Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
398,539 CVEs1,726 in CISA KEV17,265 with EPSS ≥ 10%25,049 with a public exploitUpdated 27 September 2026
25,049 results · page 300 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2008-1295 | SQL injection vulnerability in archives.php in Gregory Kokanosky (aka Greg's Place) phpMyNewsletter 0.8 beta 5 and earlier allows remote attackers to execute arbitrary SQL commands via the msg_id parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 0.94% | 12 March 2008 |
| CVE-2008-0301 | Multiple SQL injection vulnerabilities in Mapbender 2.4.4 allow remote attackers to execute arbitrary SQL commands via the gaz parameter to mod_gazetteer_edit.php and other unspecified vectors. | EXPLOIT ✓HIGH 7.5EPSS 1.68% | 11 March 2008 |
| CVE-2008-0300 | mapFiler.php in Mapbender 2.4 to 2.4.4 allows remote attackers to execute arbitrary PHP code via PHP code sequences in the factor parameter, which are not properly handled when accessing a filename that contains those sequences. | EXPLOIT ✓MEDIUM 6.8EPSS 1.99% | 11 March 2008 |
| CVE-2008-0118 | Unspecified vulnerability in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, Excel Viewer 2003 up to SP3, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption… | EXPLOIT ×2 ✓HIGH 9.3EPSS 34.8% | 11 March 2008 |
| CVE-2008-0117 | Unspecified vulnerability in Microsoft Excel 2000 SP3 and 2002 SP2, and Office 2004 and 2008 for Mac, allows user-assisted remote attackers to execute arbitrary code via crafted conditional formatting values, aka "Excel Conditional Formatting… | EXPLOIT ✓HIGH 9.3EPSS 33.4% | 11 March 2008 |
| CVE-2008-0116 | Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, Compatibility Pack, and Office 2004 and 2008 for Mac allows user-assisted remote attackers to execute arbitrary code via malformed tags in rich text, aka "Excel Rich Text Validation Vulnerability." | EXPLOIT ✓HIGH 9.3EPSS 48.2% | 11 March 2008 |
| CVE-2008-0115 | Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2007, Viewer 2003, Compatibility Pack, and Office for Mac 2004 allows user-assisted remote attackers to execute arbitrary code via malformed formulas, aka "Excel Formula Parsing Vulnerability." | EXPLOIT ✓HIGH 9.3EPSS 39.3% | 11 March 2008 |
| CVE-2008-0114 | Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office for Mac 2004 allows user-assisted remote attackers to execute arbitrary code via crafted Style records that trigger memory corruption. | EXPLOIT ✓HIGH 9.3EPSS 38.8% | 11 March 2008 |
| CVE-2008-0113 | Unspecified vulnerability in Microsoft Office Excel Viewer 2003 up to SP3 allows user-assisted remote attackers to execute arbitrary code via an Excel document with malformed cell comments that trigger memory corruption from an "allocation error," aka… | EXPLOIT ✓HIGH 9.3EPSS 42.2% | 11 March 2008 |
| CVE-2008-0112 | Unspecified vulnerability in Microsoft Excel 2000 SP3, and Office for Mac 2004 and 2008 allows user-assisted remote attackers to execute arbitrary code via a crafted .SLK file that is not properly handled when importing the file, aka "Excel File Import… | EXPLOIT ✓HIGH 9.3EPSS 32.2% | 11 March 2008 |
| CVE-2008-0111 | Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2007, Viewer 2003, Compatibility Pack, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via crafted data validation records, aka "Excel Data Validation… | EXPLOIT ✓HIGH 9.3EPSS 50.9% | 11 March 2008 |
| CVE-2008-1283 | Cross-site scripting (XSS) vulnerability in Neptune Web Server 3.0 allows remote attackers to inject arbitrary web script or HTML via the URI, which is not properly handled in the 404 error page. | EXPLOIT ✓MEDIUM 4.3EPSS 1.46% | 11 March 2008 |
| CVE-2008-1278 | The RemotelyAnywhere.exe service in the Remotely Anywhere Server and Workstation 8.0.668 and earlier allows remote attackers to cause a denial of service (crash) via an invalid Accept-Charset header, which triggers a NULL pointer dereference. | EXPLOIT ✓MEDIUM 5.0EPSS 7.34% | 10 March 2008 |
| CVE-2008-1277 | The IMAP service (MEIMAPS.exe) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allows remote attackers to cause a denial of service (crash) via (1) SEARCH and (2) APPEND commands without required arguments, which triggers a… | EXPLOIT ✓HIGH 9.0EPSS 8.25% | 10 March 2008 |
| CVE-2008-1276 | Multiple buffer overflows in the IMAP service (MEIMAPS.EXE) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allow remote authenticated attackers to execute arbitrary code via long arguments to the (1) FETCH, (2) EXAMINE, and… | EXPLOIT ✓HIGH 9.0EPSS 7.09% | 10 March 2008 |
