Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
398,548 CVEs1,728 in CISA KEV17,265 with EPSS ≥ 10%25,049 with a public exploitUpdated 27 September 2026
25,049 results · page 307 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2008-0470 | A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteStr method. | EXPLOIT ✓HIGH 9.3EPSS 30.9% | 29 January 2008 |
| CVE-2008-0469 | SQL injection vulnerability in index.php in Tiger Php News System (TPNS) 1.0b and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter in a newscat action. | EXPLOIT ✓HIGH 7.5EPSS 1.23% | 29 January 2008 |
| CVE-2008-0468 | SQL injection vulnerability in category.php in Flinx 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 29 January 2008 |
| CVE-2008-0387 | Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote attackers to execute arbitrary code via crafted (1) op_receive, (2) op_start, (3) op_start_and_receive, (4)… | EXPLOIT ✓HIGH 7.8EPSS 45.9% | 29 January 2008 |
| CVE-2008-0175 | Unrestricted file upload vulnerability in GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the main virtual directory. | EXPLOIT ✓HIGH 7.5EPSS 15.4% | 29 January 2008 |
| CVE-2008-0466 | Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02, does not require authentication, which allows remote attackers to list directories and read files. | EXPLOIT ×2 ✓MEDIUM 5.0EPSS 4.93% | 29 January 2008 |
| CVE-2008-0406 | HTTP File Server (HFS) before 2.2c, when account names are used as log filenames, allows remote attackers to cause a denial of service (daemon crash) via a long account name. | EXPLOIT ✓MEDIUM 5.0EPSS 3.57% | 29 January 2008 |
| CVE-2008-0465 | Directory traversal vulnerability in optimizer.php in Seagull 0.6.3 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 3.43% | 25 January 2008 |
| CVE-2008-0464 | Directory traversal vulnerability in archiv.cgi in absofort aconon Mail 2007 Enterprise SQL 11.7.0 and Mail 2004 Enterprise SQL 11.5.1 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 3.32% | 25 January 2008 |
| CVE-2008-0461 | SQL injection vulnerability in index.php in the Search module in PHP-Nuke 8.0 FINAL and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the sid parameter in a comments action to modules.php. | EXPLOIT ✓MEDIUM 6.8EPSS 2.00% | 25 January 2008 |
| CVE-2008-0459 | Directory traversal vulnerability in update/index.php in Liquid-Silver CMS 0.35, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 1.92% | 25 January 2008 |
| CVE-2008-0458 | Directory traversal vulnerability in function/sources.php in SLAED CMS 2.5 Lite allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 1.93% | 25 January 2008 |
| CVE-2008-0455 | Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users… | EXPLOIT ✓MEDIUM 4.3EPSS 64.8% | 25 January 2008 |
| CVE-2007-4850 | curl/interface.c in the cURL library (aka libcurl) in PHP 5.2.4 and 5.2.5 allows context-dependent attackers to bypass safe_mode and open_basedir restrictions and read arbitrary files via a file:// request containing a \x00 sequence, a different… | EXPLOIT ✓MEDIUM 5.0EPSS 5.58% | 25 January 2008 |
| CVE-2008-0453 | SQL injection vulnerability in list.php in Easysitenetwork Recipe allows remote attackers to execute arbitrary SQL commands via the categoryid parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 0.91% | 25 January 2008 |
| CVE-2008-0452 | Directory traversal vulnerability in articles.php in Siteman 1.1.9 allows remote attackers to read arbitrary files via directory traversal sequences in the cat parameter in a viewart action. | EXPLOIT ✓MEDIUM 5.0EPSS 2.81% | 25 January 2008 |
| CVE-2008-0451 | Multiple SQL injection vulnerabilities in PacerCMS 0.6 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) siteadmin/article-edit.php; and unspecified parameters to (2) submitted-edit.php, (3) page-edit.php,… | EXPLOIT ✓HIGH 7.5EPSS 1.04% | 25 January 2008 |
