Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
398,446 CVEs1,726 in CISA KEV17,265 with EPSS ≥ 10%25,049 with a public exploitUpdated 27 September 2026
25,049 results · page 264 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2008-5562 | ASPPortal stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for xportal.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 5.16% | 15 December 2008 |
| CVE-2008-5561 | SQL injection vulnerability in Netref 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) fiche_product.php and (2) presentation.php. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 15 December 2008 |
| CVE-2008-5560 | PostEcards stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for postcards.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.70% | 15 December 2008 |
| CVE-2008-5559 | SQL injection vulnerability in sendcard.cfm in PostEcards allows remote attackers to execute arbitrary SQL commands via the cid parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.04% | 15 December 2008 |
| CVE-2008-5551 | The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks by injecting data at two different positions within an HTML document, related to STYLE elements and the CSS… | EXPLOIT ✓MEDIUM 4.3EPSS 14.0% | 12 December 2008 |
| CVE-2008-5497 | BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the login_auth cookie to true. | EXPLOIT ✓HIGH 7.5EPSS 2.81% | 12 December 2008 |
| CVE-2008-5496 | SQL injection vulnerability in showcategory.php in PozScripts Business Directory Script allows remote attackers to execute arbitrary SQL commands via the cid parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.19% | 12 December 2008 |
| CVE-2008-5494 | SQL injection vulnerability in the Contact Information Module (com_contactinfo) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 12 December 2008 |
| CVE-2008-5493 | SQL injection vulnerability in track.php in PHPStore Wholesales (aka Wholesale) allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.19% | 12 December 2008 |
| CVE-2008-5492 | Heap-based buffer overflow in the PDFVIEW.PdfviewCtrl.1 ActiveX control in pdfview.ocx 2.0.0.1 in VeryDOC PDF Viewer OCX Control allows remote attackers to execute arbitrary code via a long first argument to the OpenPDF method. | EXPLOIT ×3 ✓HIGH 9.3EPSS 35.3% | 12 December 2008 |
| CVE-2008-5491 | SQL injection vulnerability in edit.php in SlimCMS 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the pageID parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 12 December 2008 |
| CVE-2008-5490 | SQL injection vulnerability in index.php in PHPStore Yahoo Answers allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.15% | 12 December 2008 |
| CVE-2008-5489 | SQL injection vulnerability in channel_detail.php in ClipShare Pro 4, and 2006 through 2007, allows remote attackers to execute arbitrary SQL commands via the chid parameter. | EXPLOIT ×2 ✓HIGH 7.5EPSS 1.15% | 12 December 2008 |
| CVE-2008-5487 | Cross-site scripting (XSS) vulnerability in admin.php in TurnkeyForms Text Link Sales allows remote attackers to inject arbitrary web script or HTML via the id parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.57% | 12 December 2008 |
| CVE-2008-5486 | SQL injection vulnerability in admin.php in TurnkeyForms Text Link Sales allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.04% | 12 December 2008 |
| CVE-2008-5431 | Teamtek Universal FTP Server 1.0.44 allows remote attackers to cause a denial of service via (1) a certain CWD command, (2) a long LIST command, or (3) a certain PORT command. | EXPLOIT ✓MEDIUM 5.0EPSS 2.73% | 11 December 2008 |
| CVE-2008-4844 | Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer 5.01, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via DSO bindings involving (1) an XML Island, (2)… | EXPLOIT ×3 ✓HIGH 9.3EPSS 66.5% | 11 December 2008 |