| CVE-2008-1275 | Multiple unspecified vulnerabilities in the SMTP service in MailEnable Standard Edition 1.x, Professional Edition 3.x and earlier, and Enterprise Edition 3.x and earlier allow remote attackers to cause a denial of service (crash) via crafted (1) EXPN or… | EXPLOIT ✓HIGH 7.8EPSS 4.04% | 10 March 2008 |
| CVE-2008-1273 | Multiple cross-site scripting (XSS) vulnerabilities in imageVue 1.7 allow remote attackers to inject arbitrary web script or HTML via the path parameter to (1) popup.php, (2) test/dir2.php, (3) admin/upload.php, and (4) dirxml.php in upload/. | EXPLOIT ×4 ✓MEDIUM 4.3EPSS 1.48% | 10 March 2008 |
| CVE-2008-1272 | Multiple SQL injection vulnerabilities in BM Classifieds 20080309 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to showad.php and the (2) ad parameter to pfriendly.php. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 10 March 2008 |
| CVE-2008-1218 | Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which are treated as argument… | EXPLOIT ✓MEDIUM 6.8EPSS 7.34% | 10 March 2008 |
| CVE-2008-1270 | mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory. | EXPLOIT ✓MEDIUM 5.0EPSS 11.9% | 10 March 2008 |
| CVE-2008-1262 | The administration panel on the Airspan WiMax ProST 4.1 antenna with 6.5.38.0 software does not verify authentication credentials, which allows remote attackers to (1) upload malformed firmware or (2) bind the antenna to a different WiMAX base station… | EXPLOIT ✓HIGH 10.0EPSS 8.53% | 10 March 2008 |
| CVE-2008-1247 | The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote attackers to perform arbitrary administrative actions via a direct request to (1) Advanced.tri, (2) AdvRoute.tri,… | EXPLOIT ✓HIGH 10.0EPSS 5.16% | 10 March 2008 |
| CVE-2008-1245 | cgi-bin/setup_virtualserver.exe on the Belkin F5D7230-4 router with firmware 9.01.10 allows remote attackers to cause a denial of service (control center outage) via an HTTP request with invalid POST data and a "Connection: Keep-Alive" header. | EXPLOIT ✓HIGH 7.8EPSS 3.18% | 10 March 2008 |
| CVE-2008-1244 | cgi-bin/setup_dns.exe on the Belkin F5D7230-4 router with firmware 9.01.10 does not require authentication, which allows remote attackers to perform administrative actions, as demonstrated by changing a DNS server via the dns1_1, dns1_2, dns1_3, and… | EXPLOIT ✓HIGH 10.0EPSS 4.90% | 10 March 2008 |
| CVE-2008-1242 | The control panel on the Belkin F5D7230-4 router with firmware 9.01.10 maintains authentication state by IP address, which allows remote attackers to bypass authentication by establishing a session from a source IP address of a previously authenticated… | EXPLOIT ✓HIGH 10.0EPSS 4.13% | 10 March 2008 |
| CVE-2008-1231 | Directory traversal vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to include and execute arbitrary local .jsp files, and obtain sensitive information, via a .. | EXPLOIT ✓HIGH 9.3EPSS 7.61% | 10 March 2008 |
| CVE-2008-1230 | Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbitrary .jsp files via an unspecified manipulation that attaches a .jsp file to an "entry page." | EXPLOIT ✓HIGH 9.3EPSS 4.41% | 10 March 2008 |
| CVE-2008-1229 | Cross-site scripting (XSS) vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to inject arbitrary web script or HTML via the editor parameter, a different vector than CVE-2007-5120.b. | EXPLOIT ✓MEDIUM 4.3EPSS 2.08% | 10 March 2008 |
| CVE-2008-1228 | Cross-site scripting (XSS) vulnerability in admin.php in MG2 (formerly Minigal) allows remote attackers to inject arbitrary web script or HTML via the list parameter in an import action. | EXPLOIT ✓MEDIUM 4.3EPSS 1.31% | 10 March 2008 |
| CVE-2008-1225 | Multiple cross-site scripting (XSS) vulnerabilities in WebCT Campus Edition 4.1.5.8, when "Don't wrap text" is enabled, allow remote authenticated users to inject arbitrary web script or HTML via a (1) mail message or (2) discussion board message. | EXPLOIT ✓MEDIUM 4.3EPSS 1.71% | 10 March 2008 |
| CVE-2008-1221 | Absolute path traversal vulnerability in the FTP server in MicroWorld eScan Corporate Edition 9.0.742.98 and eScan Management Console (aka eScan Server) 9.0.742.1 allows remote attackers to read arbitrary files via an absolute pathname in the RETR (get)… | EXPLOIT ✓MEDIUM 5.0EPSS 3.12% | 10 March 2008 |
| CVE-2008-1220 | SQL injection vulnerability in the 4nChat 0.91 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the roomid parameter in an index action to modules.php. | EXPLOIT ✓HIGH 7.5EPSS 0.91% | 10 March 2008 |
