 2009 |
| CVE-2008-6607 | Cross-site scripting (XSS) vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to inject arbitrary web script or HTML via the thema parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.21% | 6 April 2009 |
| CVE-2008-6606 | SQL injection vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ×2 ✓HIGH 7.5EPSS 0.97% | 6 April 2009 |
| CVE-2008-6605 | Cross-site request forgery (CSRF) vulnerability in the xslt script in the web-based management interface on the 2wire 1701HG, 1800HW, 2071HG, and 2700HG with firmware 3.17.5, 3.7.1, 4.25.19, or 5.29.51 allows remote attackers to hijack the intranet… | EXPLOIT ✓MEDIUM 6.8EPSS 0.94% | 6 April 2009 |
| CVE-2008-6604 | Directory traversal vulnerability in index.php in PicoFlat CMS 0.5.9 allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 10.0EPSS 8.17% | 4 April 2009 |
| CVE-2008-6597 | Cross-site scripting (XSS) vulnerability in upload/install/index.php in PHCDownload 1.1 allows remote attackers to inject arbitrary web script or HTML via the step parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.18% | 3 April 2009 |
| CVE-2008-6596 | SQL injection vulnerability in admin/index.php in PHCDownload 1.1 allows remote attackers to execute arbitrary SQL commands via the hash parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 3 April 2009 |
| CVE-2008-6593 | SQL injection vulnerability in LightNEasy/lightneasy.php in LightNEasy SQLite 1.2.2 and earlier allows remote attackers to inject arbitrary PHP code into comments.dat via the dlid parameter to index.php. | EXPLOIT ✓HIGH 7.5EPSS 3.46% | 3 April 2009 |
| CVE-2008-6592 | thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy "no database" (aka flat) and SQLite 1.2.2 and earlier, allows remote attackers to copy, rename, and read arbitrary files via directory traversal sequences in the image parameter with a modified… | EXPLOIT ✓HIGH 7.5EPSS 2.90% | 3 April 2009 |
| CVE-2008-6590 | Multiple directory traversal vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allow remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 3.37% | 3 April 2009 |
| CVE-2008-6586 | Cross-site request forgery (CSRF) vulnerability in gui/index.php in µTorrent (uTorrent) WebUI 0.315 allows remote attackers to (1) hijack the authentication of users for requests that force the download of arbitrary torrent files via the add-url action… | EXPLOIT ✓MEDIUM 6.8EPSS 2.72% | 3 April 2009 |
| CVE-2008-6585 | Cross-site request forgery (CSRF) vulnerability in html/admin.php in TorrentFlux 2.3 allows remote attackers to hijack the authentication of administrators for requests that add new accounts via the addUser action. | EXPLOIT ✓MEDIUM 6.8EPSS 1.22% | 3 April 2009 |
| CVE-2008-6583 | Buffer overflow in BS.player 2.27 build 959 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .SRT file. | EXPLOIT ✓HIGH 9.3EPSS 7.04% | 3 April 2009 |
| CVE-2009-1238 | Race condition in the HFS vfs sysctl interface in XNU 1228.8.20 and earlier on Apple Mac OS X 10.5.6 and earlier allows local users to cause a denial of service (kernel memory corruption) by simultaneously executing the same HFS_SET_PKG_EXTENSIONS code… | EXPLOIT ✓HIGH 7.2EPSS 0.62% | 2 April 2009 |
| CVE-2009-1237 | Multiple memory leaks in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allow local users to cause a denial of service (kernel memory consumption) via a crafted (1) SYS_add_profil or (2) SYS___mac_getfsstat system call. | EXPLOIT ×2 ✓MEDIUM 4.9EPSS 0.91% | 2 April 2009 |
| CVE-2009-1236 | Heap-based buffer overflow in the AppleTalk networking stack in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allows remote attackers to cause a denial of service (system crash) via a ZIP NOTIFY (aka ZIPOP_NOTIFY) packet that overwrites… | EXPLOIT ✓HIGH 10.0EPSS 8.41% | 2 April 2009 |
| CVE-2009-1235 | XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space and the HFS IOCTL handler, which allows local users to overwrite kernel memory and gain privileges by attaching an HFS+ disk image… | EXPLOIT ✓HIGH 7.2EPSS 0.98% | 2 April 2009 |
| CVE-2009-1234 | Opera 9.64 allows remote attackers to cause a denial of service (application crash) via an XML document containing a long series of start-tags with no corresponding end-tags. | EXPLOIT ✓MEDIUM 4.3EPSS 6.52% | 2 April 2009 |
| CVE-2009-1233 | Apple Safari 3.2.2 and 4 Beta on Windows allows remote attackers to cause a denial of service (application crash) via an XML document containing many nested A elements. | EXPLOIT ✓MEDIUM 4.3EPSS 4.45% | 2 April 2009 |
| CVE-2009-1232 | Mozilla Firefox 3.0.8 and earlier 3.0.x versions allows remote attackers to cause a denial of service (memory corruption) via an XML document composed of a long series of start-tags with no corresponding end-tags. | EXPLOIT ✓MEDIUM 4.3EPSS 5.47% | 2 April 2009 |
| CVE-2009-1230 | Static code injection vulnerability in index.php in Podcast Generator 1.1 and earlier allows remote authenticated administrators to inject arbitrary PHP code into config.php via the recent parameter in a config change action. | EXPLOIT ✓MEDIUM 6.5EPSS 1.79% | 2 April 2009 |
| CVE-2009-1229 | SQL injection vulnerability in Arcadwy Arcade Script allows remote attackers to execute arbitrary SQL commands via the user cookie parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.04% | 2 April 2009 |
