Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
398,483 CVEs1,726 in CISA KEV17,265 with EPSS ≥ 10%25,049 with a public exploitUpdated 27 September 2026
25,049 results · page 285 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2008-2971 | SQL injection vulnerability in links-extern.php in CiBlog 3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 2 July 2008 |
| CVE-2008-2970 | Multiple session fixation vulnerabilities in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to (1) index.php and (2) login.php in homepg/. | EXPLOIT ✓HIGH 7.5EPSS 2.36% | 2 July 2008 |
| CVE-2008-2969 | Directory traversal vulnerability in download.php in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 2.83% | 2 July 2008 |
| CVE-2008-2968 | SQL injection vulnerability in rating.php in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allows remote attackers to execute arbitrary SQL commands via the book_id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.14% | 2 July 2008 |
| CVE-2008-2967 | Multiple cross-site scripting (XSS) vulnerabilities in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) query string to login.php and the (2) glb_sid parameter to… | EXPLOIT ✓MEDIUM 4.3EPSS 1.73% | 2 July 2008 |
| CVE-2008-2966 | Directory traversal vulnerability in viewprofile.php in JaxUltraBB 2.0 and earlier allows remote attackers to read arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.49% | 2 July 2008 |
| CVE-2008-2965 | Cross-site scripting (XSS) vulnerability in viewforum.php in JaxUltraBB (JUBB) 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the forum parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.44% | 2 July 2008 |
| CVE-2008-2964 | SQL injection vulnerability in guide.php in ResearchGuide 0.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.93% | 2 July 2008 |
| CVE-2008-2963 | Multiple SQL injection vulnerabilities in MyBlog allow remote attackers to execute arbitrary SQL commands via the (1) view parameter to (a) index.php, and the (2) id parameter to (b) member.php and (c) post.php. | EXPLOIT ✓MEDIUM 6.8EPSS 0.91% | 2 July 2008 |
| CVE-2008-2962 | Multiple cross-site scripting (XSS) vulnerabilities in MyBlog allow remote attackers to inject arbitrary web script or HTML via the (1) s and (2) sort parameters to index.php, and the (3) id parameter to post.php. | EXPLOIT ✓MEDIUM 4.3EPSS 1.44% | 2 July 2008 |
| CVE-2008-2961 | Multiple directory traversal vulnerabilities in view/index.php in CMS Mini 0.2.2 allow remote attackers to read arbitrary local files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 2.67% | 2 July 2008 |
| CVE-2008-2959 | Buffer overflow in a certain ActiveX control (vb6skit.dll) in Microsoft Visual Basic Enterprise Edition 6.0 SP6 might allow remote attackers to execute arbitrary code via a long lpstrLinkPath argument to the fCreateShellLink function. | EXPLOIT ✓HIGH 9.3EPSS 24.8% | 2 July 2008 |
| CVE-2008-2955 | Pidgin 2.4.1 allows remote attackers to cause a denial of service (crash) via a long filename that contains certain characters, as demonstrated using an MSN message that triggers the crash in the msn_slplink_process_msg function. | EXPLOIT ✓MEDIUM 4.3EPSS 7.26% | 1 July 2008 |
| CVE-2008-2952 | liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error. | EXPLOIT ✓MEDIUM 5.0EPSS 13.2% | 1 July 2008 |
| CVE-2008-2949 | Cross-domain vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to change the location property of a frame via the String data type, and use a frame from a different domain to observe domain-independent events, as demonstrated… | EXPLOIT ✓MEDIUM 6.8EPSS 20.5% | 30 June 2008 |
| CVE-2008-2948 | Cross-domain vulnerability in Microsoft Internet Explorer 7 and 8 allows remote attackers to change the location property of a frame via the Object data type, and use a frame from a different domain to observe domain-independent events, as demonstrated… | EXPLOIT ✓MEDIUM 6.8EPSS 25.4% | 30 June 2008 |