| CVE-2008-1219 | SQL injection vulnerability in the Kutub-i Sitte (KutubiSitte) 1.1 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the kid parameter in a hadisgoster action to modules.php. | EXPLOIT ✓HIGH 7.5EPSS 1.19% | 10 March 2008 |
| CVE-2008-1215 | Stack-based buffer overflow in the command_Expand_Interpret function in command.c in ppp (aka user-ppp), as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long… | EXPLOIT ✓MEDIUM 4.6EPSS 0.79% | 9 March 2008 |
| CVE-2008-1208 | Cross-site scripting (XSS) vulnerability in the login page in Check Point VPN-1 UTM Edge W Embedded NGX 7.0.48x allows remote attackers to inject arbitrary web script or HTML via the user parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.92% | 8 March 2008 |
| CVE-2008-1193 | Unspecified vulnerability in Java Runtime Environment Image Parsing Library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allows remote attackers to gain privileges via an untrusted application. | EXPLOIT ✓HIGH 9.3EPSS 12.5% | 6 March 2008 |
| CVE-2008-1181 | Juniper Networks Secure Access 2000 5.5 R1 (build 11711) allows remote attackers to obtain sensitive information via a direct request for remediate.cgi without certain parameters, which reveals the path in an "Execute failed" error message. | EXPLOIT ✓MEDIUM 5.0EPSS 2.45% | 6 March 2008 |
| CVE-2008-1180 | Cross-site scripting (XSS) vulnerability in dana-na/auth/rdremediate.cgi in Juniper Networks Secure Access 2000 5.5 R1 build 11711 allows remote attackers to inject arbitrary web script or HTML via the delivery_mode parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.79% | 6 March 2008 |
| CVE-2008-1178 | Directory traversal vulnerability in include/doc/index.php in Centreon 1.4.2.3 and earlier allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 4.3EPSS 5.20% | 6 March 2008 |
| CVE-2008-1177 | SQL injection vulnerability in shop/detail.php in Affiliate Market (affmarket) 0.1 BETA allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.93% | 6 March 2008 |
| CVE-2008-1176 | Cross-site scripting (XSS) vulnerability in function/sideblock.php in Affiliate Market (affmarket) 0.1 BETA allows remote attackers to inject arbitrary web script or HTML via the sideblock4 parameter. | EXPLOIT ✓LOW 2.6EPSS 1.21% | 6 March 2008 |
| CVE-2008-1174 | Cross-site scripting (XSS) vulnerability in editUser.asp in AuthentiX 6.3b1 Trial allows remote attackers to inject arbitrary web script or HTML via the username parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.62% | 6 March 2008 |
| CVE-2008-1173 | Cross-site scripting (XSS) vulnerability in account-inbox.php in TorrentTrader Classic 1.08 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.51% | 6 March 2008 |
| CVE-2008-0986 | Integer overflow in the BMP::readFromStream method in the libsgl.so library in Google Android SDK m3-rc37a and earlier, and m5-rc14, allows remote attackers to execute arbitrary code via a crafted BMP file with a header containing a negative offset field. | EXPLOIT ✓HIGH 7.5EPSS 4.87% | 6 March 2008 |
| CVE-2008-0985 | Heap-based buffer overflow in the GIF library in the WebKit framework for Google Android SDK m3-rc37a and earlier allows remote attackers to execute arbitrary code via a crafted GIF file whose logical screen height and width are different than the… | EXPLOIT ✓MEDIUM 6.8EPSS 4.59% | 6 March 2008 |
| CVE-2008-1170 | Multiple PHP remote file inclusion vulnerabilities in KCWiki 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the page parameter to (1) minimal/wiki.php and (2) simplest/wiki.php. | EXPLOIT ×2 ✓MEDIUM 6.8EPSS 2.30% | 5 March 2008 |
| CVE-2008-1169 | Directory traversal vulnerability in the embedded HTTP server in SCI Photo Chat Server 3.4.9 and earlier allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) or "../" (dot dot forward slash) in the GET command. | EXPLOIT ✓HIGH 7.8EPSS 2.82% | 5 March 2008 |
| CVE-2008-1164 | SQL injection vulnerability in index.php in phpComasy 0.8 allows remote attackers to execute arbitrary SQL commands via the mod_project_id parameter in a project_detail action. | EXPLOIT ✓HIGH 7.5EPSS 0.93% | 5 March 2008 |
| CVE-2008-1163 | SQL injection vulnerability in index.php in phpArcadeScript 1.0 through 3.0 RC2 allows remote attackers to execute arbitrary SQL commands via the userid parameter in a profile action. | EXPLOIT ✓HIGH 7.5EPSS 0.93% | 5 March 2008 |
| CVE-2008-1162 | SQL injection vulnerability in album.php in PHP WEB SCRIPT Dynamic Photo Gallery 1.02 allows remote attackers to execute arbitrary SQL commands via the albumID parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.14% | 5 March 2008 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.