| CVE-2009-1228 | Cross-site scripting (XSS) vulnerability in register.php in Arcadwy Arcade Script CMS allows remote attackers to inject arbitrary web script or HTML via the username field (user_name parameter). | EXPLOIT ✓MEDIUM 4.3EPSS 1.52% | 2 April 2009 |
| CVE-2009-1227 | Buffer overflow in the PKI Web Service in Check Point Firewall-1 PKI Web Service allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) Authorization or (2) Referer HTTP header to TCP port 18624. | EXPLOIT ✓HIGH 10.0EPSS 7.20% | 2 April 2009 |
| CVE-2009-1226 | core/admin/delete.php in Podcast Generator 1.1 and earlier does not properly restrict access to administrative functions, which allows remote attackers to delete arbitrary files via the file parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.35% | 2 April 2009 |
| CVE-2009-1225 | Cross-site scripting (XSS) vulnerability in index.php in Turnkey Ebook Store 1.1 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a search action. | EXPLOIT ✓MEDIUM 4.3EPSS 1.19% | 2 April 2009 |
| CVE-2009-1224 | SQL injection vulnerability in vsp-core/pub/themes/bismarck/gamestat.php in vsp stats processor 0.45 allows remote attackers to execute arbitrary SQL commands via the gameID parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.95% | 2 April 2009 |
| CVE-2009-1222 | Directory traversal vulnerability in index.php in webEdition 6.0.0.4 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.1EPSS 2.02% | 2 April 2009 |
| CVE-2008-6582 | SQL injection vulnerability in index.php in Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action. | EXPLOIT ×2 ✓HIGH 7.5EPSS 0.98% | 2 April 2009 |
| CVE-2008-6581 | login.php in PhpAddEdit 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the addedit cookie parameter. | EXPLOIT ✓HIGH 7.5EPSS 3.33% | 2 April 2009 |
| CVE-2008-6580 | The Red_Reservations script for ColdFusion stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database via a direct request to (1) makered.mdb and (2) makered97.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.23% | 2 April 2009 |
| CVE-2003-1571 | Web Wiz Guestbook 6.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for database/WWGguestbook.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.61% | 2 April 2009 |
| CVE-2009-1220 | Cross-site scripting (XSS) vulnerability in +webvpn+/index.html in WebVPN on the Cisco Adaptive Security Appliances (ASA) 5520 with software 7.2(4)30 and earlier 7.2 versions including 7.2(2)22, and 8.0(4)28 and earlier 8.0 versions, when clientless… | EXPLOIT ✓MEDIUM 4.3EPSS 9.01% | 1 April 2009 |
| CVE-2009-1219 | Sun Calendar Express Web Server in Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6 2004Q2 through 6.3-7.01 allows remote attackers to cause a denial of service (daemon crash) via multiple requests to the default URI with alphabetic… | EXPLOIT ✓MEDIUM 5.0EPSS 8.70% | 1 April 2009 |
| CVE-2009-1218 | Multiple cross-site scripting (XSS) vulnerabilities in Sun Calendar Express Web Server in Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6 2004Q2 through 6.3-7.01 allow remote attackers to inject arbitrary web script or HTML via (1) the… | EXPLOIT ✓MEDIUM 4.3EPSS 4.36% | 1 April 2009 |
| CVE-2007-4475 | Stack-based buffer overflow in EAI WebViewer3D ActiveX control (webviewer3d.dll) in SAP AG SAPgui before 7.10 Patch Level 9 allows remote attackers to execute arbitrary code via a long argument to the SaveViewToSessionFile method. | EXPLOIT ×2 ✓HIGH 9.3EPSS 40.3% | 1 April 2009 |
| CVE-2009-1217 | Off-by-one error in the GpFont::SetData function in gdiplus.dll in Microsoft GDI+ on Windows XP allows remote attackers to cause a denial of service (stack corruption and application termination) via a crafted EMF file that triggers an integer overflow,… | EXPLOIT ✓MEDIUM 4.3EPSS 16.3% | 1 April 2009 |
| CVE-2009-1212 | Multiple insecure method vulnerabilities in PRECIS~2.DLL in the PrecisionID Datamatrix ActiveX control (DMATRIXLib.Datamatrix) allow remote attackers to overwrite arbitrary files via the (1) SaveBarCode and (2) SaveEnhWMF methods. | EXPLOIT ✓HIGH 7.8EPSS 5.74% | 1 April 2009 |
| CVE-2009-1210 | Format string vulnerability in the PROFINET/DCP (PN-DCP) dissector in Wireshark 1.0.6 and earlier allows remote attackers to execute arbitrary code via a PN-DCP packet with format string specifiers in the station name. | EXPLOIT ✓HIGH 10.0EPSS 15.2% | 1 April 2009 |
| CVE-2009-1209 | Stack-based buffer overflow in W3C Amaya Web Browser 11.1 allows remote attackers to execute arbitrary code via a script tag with a long defer attribute. | EXPLOIT ×3 ✓HIGH 9.3EPSS 12.4% | 1 April 2009 |
| CVE-2009-0686 | The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro 2008 and 2009, and Security Pro 2008 and 2009, allows local users to gain privileges via a crafted IRP in a METHOD_NEITHER IOCTL request to \Device\tmactmon… | EXPLOIT ✓HIGH 7.2EPSS 0.80% | 1 April 2009 |
| CVE-2009-1204 | Cross-site scripting (XSS) vulnerability in TikiWiki (Tiki) CMS/Groupware 2.2 allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF portion of a URI to (1) tiki-galleries.php, (2) tiki-list_file_gallery.php, (3)… | EXPLOIT ×3 ✓MEDIUM 4.3EPSS 4.54% | 1 April 2009 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.