Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
398,094 CVEs1,726 in CISA KEV17,253 with EPSS ≥ 10%25,049 with a public exploitUpdated 25 September 2026
25,049 results · page 250 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2008-6253 | Directory traversal vulnerability in data/inc/lib/pcltar.lib.php in Pluck 4.5.3, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the g_pcltar_lib_dir parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 4.96% | 24 February 2009 |
| CVE-2008-6252 | Stack-based buffer overflow in the smc program in smcFanControl 2.1.2 allows local users to execute arbitrary code and gain privileges via a long -k option. | EXPLOIT ✓HIGH 7.2EPSS 1.31% | 24 February 2009 |
| CVE-2008-6251 | PHP remote file inclusion vulnerability in includes/init.php in phpFan 3.3.4 allows remote attackers to execute arbitrary PHP code via a URL in the includepath parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 2.03% | 24 February 2009 |
| CVE-2008-6250 | SQL injection vulnerability in Comdev Web Blogger 4.1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the arcmonth parameter to a blog page. | EXPLOIT ✓MEDIUM 6.8EPSS 1.08% | 23 February 2009 |
| CVE-2008-6249 | SQL injection vulnerability in plugins/users/index.php in Galatolo WebManager 1.3a and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 23 February 2009 |
| CVE-2008-6248 | Cross-site scripting (XSS) vulnerability in all.php in Galatolo WebManager 1.3a and earlier allows remote attackers to inject arbitrary web script or HTML via the tag parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.45% | 23 February 2009 |
| CVE-2008-6247 | SQL injection vulnerability in topsite.php in Scripts For Sites (SFS) EZ Top Sites allows remote attackers to execute arbitrary SQL commands via the ts parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 23 February 2009 |
| CVE-2008-6246 | SQL injection vulnerability in category.php in Scripts For Sites (SFS) EZ Webring allows remote attackers to execute arbitrary SQL commands via the cat parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 23 February 2009 |
| CVE-2008-6245 | SQL injection vulnerability in track.php in Scripts For Sites (SFS) EZ BIZ PRO allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 23 February 2009 |
| CVE-2008-6244 | SQL injection vulnerability in view_reviews.php in Scripts for Sites (SFS) EZ Gaming Cheats allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 23 February 2009 |
| CVE-2008-6243 | SQL injection vulnerability in showcategory.php in Scripts For Sites (SFS) Hotscripts-like Site allows remote attackers to execute arbitrary SQL commands via the cid parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.04% | 23 February 2009 |
| CVE-2008-6242 | SQL injection vulnerability in SearchResults.php in Scripts For Sites (SFS) EZ e-store allows remote attackers to execute arbitrary SQL commands via the where parameter. | EXPLOIT ×2 ✓HIGH 7.5EPSS 0.98% | 23 February 2009 |
| CVE-2009-0711 | filter.php in PHPFootball 1.6 and earlier allows remote attackers to retrieve password hashes via a request with an Accounts value for the dbtable parameter, in conjunction with a Password value for the dbfield parameter. | EXPLOIT ✓MEDIUM 5.0EPSS 1.21% | 23 February 2009 |
| CVE-2009-0710 | Multiple cross-site scripting (XSS) vulnerabilities in PHPFootball 1.6 allow remote attackers to inject arbitrary web script or HTML via (1) the user parameter to login.php or (2) the dbfield parameter to filter.php. | EXPLOIT ✓MEDIUM 4.3EPSS 1.51% | 23 February 2009 |
| CVE-2009-0709 | SQL injection vulnerability in login.php in PHPFootball 1.6 allows remote attackers to execute arbitrary SQL commands via the user parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.95% | 23 February 2009 |
| CVE-2009-0707 | SQL injection vulnerability in admin/index.php in PowerClan 1.14a allows remote attackers to execute arbitrary SQL commands via the loginemail parameter (aka login field). | EXPLOIT ✓HIGH 7.5EPSS 2.05% | 23 February 2009 |
