Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
398,446 CVEs1,726 in CISA KEV17,265 with EPSS ≥ 10%25,049 with a public exploitUpdated 27 September 2026
25,049 results · page 267 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2008-5071 | Multiple eval injection vulnerabilities in itpm_estimate.php in Yoxel 1.23beta and earlier allow remote authenticated users to execute arbitrary PHP code via the proj_id parameter. | EXPLOIT ✓HIGH 9.0EPSS 6.40% | 14 November 2008 |
| CVE-2008-5070 | SQL injection vulnerability in Pro Chat Rooms 3.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the gud parameter to (1) profiles/index.php and (2) profiles/admin.php. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 14 November 2008 |
| CVE-2008-5069 | SQL injection vulnerability in go.php in Panuwat PromoteWeb MySQL, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 14 November 2008 |
| CVE-2008-5068 | Multiple cross-site scripting (XSS) vulnerabilities in Kmita Gallery allow remote attackers to inject arbitrary web script or HTML via the (1) begin parameter to index.php and the (2) searchtext parameter to search.php. | EXPLOIT ✓MEDIUM 4.3EPSS 1.46% | 13 November 2008 |
| CVE-2008-5067 | Cross-site scripting (XSS) vulnerability in search.php in Kmita Catalogue 2.x allows remote attackers to inject arbitrary web script or HTML via the q parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.45% | 13 November 2008 |
| CVE-2008-5066 | PHP remote file inclusion vulnerability in upload/admin/frontpage_right.php in Agares Media ThemeSiteScript 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter. | EXPLOIT ✓HIGH 10.0EPSS 3.55% | 13 November 2008 |
| CVE-2008-5065 | TlGuestBook 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlGuestBook_login cookie to admin. | EXPLOIT ✓HIGH 7.5EPSS 2.56% | 13 November 2008 |
| CVE-2008-5064 | SQL injection vulnerability in liga.php in H&H WebSoccer 2.80 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 13 November 2008 |
| CVE-2008-5063 | PHP remote file inclusion vulnerability in Admin/ADM_Pagina.php in OTManager 2.4 allows remote attackers to execute arbitrary PHP code via a URL in the Tipo parameter. | EXPLOIT ✓HIGH 10.0EPSS 4.53% | 13 November 2008 |
| CVE-2008-5062 | Directory traversal vulnerability in php/cal_pdf.php in Mini Web Calendar (mwcal) 1.2 allows remote attackers to read arbitrary files via directory traversal sequences in the thefile parameter. | EXPLOIT ✓MEDIUM 5.0EPSS 8.06% | 13 November 2008 |
| CVE-2008-5061 | Cross-site scripting (XSS) vulnerability in php/cal_default.php in Mini Web Calendar (mwcal) 1.2 allows remote attackers to inject arbitrary web script or HTML via the URL. | EXPLOIT ✓MEDIUM 4.3EPSS 3.48% | 13 November 2008 |
| CVE-2008-5060 | Multiple PHP remote file inclusion vulnerabilities in ModernBill 4.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to (1) export_batch.inc.php, (2) run_auto_suspend.cron.php, and (3) send_email_cache.php… | EXPLOIT ✓HIGH 10.0EPSS 3.79% | 13 November 2008 |
| CVE-2008-5059 | Cross-site scripting (XSS) vulnerability in index.php in ModernBill 4.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a Javascript event in the new_language parameter in a login action. | EXPLOIT ✓MEDIUM 4.3EPSS 1.52% | 13 November 2008 |
| CVE-2008-5058 | SQL injection vulnerability in siteadmin/loginsucess.php in Pre Simple CMS allows remote attackers to execute arbitrary SQL commands via the user parameter, as reachable from siteadmin/adminlogin.php. | EXPLOIT ✓HIGH 7.5EPSS 2.42% | 13 November 2008 |
| CVE-2008-5057 | SQL injection vulnerability in film.asp in Yigit Aybuga Dizi Portali allows remote attackers to execute arbitrary SQL commands via the film parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 13 November 2008 |
| CVE-2008-5054 | Multiple SQL injection vulnerabilities in Develop It Easy Membership System 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) password parameters to customer_login.php and the (3) user_name and (4) user_pass… | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 13 November 2008 |
