Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
398,446 CVEs1,726 in CISA KEV17,265 with EPSS ≥ 10%25,049 with a public exploitUpdated 27 September 2026
25,049 results · page 263 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2008-5629 | SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitrary SQL commands via the id parameter in a play action. | EXPLOIT ×2 ✓HIGH 7.5EPSS 0.98% | 17 December 2008 |
| CVE-2008-5628 | SQL injection vulnerability in index.php in CMS little 0.0.1 allows remote attackers to execute arbitrary SQL commands via the term parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 0.91% | 17 December 2008 |
| CVE-2008-5627 | SQL injection vulnerability in account.asp in Active Trade 2 allows remote attackers to execute arbitrary SQL commands via the (1) username parameter (aka Email field) or the (2) password parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 17 December 2008 |
| CVE-2008-5626 | XM Easy Personal FTP Server 5.6.0 allows remote authenticated users to cause a denial of service via a crafted argument to the NLST command, as demonstrated by a -1 argument. | EXPLOIT ×2 ✓MEDIUM 4.0EPSS 35.9% | 17 December 2008 |
| CVE-2008-5625 | PHP 5 before 5.2.7 does not enforce the error_log safe_mode restrictions when safe_mode is enabled through a php_admin_flag setting in httpd.conf, which allows context-dependent attackers to write to arbitrary files by placing a "php_value error_log"… | EXPLOIT ✓HIGH 7.5EPSS 7.31% | 17 December 2008 |
| CVE-2008-5621 | Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tbl_structure.php with a modified table… | EXPLOIT ✓MEDIUM 6.0EPSS 2.15% | 17 December 2008 |
| CVE-2008-5619 | html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that… | EXPLOIT ×2 ✓HIGH 10.0EPSS 58.6% | 17 December 2008 |
| CVE-2008-5081 | The originates_from_local_legacy_unicast_socket function (avahi-core/server.c) in avahi-daemon in Avahi before 0.6.24 allows remote attackers to cause a denial of service (crash) via a crafted mDNS packet with a source port of 0, which triggers an… | EXPLOIT ✓MEDIUM 5.0EPSS 59.2% | 17 December 2008 |
| CVE-2008-5608 | ASP AutoDealer stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for auto.mdb. | EXPLOIT ×2 ✓MEDIUM 5.0EPSS 2.85% | 16 December 2008 |
| CVE-2008-5607 | SQL injection vulnerability in the JMovies (aka JM or com_jmovies) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 16 December 2008 |
| CVE-2008-5606 | Gazatem QMail Mailing List Manager 1.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for qmail.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.61% | 16 December 2008 |
| CVE-2008-5605 | Multiple SQL injection vulnerabilities in ASP Portal allow remote attackers to execute arbitrary SQL commands via the (1) ItemID parameter to classifieds.asp and the (2) ID parameter to Events.asp. | EXPLOIT ✓HIGH 7.5EPSS 2.08% | 16 December 2008 |
| CVE-2008-5604 | Directory traversal vulnerability in index.php in My Simple Forum 3.0 and 4.1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 2.38% | 16 December 2008 |
| CVE-2008-5603 | ASPTicker 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for news.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.61% | 16 December 2008 |
| CVE-2008-5602 | Natterchat 1.12 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for natterchat112.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.59% | 16 December 2008 |
| CVE-2008-5601 | User Engine Lite ASP stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for users.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.61% | 16 December 2008 |
| CVE-2008-5600 | Merlix Teamworx Server stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for teamworx.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.61% | 16 December 2008 |
| CVE-2008-5599 | SQL injection vulnerability in default.asp in Merlix Teamworx Server allows remote attackers to execute arbitrary SQL commands via the password parameter (aka passwd field) in a login action. | EXPLOIT ✓HIGH 7.5EPSS 1.04% | 16 December 2008 |
| CVE-2008-5598 | Directory traversal vulnerability in index.php in PHPmyGallery 1.51 gold allows remote attackers to list arbitrary directories via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 2.91% | 16 December 2008 |
| CVE-2008-5597 | Cold BBS stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for db/cforum.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.59% | 16 December 2008 |
| CVE-2008-5596 | Ikon AdManager 2.1 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for ikonBAnner_AdManager.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.59% | 16 December 2008 |
| CVE-2008-5595 | SQL injection vulnerability in detail.asp in ASP AutoDealer allows remote attackers to execute arbitrary SQL commands via the ID parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.15% | 16 December 2008 |
| CVE-2008-5594 | Multiple directory traversal vulnerabilities in index.php in Mini Blog 1.0.1 allow remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.50% | 16 December 2008 |
| CVE-2008-5593 | Multiple directory traversal vulnerabilities in index.php in Mini CMS 1.0.1 allow remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.43% | 16 December 2008 |
| CVE-2008-5592 | Nightfall Personal Diary 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for users-zza21.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.61% | 16 December 2008 |
| CVE-2008-5591 | Cross-site scripting (XSS) vulnerability in login.asp in Nightfall Personal Diary 1.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter and possibly other "login fields." NOTE: some of these details are obtained… | EXPLOIT ✓MEDIUM 4.3EPSS 1.57% | 16 December 2008 |
| CVE-2008-5590 | SQL injection vulnerability in customer.forumtopic.php in Kalptaru Infotech Product Sale Framework 0.1 beta allows remote attackers to execute arbitrary SQL commands via the forum_topic_id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 16 December 2008 |