| CVE-2008-0447 | SQL injection vulnerability in index.php in Foojan WMS PHP Weblog 1.0 allows remote attackers to execute arbitrary SQL commands via the story parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 25 January 2008 |
| CVE-2008-0446 | SQL injection vulnerability in voircom.php in LulieBlog 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 25 January 2008 |
| CVE-2008-0443 | Heap-based buffer overflow in the FileUploader.FUploadCtl.1 ActiveX control in FileUploader.dll 2.0.0.2 in Lycos FileUploader Module allows remote attackers to execute arbitrary code via a long HandwriterFilename property value. | EXPLOIT ✓HIGH 10.0EPSS 12.8% | 25 January 2008 |
| CVE-2008-0442 | PHP remote file inclusion vulnerability in inc/linkbar.php in Small Axe Weblog 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the ffile parameter, a different vector than CVE-2008-0376. | EXPLOIT ✓HIGH 7.5EPSS 2.03% | 25 January 2008 |
| CVE-2008-0440 | AlstraSoft Forum Pay Per Post Exchange 2.0 stores passwords in cleartext, which makes it easier for attackers to access user accounts. | EXPLOIT ✓MEDIUM 5.0EPSS 2.06% | 23 January 2008 |
| CVE-2008-0439 | Cross-site scripting (XSS) vulnerability in templates/default/admincp/attachments_header.php in DeluxeBB 1.1 allows remote attackers to inject arbitrary web script or HTML via the lang_listofmatches parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.46% | 23 January 2008 |
| CVE-2008-0438 | Cross-site scripting (XSS) vulnerability in the font rendering functionality in Novemberborn sIFR 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the txt parameter to a Flash (SWF) file, as demonstrated by fonts/FuturaLt.swf. | EXPLOIT ✓MEDIUM 4.3EPSS 2.93% | 23 January 2008 |
| CVE-2008-0437 | Multiple buffer overflows in the WebHPVCInstall.HPVirtualRooms14 ActiveX control in HPVirtualRooms14.dll 1.0.0.100, as used in the installation process for HP Virtual Rooms, allow remote attackers to execute arbitrary code via a long (1)… | EXPLOIT ✓HIGH 10.0EPSS 58.1% | 23 January 2008 |
| CVE-2008-0436 | Cross-site scripting (XSS) vulnerability in profile-upload/upload.asp in PD9 Software MegaBBS 1.5.14b allows remote attackers to inject arbitrary web script or HTML via the target parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.47% | 23 January 2008 |
| CVE-2008-0435 | Directory traversal vulnerability in index.php in OZJournals 2.1.1 allows remote attackers to read portions of arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 2.92% | 23 January 2008 |
| CVE-2008-0434 | Format string vulnerability in the AXIMilter module in AXIGEN Mail Server 5.0.2 allows remote attackers to execute arbitrary code via format string specifiers in the CNHO command. | EXPLOIT ✓HIGH 9.3EPSS 10.4% | 23 January 2008 |
| CVE-2008-0433 | PHP remote file inclusion vulnerability in theme/phpAutoVideo/LightTwoOh/sidebar.php in Agares phpAutoVideo 2.21 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the loadpage parameter, a different vector than CVE-2007-6614. | EXPLOIT ✓HIGH 7.5EPSS 3.14% | 23 January 2008 |
| CVE-2008-0432 | Cross-site scripting (XSS) vulnerability in index.php in phpAutoVideo 2.21 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.73% | 23 January 2008 |
| CVE-2008-0431 | Directory traversal vulnerability in administrator/download.php in IDMOS (aka Phoenix) 1.0 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 2.77% | 23 January 2008 |
| CVE-2008-0430 | SQL injection vulnerability in form.php in 360 Web Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the IDFM parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 23 January 2008 |
| CVE-2008-0429 | SQL injection vulnerability in index.php in AlstraSoft Forum Pay Per Post Exchange 2.0 allows remote attackers to execute arbitrary SQL commands via the catid parameter in a forum_catview action. | EXPLOIT ✓HIGH 7.5EPSS 1.18% | 23 January 2008 |
