Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
398,149 CVEs1,726 in CISA KEV17,253 with EPSS ≥ 10%25,049 with a public exploitUpdated 25 September 2026
25,049 results · page 256 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2009-0377 | SQL injection vulnerability in the beamospetition (com_beamospetition) 1.0.12 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mpid parameter in a sign action to index.php, a different vector than CVE-2008-3132. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 2 February 2009 |
| CVE-2009-0374 | Google Chrome 1.0.154.43 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted element to the current mouse position, related to a "Clickjacking" vulnerability. | EXPLOIT ✓MEDIUM 4.3EPSS 2.40% | 30 January 2009 |
| CVE-2009-0373 | SQL injection vulnerability in the ElearningForce Flash Magazine Deluxe (com_flashmagazinedeluxe) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mag_id parameter in a magazine action to index.php. | EXPLOIT ✓HIGH 7.5EPSS 1.02% | 30 January 2009 |
| CVE-2009-0372 | Unrestricted file upload vulnerability in index.php in Miltenovik Manojlo MemHT Portal 4.0.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and an image content type via a users… | EXPLOIT ✓MEDIUM 6.5EPSS 3.47% | 30 January 2009 |
| CVE-2009-0371 | Directory traversal vulnerability in post.php in SiteXS CMS 0.1.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 1.88% | 30 January 2009 |
| CVE-2009-0369 | Microsoft Internet Explorer 7 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted element to the current mouse position, related to a "Clickjacking" vulnerability. | EXPLOIT ✓MEDIUM 4.3EPSS 10.6% | 30 January 2009 |
| CVE-2008-6016 | SQL injection vulnerability in questions.php in EsFaq 2.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter, a different vector than CVE-2008-3952. | EXPLOIT ✓HIGH 7.5EPSS 0.91% | 30 January 2009 |
| CVE-2008-6014 | SQL injection vulnerability in scripts/links.php in Rianxosencabos CMS 0.9 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 30 January 2009 |
| CVE-2008-6012 | Directory traversal vulnerability in index.php in Pritlog 0.4 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 4.3EPSS 2.27% | 30 January 2009 |
| CVE-2008-6011 | SQL injection vulnerability in index.php in SG Real Estate Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the page_id parameter. | EXPLOIT ×2 ✓HIGH 7.5EPSS 0.97% | 30 January 2009 |
| CVE-2008-6010 | Multiple directory traversal vulnerabilities in SG Real Estate Portal 2.0 allow remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 2.67% | 30 January 2009 |
| CVE-2008-6009 | SG Real Estate Portal 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the Auth cookie to 1. | EXPLOIT ✓HIGH 7.5EPSS 2.56% | 30 January 2009 |
| CVE-2008-6007 | SQL injection vulnerability in view_group.php in QuidaScript BookMarks Favourites Script (APB) allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 30 January 2009 |
| CVE-2008-6006 | Multiple PHP remote file inclusion vulnerabilities in Micronation Banking System (minba) 1.5.0 allow remote attackers to execute arbitrary PHP code via a URL in the minsoft_path parameter to (1) utdb_access.php and (2) utgn_message.php in utility/. | EXPLOIT ✓HIGH 7.5EPSS 2.29% | 30 January 2009 |
| CVE-2009-0351 | Stack-based buffer overflow in WFTPSRV.exe in WinFTP 2.3.0 allows remote authenticated users to execute arbitrary code via a long LIST argument beginning with an * (asterisk) character. | EXPLOIT ✓HIGH 9.0EPSS 5.27% | 29 January 2009 |
| CVE-2009-0350 | Stack-based buffer overflow in Merak Media Player 3.2 allows remote attackers to execute arbitrary code via a long string in a .m3u playlist file, related to the status bar icon's tooltip. | EXPLOIT ×2 ✓HIGH 9.3EPSS 10.2% | 29 January 2009 |
| CVE-2009-0349 | Stack-based buffer overflow in FTPShell Server 4.3 allows user-assisted remote attackers to cause a denial of service (persistent daemon crash) and possibly execute arbitrary code via a long string in a licensing key (aka .key) file. | EXPLOIT ✓HIGH 9.3EPSS 5.86% | 29 January 2009 |