| CVE-2006-7235 | Teamtek Universal FTP Server 1.0.50 allows remote attackers to cause a denial of service (daemon crash or hang) via (1) multiple STOR (aka PUT) commands, or an MKD command followed by (2) a '*' argument, (3) a '|' argument, (4) spaces, or (5) a long… | EXPLOIT ×2 ✓MEDIUM 5.0EPSS 2.99% | 11 December 2008 |
| CVE-2008-5418 | Directory traversal vulnerability in login.php in the PunPortal module before 2.0 for PunBB allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 5.1EPSS 1.91% | 10 December 2008 |
| CVE-2008-5416 | Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and… | EXPLOIT ×3 ✓HIGH 9.0EPSS 87.0% | 10 December 2008 |
| CVE-2008-4841 | The WordPad Text Converter for Word 97 files in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted (1) .doc, (2) .wri, or (3) .rtf Word 97 file that triggers memory corruption,… | EXPLOIT ✓HIGH 9.3EPSS 43.0% | 10 December 2008 |
| CVE-2008-4255 | Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, and Office Project… | EXPLOIT ✓HIGH 9.3EPSS 53.7% | 10 December 2008 |
| CVE-2008-5409 | Unspecified vulnerability in the pdf.xmd module in (1) BitDefender Free Edition 10 and Antivirus Standard 10, (2) BullGuard Internet Security 8.5, and (3) Software602 Groupware Server 6.0.08.1118 allows remote attackers to cause a denial of service… | EXPLOIT ✓HIGH 9.3EPSS 11.1% | 10 December 2008 |
| CVE-2008-5406 | Stack-based buffer overflow in Apple QuickTime Player 7.5.5 and iTunes 8.0.2.20 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a MOV file with "long arguments," related to an "off by one… | EXPLOIT ✓HIGH 9.3EPSS 9.73% | 10 December 2008 |
| CVE-2008-5405 | Stack-based buffer overflow in the RDP protocol password decoder in Cain & Abel 4.9.23 and 4.9.24, and possibly earlier, allows remote attackers to execute arbitrary code via an RDP file containing a long string. | EXPLOIT ×4 ✓HIGH 9.3EPSS 47.0% | 10 December 2008 |
| CVE-2008-5305 | Eval injection vulnerability in TWiki before 4.2.4 allows remote attackers to execute arbitrary Perl code via the %SEARCH{}% variable. | EXPLOIT ✓HIGH 10.0EPSS 4.64% | 10 December 2008 |
| CVE-2008-5304 | Cross-site scripting (XSS) vulnerability in TWiki before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via the %URLPARAM{}% variable. | EXPLOIT ✓MEDIUM 4.3EPSS 2.24% | 10 December 2008 |
| CVE-2008-5394 | /bin/login in shadow 4.0.18.1 in Debian GNU/Linux, and probably other Linux distributions, allows local users in the utmp group to overwrite arbitrary files via a symlink attack on a temporary file referenced in a line (aka ut_line) field in a utmp entry. | EXPLOIT ✓HIGH 7.2EPSS 0.95% | 9 December 2008 |
| CVE-2008-5383 | Stack-based buffer overflow in National Instruments Electronics Workbench allows user-assisted attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted .ewb file. | EXPLOIT ✓HIGH 9.3EPSS 4.71% | 9 December 2008 |
| CVE-2008-5079 | net/atm/svc.c in the ATM subsystem in the Linux kernel 2.6.27.8 and earlier allows local users to cause a denial of service (kernel infinite loop) by making two calls to svc_listen for the same socket, and then reading a /proc/net/atm/*vc file, related… | EXPLOIT ✓MEDIUM 4.9EPSS 1.09% | 9 December 2008 |
| CVE-2008-4310 | httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request. | EXPLOIT ✓HIGH 7.8EPSS 13.6% | 9 December 2008 |
| CVE-2008-5377 | pstopdf in CUPS 1.3.8 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pstopdf.log temporary file, a different vulnerability than CVE-2001-1333. | EXPLOIT ✓MEDIUM 6.9EPSS 0.66% | 8 December 2008 |
| CVE-2008-5365 | SQL injection vulnerability in VoteHistory.asp in ActiveWebSoftwares ActiveVotes 2.2 allows remote attackers to execute arbitrary SQL commands via the AccountID parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.20% | 8 December 2008 |