| CVE-2009-0705 | SQL injection vulnerability in news.php in PowerScripts PowerNews 2.5.4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the newsid parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 0.96% | 23 February 2009 |
| CVE-2009-0704 | SQL injection vulnerability in search.php in WSN Guest 1.23 allows remote attackers to execute arbitrary SQL commands via the search parameter in an advanced action. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 23 February 2009 |
| CVE-2009-0703 | SQL injection vulnerability in bview.asp in ASPThai.Net Webboard 6.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 23 February 2009 |
| CVE-2009-0702 | SQL injection vulnerability in the Phoca Documentation (com_phocadocumentation) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a section action to index.php. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 23 February 2009 |
| CVE-2009-0701 | Multiple PHP remote file inclusion vulnerabilities in index.php in Cybershade CMS 0.2b, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) THEME_header and (2) THEME_footer parameters. | EXPLOIT ✓MEDIUM 6.8EPSS 1.85% | 23 February 2009 |
| CVE-2009-0700 | Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and (1) read sensitive Customer or Order data via a modified Pfad parameter to pagesUTF8/Sys_DirAnzeige.jsp, or (2) list sensitive Jobs via a direct… | EXPLOIT ×2 ✓MEDIUM 4.0EPSS 2.51% | 23 February 2009 |
| CVE-2009-0699 | Cross-site scripting (XSS) vulnerability in pagesUTF8/auftrag_allgemeinauftrag.jsp in Plunet BusinessManager 4.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the (1) QUB and (2) Bez74 parameters. | EXPLOIT ✓LOW 3.5EPSS 1.26% | 23 February 2009 |
| CVE-2008-6241 | Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPSite 0.0.1 and 0.0.7, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the checkuser parameter (aka username field), or (2) the… | EXPLOIT ✓MEDIUM 6.8EPSS 0.95% | 23 February 2009 |
| CVE-2008-6237 | SQL injection vulnerability in software-description.php in Scripts For Sites (SFS) Hotscripts-like Site allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 23 February 2009 |
| CVE-2009-0680 | cgi-bin/welcome/VPN_only in the web interface in Netgear SSL312 allows remote attackers to cause a denial of service (device crash) via a crafted query string, as demonstrated using directory traversal sequences. | EXPLOIT ✓HIGH 7.8EPSS 8.41% | 22 February 2009 |
| CVE-2009-0678 | images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array parameter value that does not correspond to a valid font file, which reveals the installation path in an error message. | EXPLOIT ✓MEDIUM 5.0EPSS 2.84% | 22 February 2009 |
| CVE-2009-0677 | avatarlist.php in the Your Account module, reached through modules.php, in Raven Web Services RavenNuke 2.30 allows remote authenticated users to execute arbitrary code via PHP sequences in an element of the replacements array, which is processed by the… | EXPLOIT ✓MEDIUM 6.5EPSS 9.03% | 22 February 2009 |
| CVE-2009-0676 | The sock_getsockopt function in net/core/sock.c in the Linux kernel before 2.6.28.6 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel memory via an SO_BSDCOMPAT getsockopt… | EXPLOIT ✓LOW 2.1EPSS 0.70% | 22 February 2009 |
| CVE-2009-0674 | images/captcha.php in Raven Web Services RavenNuke 2.30, when register_globals and display_errors are enabled, allows remote attackers to determine the existence of local files by sending requests with full pathnames in the aFonts array parameter, and… | EXPLOIT ✓MEDIUM 6.0EPSS 2.28% | 22 February 2009 |
| CVE-2009-0673 | Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary PHP code via the ID Field Name box in a yaCustomFields action to… | EXPLOIT ✓MEDIUM 6.5EPSS 2.65% | 22 February 2009 |
| CVE-2009-0672 | SQL injection vulnerability in the Resend_Email module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary SQL commands via the user_prefix parameter to modules.php. | EXPLOIT ✓MEDIUM 6.5EPSS 1.26% | 22 February 2009 |