| CVE-2008-5589 | SQL injection vulnerability in processlogin.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the (1) txtusername parameter (aka username field) or the (2) txtpassword parameter (aka password field). | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 16 December 2008 |
| CVE-2008-5588 | SQL injection vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the siteID parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 16 December 2008 |
| CVE-2008-5587 | Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 4.3EPSS 12.9% | 16 December 2008 |
| CVE-2008-5586 | SQL injection vulnerability in findoffice.php in Check Up New Generation (aka Check New) 4.52, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the search parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 0.95% | 16 December 2008 |
| CVE-2008-5585 | Multiple PHP remote file inclusion vulnerabilities in lcxBBportal 0.1 Alpha 2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) portal/includes/portal_block.php and (2) includes/acp/acp_lcxbbportal.php. | EXPLOIT ✓HIGH 7.5EPSS 2.47% | 16 December 2008 |
| CVE-2008-5584 | Multiple cross-site scripting (XSS) vulnerabilities in ProjectPier 0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) a message, (2) a milestone, or (3) a display name in a profile, or the (4) a or (5) c parameter to… | EXPLOIT ✓MEDIUM 4.3EPSS 2.99% | 15 December 2008 |
| CVE-2008-5582 | SQL injection vulnerability in utilities/login.asp in Nukedit 4.9.x, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the email parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 15 December 2008 |
| CVE-2008-5581 | PHP remote file inclusion vulnerability in mini-pub.php/front-end/img.php in mini-pub 0.3 allows remote attackers to execute arbitrary PHP code via a URL in the sFileName parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.48% | 15 December 2008 |
| CVE-2008-5580 | mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the sFileName argument. | EXPLOIT ✓HIGH 7.5EPSS 3.35% | 15 December 2008 |
| CVE-2008-5579 | Absolute path traversal vulnerability in mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to read arbitrary files via a full pathname in the sFileName parameter. | EXPLOIT ✓MEDIUM 5.0EPSS 2.66% | 15 December 2008 |
| CVE-2008-5578 | Multiple SQL injection vulnerabilities in index.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allow remote attackers to execute arbitrary SQL commands via (1) the f parameter in a showforum action, (2) the u parameter in a profile action, (3) the viewcat… | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 15 December 2008 |
| CVE-2008-5577 | PHP remote file inclusion vulnerability in index.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allows remote attackers to execute arbitrary PHP code via a URL in the inc_function parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.43% | 15 December 2008 |
| CVE-2008-5576 | admin/forums.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allows remote attackers to bypass authentication and gain administrative access via a large value of the current_user[users_level] parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.77% | 15 December 2008 |
| CVE-2008-5574 | SQL injection vulnerability in member.php in Webmaster Marketplace allows remote attackers to execute arbitrary SQL commands via the u parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.35% | 15 December 2008 |
| CVE-2008-5573 | SQL injection vulnerability in the login feature in Poll Pro 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) Password and (2) username parameters. | EXPLOIT ✓HIGH 7.5EPSS 1.20% | 15 December 2008 |
| CVE-2008-5572 | Professional Download Assistant 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for database/downloads.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 7.39% | 15 December 2008 |
| CVE-2008-5571 | SQL injection vulnerability in admin/login.asp in Professional Download Assistant 0.1 allows remote attackers to execute arbitrary SQL commands via the (1) uname parameter (aka user field) or the (2) psw parameter (aka passwd field). | EXPLOIT ×2 ✓HIGH 7.5EPSS 2.37% | 15 December 2008 |
| CVE-2008-5570 | Directory traversal vulnerability in index.php in PHP Multiple Newsletters 2.7, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 2.38% | 15 December 2008 |
| CVE-2008-5569 | Multiple cross-site scripting (XSS) vulnerabilities in PHPepperShop 1.4 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php or (2) shop/kontakt.php, or (3) shop_kunden_mgmt.php or (4) SHOP_KONFIGURATION.php… | EXPLOIT ×4 ✓MEDIUM 4.3EPSS 2.21% | 15 December 2008 |
| CVE-2008-5568 | Cross-site request forgery (CSRF) vulnerability in admin/settings.php in IPN Pro 3 1.44 and earlier allows remote attackers to change the admin password via a logout action in conjunction with the admin_id, newpass_1, and newpass_2 parameters. | EXPLOIT ✓MEDIUM 6.8EPSS 0.98% | 15 December 2008 |
| CVE-2008-5567 | Cross-site request forgery (CSRF) vulnerability in admin/ad_settings.php in Bonza Cart 1.10 and earlier allows remote attackers to change the admin password via a logout action in conjunction with the NewAdmin, NewPass1, and NewPass2 parameters. | EXPLOIT ✓MEDIUM 6.8EPSS 0.99% | 15 December 2008 |
| CVE-2008-5566 | Cross-site scripting (XSS) vulnerability in index.php in Triangle Solutions PHP Multiple Newsletters 2.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. | EXPLOIT ✓MEDIUM 4.3EPSS 3.36% | 15 December 2008 |
| CVE-2008-5565 | Cross-site request forgery (CSRF) vulnerability in admin/settings.php in DL PayCart 1.34 and earlier allows remote attackers to change the admin password via a logout action in conjunction with the NewAdmin, NewPass1, and NewPass2 parameters. | EXPLOIT ✓MEDIUM 6.8EPSS 0.99% | 15 December 2008 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.