| CVE-2008-5053 | PHP remote file inclusion vulnerability in admin.rssreader.php in the Simple RSS Reader (com_rssreader) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter. | EXPLOIT ✓HIGH 10.0EPSS 64.1% | 13 November 2008 |
| CVE-2008-5051 | SQL injection vulnerability in the JooBlog (com_jb2) component 0.1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the PostID parameter to index.php. | EXPLOIT ×2 ✓HIGH 7.5EPSS 1.01% | 13 November 2008 |
| CVE-2008-5049 | Buffer overflow in AKEProtect.sys 3.3.3.0 in ISecSoft Anti-Keylogger Elite 3.3.0 and earlier, and possibly other versions including 3.3.3, allows local users to gain privileges via long inputs to the (1) 0x002224A4, (2) 0x002224C0, and (3) 0x002224CC… | EXPLOIT ✓HIGH 7.2EPSS 0.93% | 13 November 2008 |
| CVE-2008-5048 | Buffer overflow in Atepmon.sys in ISecSoft Anti-Trojan Elite 4.2.1 and earlier, and possibly 4.2.2, allows local users to cause a denial of service (crash) and possibly execute arbitrary code via long inputs to the 0x00222494 IOCTL. | EXPLOIT ✓HIGH 7.2EPSS 0.84% | 13 November 2008 |
| CVE-2008-5047 | SQL injection vulnerability in admin/index.php in Mole Group Rental Script allows remote attackers to execute arbitrary SQL commands via the username parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.04% | 13 November 2008 |
| CVE-2008-5046 | SQL injection vulnerability in index.php in Mole Group Pizza Script allows remote attackers to execute arbitrary SQL commands via the manufacturers_id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.04% | 13 November 2008 |
| CVE-2008-5045 | Heap-based buffer overflow in Network-Client FTP Now 2.6, and possibly other versions, allows remote FTP servers to cause a denial of service (crash) via a 200 server response that is exactly 1024 characters long. | EXPLOIT ✓HIGH 10.0EPSS 3.35% | 13 November 2008 |
| CVE-2008-5044 | Race condition in Microsoft Windows Server 2003 and Vista allows local users to cause a denial of service (crash or hang) via a multi-threaded application that makes many calls to UnhookWindowsHookEx while certain other desktop activity is occurring. | EXPLOIT ✓MEDIUM 4.0EPSS 1.68% | 12 November 2008 |
| CVE-2008-4037 | Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, as… | EXPLOIT ×3 ✓HIGH 9.3EPSS 59.1% | 12 November 2008 |
| CVE-2008-4033 | Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the… | EXPLOIT ✓MEDIUM 4.3EPSS 27.7% | 12 November 2008 |
| CVE-2008-4029 | Cross-domain vulnerability in Microsoft XML Core Services 3.0 and 4.0, as used in Internet Explorer, allows remote attackers to obtain sensitive information from another domain via a crafted XML document, related to improper error checks for external… | EXPLOIT ✓MEDIUM 4.3EPSS 26.7% | 12 November 2008 |
| CVE-2008-5042 | Zeeways PhotoVideoTube 1.1 and earlier allows remote attackers to bypass authentication and perform administrative tasks via a direct request to admin/home.php. | EXPLOIT ✓HIGH 7.5EPSS 3.26% | 12 November 2008 |
| CVE-2008-5040 | Graphiks MyForum 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the (1) myforum_login and (2) myforum_pass cookies to 1. | EXPLOIT ✓HIGH 7.5EPSS 2.56% | 12 November 2008 |
| CVE-2008-5039 | Cross-site scripting (XSS) vulnerability in the League module for PHP-Nuke, possibly 2.4, allows remote attackers to inject arbitrary web script or HTML via the tid parameter in a team action to modules.php. | EXPLOIT ✓MEDIUM 4.3EPSS 1.46% | 12 November 2008 |
| CVE-2008-5037 | SQL injection vulnerability in view.php in ElkaGroup Image Gallery 1.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 12 November 2008 |
| CVE-2008-5036 | Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file, related to the ParseRealText function in modules/demux/subtitle.c. | EXPLOIT ×2 ✓HIGH 9.3EPSS 41.4% | 10 November 2008 |
| CVE-2008-5032 | Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the header of an invalid CUE image file, related to modules/access/vcd/cdrom.c. | EXPLOIT ✓HIGH 9.3EPSS 10.7% | 10 November 2008 |
| CVE-2008-5010 | in.dhcpd in the DHCP implementation in Sun Solaris 8 through 10, and OpenSolaris before snv_103, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unknown DHCP requests related to the "number of offers," aka… | EXPLOIT ✓HIGH 10.0EPSS 4.83% | 10 November 2008 |