| CVE-2008-2943 | Double free vulnerability in IBM Tivoli Directory Server (TDS) 6.1.0.0 through 6.1.0.15 allows remote authenticated administrators to cause a denial of service (ABEND) and possibly execute arbitrary code by using ldapadd to attempt to create a duplicate… | EXPLOIT ✓MEDIUM 6.0EPSS 2.42% | 30 June 2008 |
| CVE-2008-2365 | Race condition in the ptrace and utrace support in the Linux kernel 2.6.9 through 2.6.25, as used in Red Hat Enterprise Linux (RHEL) 4, allows local users to cause a denial of service (oops) via a long series of PTRACE_ATTACH ptrace calls to another… | EXPLOIT ×2 ✓MEDIUM 4.7EPSS 0.53% | 30 June 2008 |
| CVE-2008-2922 | Stack-based buffer overflow in artegic Dana IRC client 1.3 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long IRC message. | EXPLOIT ×2 ✓HIGH 7.5EPSS 5.05% | 30 June 2008 |
| CVE-2008-2921 | SQL injection vulnerability in index.php in EZTechhelp EZCMS 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.09% | 30 June 2008 |
| CVE-2008-2920 | admin/filemanager/ (aka the File Manager) in EZTechhelp EZCMS 1.2 and earlier does not require authentication, which allows remote attackers to create, modify, read, and delete files. | EXPLOIT ✓HIGH 7.5EPSS 2.55% | 30 June 2008 |
| CVE-2008-2919 | SQL injection vulnerability in listing.php in Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL commands via the sort parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 0.93% | 30 June 2008 |
| CVE-2008-2918 | SQL injection vulnerability in details.php in Application Dynamics Cartweaver 3.0 allows remote attackers to execute arbitrary SQL commands via the prodId parameter, possibly a related issue to CVE-2006-2046.3. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 30 June 2008 |
| CVE-2008-2917 | SQL injection vulnerability in productsofcat.asp in E-SMART CART allows remote attackers to execute arbitrary SQL commands via the category_id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.68% | 30 June 2008 |
| CVE-2008-2916 | Multiple SQL injection vulnerabilities in Pre ADS Portal 2.0 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) cid parameter to showcategory.php and the (2) id parameter to… | EXPLOIT ✓MEDIUM 6.8EPSS 1.12% | 30 June 2008 |
| CVE-2008-2915 | Multiple SQL injection vulnerabilities in jobseekers/JobSearch.php (aka the search module) in Pre Job Board allow remote attackers to execute arbitrary SQL commands via the (1) position or (2) kw parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 30 June 2008 |
| CVE-2008-2914 | SQL injection vulnerability in jobseekers/JobSearch3.php (aka the search module) in PHP JOBWEBSITE PRO allows remote attackers to execute arbitrary SQL commands via the (1) kw or (2) position parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 30 June 2008 |
| CVE-2008-2913 | Directory traversal vulnerability in func.php in Devalcms 1.4a, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 1.86% | 30 June 2008 |
| CVE-2008-2912 | Multiple PHP remote file inclusion vulnerabilities in Contenido CMS 4.8.4 allow remote attackers to execute arbitrary PHP code via a URL in the (1) contenido_path parameter to (a) contenido/backend_search.php; the (2) cfg[path][contenido] parameter to… | EXPLOIT ✓HIGH 7.5EPSS 2.38% | 30 June 2008 |
| CVE-2008-2911 | Multiple cross-site scripting (XSS) vulnerabilities in index.php in Contenido 4.8.4 allow remote attackers to inject arbitrary web script or HTML via the (1) contenido, (2) Belang, and (3) username parameters. | EXPLOIT ✓MEDIUM 4.3EPSS 1.50% | 30 June 2008 |
| CVE-2008-2910 | Buffer overflow in the DXTTextOutEffect ActiveX control (aka the Text-Effect DXT Filter), as distributed in TextOut.dll 6.0.18.1 and mvtextout.dll, in muvee autoProducer 6.0 and 6.1 allows remote attackers to execute arbitrary code via a long… | EXPLOIT ✓HIGH 9.3EPSS 9.30% | 30 June 2008 |
| CVE-2008-2909 | SQL injection vulnerability in results.php in Clever Copy 3.0 allows remote attackers to execute arbitrary SQL commands via the searchtype parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 30 June 2008 |