| CVE-2008-6236 | SQL injection vulnerability in login.php in Simple Document Management System (SDMS) 1.1.5 and 1.1.4, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the login parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 21 February 2009 |
| CVE-2008-3076 | The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the… | EXPLOIT ✓HIGH 9.3EPSS 9.02% | 21 February 2009 |
| CVE-2008-6234 | SQL injection vulnerability in the com_musica module in Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 21 February 2009 |
| CVE-2008-6233 | SQL injection vulnerability in index.php in Five Dollar Scripts Drinks script allows remote attackers to execute arbitrary SQL commands via the recid parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 20 February 2009 |
| CVE-2008-6232 | Pre Shopping Mall allows remote attackers to bypass authentication and gain administrative access by setting the (1) adminname and the (2) adminid cookies to "admin". | EXPLOIT ×2 ✓HIGH 7.5EPSS 2.86% | 20 February 2009 |
| CVE-2008-6231 | Pre Classified Listing PHP allows remote attackers to bypass authentication and gain administrative access by setting the (1) adminname and the (2) adminid cookies to "admin". | EXPLOIT ×2 ✓HIGH 7.5EPSS 2.91% | 20 February 2009 |
| CVE-2008-6230 | SQL injection vulnerability in Tour.php in Pre Projects Pre Podcast Portal allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 20 February 2009 |
| CVE-2008-6228 | Pre Multi-Vendor Shopping Malls allows remote attackers to bypass authentication and gain administrative access by setting the (1) adminname and the (2) adminid cookies to "admin". | EXPLOIT ✓HIGH 7.5EPSS 2.66% | 20 February 2009 |
| CVE-2008-6227 | SQL injection vulnerability in buyer_detail.php in Pre Multi-Vendor Shopping Malls allows remote attackers to execute arbitrary SQL commands via the (1) sid and (2) cid parameters. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 20 February 2009 |
| CVE-2008-6226 | SQL injection vulnerability in moreinfo.php in Pre Projects PHP Auto Listings Script, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the itemno parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 0.94% | 20 February 2009 |
| CVE-2008-6225 | SQL injection vulnerability in info.php in Mole Group Airline Ticket Sale Script allows remote attackers to execute arbitrary SQL commands via the flight parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.23% | 20 February 2009 |
| CVE-2008-6224 | Directory traversal vulnerability in visualizza.php in Way Of The Warrior (WOTW) 5.0 and earlier allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.30% | 20 February 2009 |
| CVE-2008-6223 | PHP remote file inclusion vulnerability in visualizza.php in Way Of The Warrior (WOTW) 5.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the plancia parameter to crea.php. | EXPLOIT ✓HIGH 7.5EPSS 2.45% | 20 February 2009 |
| CVE-2008-6222 | Directory traversal vulnerability in the Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 for Joomla! allows remote attackers to read arbitrary files via a .. | EXPLOIT ×2 ✓MEDIUM 5.0EPSS 11.5% | 20 February 2009 |
| CVE-2008-6221 | PHP remote file inclusion vulnerability in config.dadamail.php in the Dada Mail Manager (com_dadamail) component 2.6 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path] parameter. | EXPLOIT ✓HIGH 7.5EPSS 37.7% | 20 February 2009 |
| CVE-2008-6220 | SQL injection vulnerability in login.php in Simple Document Management System (SDMS) 1.1.5 and 1.1.4, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the pass parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.15% | 20 February 2009 |
| CVE-2009-0659 | Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 allows remote attackers to have an unknown impact via a STATS line with a long email field. | EXPLOIT ✓MEDIUM 5.0EPSS 6.63% | 20 February 2009 |
| CVE-2009-0658 | Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as… | EXPLOIT ×3 ✓HIGH 7.8EPSS 87.8% | 20 February 2009 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.