| CVE-2009-0348 | The login module in Sun Java System Access Manager 6 2005Q1 (aka 6.3), 7 2005Q4 (aka 7.0), and 7.1 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. | EXPLOIT ✓MEDIUM 5.0EPSS 8.16% | 29 January 2009 |
| CVE-2009-0347 | Open redirect vulnerability in cs.html in the Autonomy (formerly Verity) Ultraseek search engine allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter. | EXPLOIT ✓MEDIUM 5.8EPSS 10.9% | 29 January 2009 |
| CVE-2009-0343 | Niels Provos Systrace 1.6f and earlier on the x86_64 Linux platform allows local users to bypass intended access restrictions by making a 32-bit syscall with a syscall number that corresponds to a policy-compliant 64-bit syscall, related to race… | EXPLOIT ✓HIGH 7.2EPSS 0.82% | 29 January 2009 |
| CVE-2009-0341 | The shell32 module in Microsoft Internet Explorer 7.0 on Windows XP SP3 might allow remote attackers to execute arbitrary code via a long VALUE attribute in an INPUT element, possibly related to a stack consumption vulnerability. | EXPLOIT ✓HIGH 9.3EPSS 16.0% | 29 January 2009 |
| CVE-2009-0340 | Multiple directory traversal vulnerabilities in Simple PHP Newsletter 1.5 allow remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 1.88% | 29 January 2009 |
| CVE-2009-0339 | SQL injection vulnerability in inc_webblogmanager.asp in DMXReady Blog Manager allows remote attackers to execute arbitrary SQL commands via the itemID parameter in a view action. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 29 January 2009 |
| CVE-2009-0338 | Cross-site scripting (XSS) vulnerability in inc_webblogmanager.asp in DMXReady Blog Manager allows remote attackers to inject arbitrary web script or HTML via the CategoryID parameter in a refer action. | EXPLOIT ✓MEDIUM 4.3EPSS 1.51% | 29 January 2009 |
| CVE-2009-0337 | SQL injection vulnerability in index.asp in Katy Whitton BlogIt! allows remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parameters. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 29 January 2009 |
| CVE-2009-0336 | Katy Whitton BlogIt! stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request for database/Blog.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.29% | 29 January 2009 |
| CVE-2009-0335 | Cross-site scripting (XSS) vulnerability in index.asp in Katy Whitton BlogIt! allows remote attackers to inject arbitrary web script or HTML via the view parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.45% | 29 January 2009 |
| CVE-2009-0334 | SQL injection vulnerability in index.asp in Katy Whitton BlogIt! allows remote attackers to execute arbitrary SQL commands via the day parameter in an archive action. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 29 January 2009 |
| CVE-2009-0333 | SQL injection vulnerability in the WebAmoeba (WA) Ticket System (com_waticketsystem) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a category action to index.php. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 29 January 2009 |
| CVE-2009-0331 | Directory traversal vulnerability in gallery/comment.php in Enhanced Simple PHP Gallery (ESPG) 1.72 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓HIGH 7.8EPSS 2.80% | 29 January 2009 |
| CVE-2009-0330 | Directory traversal vulnerability in index.php in Simple Content Management System (SCMS) 1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 1.90% | 29 January 2009 |
| CVE-2009-0329 | SQL injection vulnerability in the PcCookBook (com_pccookbook) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the recipe_id parameter in a viewrecipe action to index.php, a different vector than CVE-2008-0844. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 29 January 2009 |
| CVE-2009-0328 | ROBS-PROJECTS Digital Sales IPN (aka DS-IPN.NET or DS-IPN Paypal Shop) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct… | EXPLOIT ✓MEDIUM 5.0EPSS 7.29% | 29 January 2009 |
| CVE-2009-0327 | SQL injection vulnerability in readbible.php in Free Bible Search PHP Script 1.0 allows remote attackers to execute arbitrary SQL commands via the version parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.17% | 29 January 2009 |