| CVE-2008-2908 | Multiple stack-based buffer overflows in a certain ActiveX control in ienipp.ocx in Novell iPrint Client for Windows before 4.36 allow remote attackers to execute arbitrary code via a long value of the (1) operation, (2) printer-url, or (3) target-frame… | EXPLOIT ✓HIGH 9.3EPSS 35.4% | 30 June 2008 |
| CVE-2008-2907 | SQL injection vulnerability in admin/index.php in WebChamado 1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the eml parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 0.91% | 30 June 2008 |
| CVE-2008-2906 | SQL injection vulnerability in lista_anexos.php in WebChamado 1.1 allows remote attackers to execute arbitrary SQL commands via the tsk_id parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 0.91% | 30 June 2008 |
| CVE-2008-2905 | PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4.6.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the… | EXPLOIT ×3 ✓MEDIUM 6.8EPSS 18.4% | 30 June 2008 |
| CVE-2008-2904 | SQL injection vulnerability in shop.php in Conkurent PHPMyCart allows remote attackers to execute arbitrary SQL commands via the cat parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 30 June 2008 |
| CVE-2008-2903 | SQL injection vulnerability in news.php in Advanced Webhost Billing System (AWBS) 2.3.3 through 2.7.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the viewnews parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 0.91% | 30 June 2008 |
| CVE-2008-2902 | SQL injection vulnerability in profile.php in AlstraSoft AskMe Pro 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 30 June 2008 |
| CVE-2008-2901 | Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php,… | EXPLOIT ✓MEDIUM 6.5EPSS 0.86% | 30 June 2008 |
| CVE-2008-2900 | SQL injection vulnerability in item.php in PHPAuction 3.2 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 27 June 2008 |
| CVE-2008-2898 | Directory traversal vulnerability in includes/header.php in Hedgehog-CMS 1.21 allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 9.3EPSS 6.71% | 27 June 2008 |
| CVE-2008-2897 | SQL injection vulnerability in index.php in PageSquid CMS 0.3 Beta allows remote attackers to execute arbitrary SQL commands via the page parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 27 June 2008 |
| CVE-2008-2896 | Directory traversal vulnerability in index.php in FireAnt 1.3 allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.29% | 27 June 2008 |
| CVE-2008-2895 | Directory traversal vulnerability in index.php in AproxEngine 5.1.0.4 allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.30% | 27 June 2008 |
| CVE-2008-2894 | Directory traversal vulnerability in the FTP client in NCH Software Classic FTP 1.02 for Windows allows remote FTP servers to create or overwrite arbitrary files via a .. | EXPLOIT ✓HIGH 9.3EPSS 2.43% | 27 June 2008 |
| CVE-2008-2893 | SQL injection vulnerability in news.php in AJ Square aj-hyip (aka AJ HYIP Acme) allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2008-2532. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 27 June 2008 |
| CVE-2008-2892 | SQL injection vulnerability in the EXP Shop (com_expshop) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a show_payment action to index.php. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 27 June 2008 |
| CVE-2008-2891 | SQL injection vulnerability in index.php in eMuSOFT emuCMS 0.3 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a category action. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 27 June 2008 |
| CVE-2008-2890 | Multiple SQL injection vulnerabilities in Online Fantasy Football League (OFFL) 0.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) fflteam_id parameter to teams.php, the (2) league_id parameter to leagues.php, and the… | EXPLOIT ✓HIGH 7.5EPSS 1.04% | 27 June 2008 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.