| CVE-2008-5004 | SQL injection vulnerability in genscode.php in myWebland Bloggie Lite 0.0.2 beta allows remote attackers to execute arbitrary SQL commands via a crafted cookie. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 10 November 2008 |
| CVE-2008-5003 | SQL injection vulnerability in ndetail.php in Shahrood allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 10 November 2008 |
| CVE-2008-5002 | Insecure method vulnerability in the ChilkatCrypt2.ChilkatCrypt2.1 ActiveX control (ChilkatCrypt2.dll 4.3.2.1) in Chilkat Crypt ActiveX Component allows remote attackers to create and overwrite arbitrary files via the WriteFile method. | EXPLOIT ×2 ✓HIGH 9.3EPSS 40.7% | 10 November 2008 |
| CVE-2008-5000 | SQL injection vulnerability in admin/includes/news.inc.php in PHPX 3.5.16, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via uppercase characters in the news_id parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 0.95% | 10 November 2008 |
| CVE-2008-4999 | Nortel Networks UNIStim IP Phone 0604DAS allows remote attackers to cause a denial of service (crash) via a long ping packet ("ping of death"). | EXPLOIT ✓HIGH 7.8EPSS 3.83% | 7 November 2008 |
| CVE-2008-4932 | webmail/modules/filesystem/edit.php in U-Mail Webmail server 4.91 allows remote attackers to overwrite arbitrary files via an absolute pathname in the path parameter and arbitrary content in the content parameter. | EXPLOIT ✓HIGH 9.0EPSS 5.52% | 5 November 2008 |
| CVE-2008-4931 | Cross-site scripting (XSS) vulnerability in the account module in firmCHANNEL Digital Signage 3.24, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php. | EXPLOIT ✓MEDIUM 4.3EPSS 1.46% | 5 November 2008 |
| CVE-2008-4926 | Multiple insecure method vulnerabilities in MW6 Technologies PDF417 ActiveX control (MW6PDF417Lib.PDF417, MW6PDF417.dll) 3.0.0.1 allow remote attackers to overwrite arbitrary files via a full pathname argument to the (1) SaveAsBMP and (2) SaveAsWMF… | EXPLOIT ✓HIGH 9.0EPSS 7.07% | 4 November 2008 |
| CVE-2008-4925 | Multiple insecure method vulnerabilities in MW6 Technologies DataMatrix ActiveX control (DATAMATRIXLib.MW6DataMatrix, DataMatrix.dll) 3.0.0.1 allow remote attackers to overwrite arbitrary files via a full pathname argument to the (1) SaveAsBMP and (2)… | EXPLOIT ✓HIGH 9.0EPSS 7.15% | 4 November 2008 |
| CVE-2008-4924 | Multiple insecure method vulnerabilities in MW6 Technologies 1D Barcode ActiveX control (BARCODELib.MW6Barcode, Barcode.dll) 3.0.0.1 allow remote attackers to overwrite arbitrary files via a full pathname argument to the (1) SaveAsBMP and (2) SaveAsWMF… | EXPLOIT ✓HIGH 9.0EPSS 7.15% | 4 November 2008 |
| CVE-2008-4923 | Multiple insecure method vulnerabilities in MW6 Technologies Aztec ActiveX control (AZTECLib.MW6Aztec, Aztec.dll) 3.0.0.1 allow remote attackers to overwrite arbitrary files via a full pathname argument to the (1) SaveAsBMP and (2) SaveAsWMF methods. | EXPLOIT ✓HIGH 9.0EPSS 7.15% | 4 November 2008 |
| CVE-2008-4922 | Buffer overflow in the DjVu ActiveX Control 3.0 for Microsoft Office (DjVu_ActiveX_MSOffice.dll) allows remote attackers to execute arbitrary code via a long (1) ImageURL property, and possibly the (2) Mode, (3) Page, or (4) Zoom properties. | EXPLOIT ×2 ✓HIGH 9.3EPSS 32.7% | 4 November 2008 |
| CVE-2008-4919 | Insecure method vulnerability in VISAGESOFT eXPert PDF Viewer X ActiveX control (VSPDFViewerX.ocx) 3.0.990.0 allows remote attackers to overwrite arbitrary files via a full pathname to the savePageAsBitmap method. | EXPLOIT ✓HIGH 8.8EPSS 2.77% | 4 November 2008 |
| CVE-2008-4918 | Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is… | EXPLOIT ✓MEDIUM 4.3EPSS 6.42% | 4 November 2008 |
| CVE-2008-2992 | Adobe Reader and Acrobat Input Validation Vulnerability | KEVEXPLOIT ×4 ✓HIGH 7.8EPSS 98.5% | 4 November 2008 |
| CVE-2008-4907 | The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a denial of service (persistent crash) via an email with a malformed From address, which triggers an… | EXPLOIT ✓MEDIUM 4.3EPSS 6.20% | 4 November 2008 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.