| CVE-2009-0326 | SQL injection vulnerability in login.php in Dark Age CMS 0.2c beta allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters. | EXPLOIT ×2 ✓HIGH 7.5EPSS 0.92% | 29 January 2009 |
| CVE-2009-0325 | Directory traversal vulnerability in entries/index.php in Ninja Blog 4.8, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 4.3EPSS 2.56% | 29 January 2009 |
| CVE-2009-0324 | Multiple SQL injection vulnerabilities in BibCiter 1.4 allow remote attackers to execute arbitrary SQL commands via the (1) idp parameter to reports/projects.php, the (2) idc parameter to reports/contacts.php, and the (3) idu parameter to… | EXPLOIT ✓HIGH 7.5EPSS 1.17% | 29 January 2009 |
| CVE-2009-0323 | Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0 and 11.0 allow remote attackers to execute arbitrary code via (1) a long type parameter in an input tag, which is not properly handled by the EndOfXmlAttributeValue function; (2) an… | EXPLOIT ×2 ✓HIGH 10.0EPSS 62.5% | 28 January 2009 |
| CVE-2009-0321 | Apple Safari 3.2.1 (aka AppVer 3.525.27.1) on Windows allows remote attackers to cause a denial of service (infinite loop or access violation) via a link to an http URI in which the authority (aka hostname) portion is either a (1) . | EXPLOIT ✓MEDIUM 4.3EPSS 2.36% | 28 January 2009 |
| CVE-2008-6004 | Cross-site scripting (XSS) vulnerability in search.php in AJ Auction Pro Platinum 2 allows remote attackers to inject arbitrary web script or HTML via the product parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.22% | 28 January 2009 |
| CVE-2008-6003 | SQL injection vulnerability in sellers_othersitem.php in AJ Auction Pro Platinum 2 allows remote attackers to execute arbitrary SQL commands via the seller_id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.93% | 28 January 2009 |
| CVE-2008-6002 | Absolute path traversal vulnerability in sendfile.php in web-cp 0.5.7, when register_globals is enabled, allows remote attackers to read arbitrary files via a full pathname in the filelocation parameter. | EXPLOIT ✓HIGH 7.1EPSS 2.19% | 28 January 2009 |
| CVE-2008-6001 | index.php in ADN Forum 1.0b and earlier allows remote attackers to bypass authentication and gain sysop access via a fpusuario cookie composed of an initial sysop: string, an arbitrary password field, and a final :sysop:0 string. | EXPLOIT ✓HIGH 7.5EPSS 2.45% | 28 January 2009 |
| CVE-2008-5998 | Multiple SQL injection vulnerabilities in the ajax_checklist_save function in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allow remote authenticated users, with "update ajax checklists" permissions, to execute arbitrary SQL commands via a… | EXPLOIT ✓MEDIUM 6.0EPSS 0.98% | 28 January 2009 |
| CVE-2008-5997 | Absolute path traversal vulnerability in admin/fileKontrola/browser.asp in Omnicom Content Platform (OCP) 2.0 allows remote attackers to list arbitrary directories via a full pathname in the root parameter. | EXPLOIT ✓HIGH 7.8EPSS 2.58% | 28 January 2009 |
| CVE-2008-5993 | Directory traversal vulnerability in image.php in Barcode Generator 1D (barcodegen) 2.0.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.40% | 28 January 2009 |
| CVE-2008-5992 | Multiple SQL injection vulnerabilities in Jetik Emlak Sistem A (ESA) 2.0 allow remote attackers to execute arbitrary SQL commands via the KayitNo parameter to (1) diger.php and (2) sayfalar.php. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 28 January 2009 |
| CVE-2008-5991 | Directory traversal vulnerability in docs.php in MailWatch for MailScanner 1.0.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 5.94% | 28 January 2009 |
| CVE-2008-5990 | Directory traversal vulnerability in connect/init.inc in emergecolab 1.0 allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 1.85% | 28 January 2009 |
| CVE-2008-5989 | Directory traversal vulnerability in defs.php in PHPcounter 1.3.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 2.05% | 28 January 2009 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.