| CVE-2008-5353 | The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote… | EXPLOIT ×4 ✓HIGH 10.0EPSS 85.8% | 5 December 2008 |
| CVE-2008-5338 | Cross-site scripting (XSS) vulnerability in info.php in Bandwebsite (aka Bandsite portal system) 1.5 allows remote attackers to inject arbitrary web script or HTML via the section parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.49% | 5 December 2008 |
| CVE-2008-5337 | SQL injection vulnerability in lyrics.php in Bandwebsite (aka Bandsite portal system) 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 5 December 2008 |
| CVE-2008-5336 | SQL injection vulnerability in index.php in WebStudio CMS allows remote attackers to execute arbitrary SQL commands via the pageid parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.38% | 5 December 2008 |
| CVE-2008-5335 | SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the subject and msg_send parameters, a different vector than CVE-2005-3157,… | EXPLOIT ✓MEDIUM 6.8EPSS 2.88% | 5 December 2008 |
| CVE-2008-5334 | PHP remote file inclusion vulnerability in includes/common.php in NitroTech 0.0.3a allows remote attackers to execute arbitrary PHP code via a URL in the root parameter. | EXPLOIT ✓HIGH 10.0EPSS 8.63% | 5 December 2008 |
| CVE-2008-5333 | SQL injection vulnerability in members.php in NitroTech 0.0.3a allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 5 December 2008 |
| CVE-2008-5332 | Multiple PHP remote file inclusion vulnerabilities in Pie 0.5.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) lib parameter to files in lib/action/ including (a) alias.php, (b) cancel.php, (c) context.php, (d) deadlinks.php,… | EXPLOIT ✓HIGH 10.0EPSS 3.79% | 5 December 2008 |
| CVE-2008-5330 | Multiple cross-site scripting (XSS) vulnerabilities in the web interface in ClearCase RWP server in IBM Rational ClearCase 7.0.0 before 7.0.0.4, and 7.0.1.1-RATL-RCC-IFIX02 and possibly other 7.0.1 versions before 7.0.1.3, allow remote attackers to… | EXPLOIT ✓MEDIUM 4.3EPSS 1.73% | 5 December 2008 |
| CVE-2008-5323 | Cross-site scripting (XSS) vulnerability in index.php in Wysi Wiki Wyg 1.0 allows remote attackers to inject arbitrary web script or HTML via the s parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.50% | 3 December 2008 |
| CVE-2008-5322 | Wysi Wiki Wyg 1.0 allows remote attackers to obtain system information via an invalid categup parameter to index.php, which calls the phpinfo function. | EXPLOIT ✓HIGH 7.8EPSS 2.51% | 3 December 2008 |
| CVE-2008-5321 | SQL injection vulnerability in index.php in GesGaleri, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the no parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 3 December 2008 |
| CVE-2008-5320 | SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute arbitrary SQL commands via the ue[] parameter. | EXPLOIT ✓MEDIUM 6.5EPSS 1.94% | 3 December 2008 |
| CVE-2008-5314 | Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted JPEG file, related to the cli_check_jpeg_exploit, jpeg_check_photoshop, and… | EXPLOIT ✓MEDIUM 4.3EPSS 8.20% | 3 December 2008 |
| CVE-2008-3058 | Multiple SQL injection vulnerabilities in Octeth Oempro 3.5.5.1, and possibly other versions before 4, allow remote attackers to execute arbitrary SQL commands via the FormValue_Email parameter (aka Email field) to index.php in (1) member/, (2) client/,… | EXPLOIT ✓HIGH 7.5EPSS 2.26% | 3 December 2008 |
| CVE-2008-5311 | SQL injection vulnerability in image.php in NetArt Media Blog System 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.04% | 2 December 2008 |
| CVE-2008-5310 | SQL injection vulnerability in image.php in NetArt Media Car Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.25% | 2 December 2008 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.