| CVE-2008-0428 | Multiple SQL injection vulnerabilities in the login function in system/class_permissions.php in bloofoxCMS 0.3 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to admin/index.php. | EXPLOIT ✓HIGH 7.5EPSS 1.68% | 23 January 2008 |
| CVE-2008-0427 | Directory traversal vulnerability in file.php in bloofoxCMS 0.3 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓HIGH 7.8EPSS 3.68% | 23 January 2008 |
| CVE-2008-0425 | Absolute path traversal vulnerability in explorerdir.php in Frimousse 0.0.2 allows remote attackers to read arbitrary files and list arbitrary directories via a full pathname in the name parameter. | EXPLOIT ✓MEDIUM 5.0EPSS 2.61% | 23 January 2008 |
| CVE-2008-0424 | SQL injection vulnerability in blog.php in Mooseguy Blog System (MGBS) 1.0 allows remote attackers to execute arbitrary SQL commands via the month parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 23 January 2008 |
| CVE-2008-0423 | Multiple PHP remote file inclusion vulnerabilities in Lama Software allow remote attackers to execute arbitrary PHP code via a URL in the MY_CONF[classRoot] parameter to (1) inc.steps.access_error.php, (2) inc.steps.check_login.php, or (3)… | EXPLOIT ✓MEDIUM 6.8EPSS 37.1% | 23 January 2008 |
| CVE-2008-0422 | SQL injection vulnerability in mail.php in boastMachine (aka bMachine) 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 3.27% | 23 January 2008 |
| CVE-2008-0421 | SQL injection vulnerability in Invision Gallery 2.0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the album parameter in a rate command. | EXPLOIT ✓HIGH 7.5EPSS 0.92% | 23 January 2008 |
| CVE-2008-0403 | The web server in Belkin Wireless G Plus MIMO Router F5D9230-4 does not require authentication for SaveCfgFile.cgi, which allows remote attackers to read and modify configuration via a direct request to SaveCfgFile.cgi. | EXPLOIT ✓MEDIUM 5.5EPSS 2.51% | 23 January 2008 |
| CVE-2008-0400 | Cross-site scripting (XSS) vulnerability in header.tpl.php in the modern template for Singapore 0.10.1 allows remote attackers to inject arbitrary web script or HTML via the gallery parameter to default.php. | EXPLOIT ✓MEDIUM 4.3EPSS 1.45% | 23 January 2008 |
| CVE-2008-0399 | Multiple buffer overflows in Toshiba Surveillance (Surveillix) RecordSend ActiveX control (MeIpCamX.DLL 1.0.0.4) allow remote attackers to execute arbitrary code via long arguments to the (1) SetPort and (2) SetIpAddress methods. | EXPLOIT ✓MEDIUM 6.8EPSS 7.98% | 23 January 2008 |
| CVE-2008-0398 | Cross-site scripting (XSS) vulnerability in aflog 1.01, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the comment form. | EXPLOIT ✓MEDIUM 4.3EPSS 1.44% | 23 January 2008 |
| CVE-2008-0397 | Multiple SQL injection vulnerabilities in aflog 1.01, and possibly earlier versions, allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to comments.php and (2) an unspecified parameter to view.php. | EXPLOIT ✓MEDIUM 6.8EPSS 0.98% | 23 January 2008 |
| CVE-2008-0396 | Directory traversal vulnerability in BitDefender Update Server (http.exe), as used in BitDefender products including Security for Fileservers and Enterprise Manager (BDEM), allows remote attackers to read arbitrary files via .. | EXPLOIT ✓HIGH 7.8EPSS 8.53% | 23 January 2008 |
| CVE-2008-0394 | Buffer overflow in Citadel SMTP server 7.10 and earlier allows remote attackers to execute arbitrary code via a long RCPT TO command, which is not properly handled by the makeuserkey function. | EXPLOIT ✓HIGH 7.5EPSS 11.9% | 23 January 2008 |
| CVE-2008-0393 | Directory traversal vulnerability in info.php in GradMan 0.1.3 and earlier allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 5.8EPSS 1.93% | 23 January 2008 |
| CVE-2008-0392 | Multiple buffer overflows in Microsoft Visual Basic Enterprise Edition 6.0 SP6 allow user-assisted remote attackers to execute arbitrary code via a .dsr file with a long (1) ConnectionName or (2) CommandName line. | EXPLOIT ✓HIGH 9.3EPSS 30.5% | 23 January 2008 |
| CVE-2008-0391 | inc/elementz.php in aliTalk 1.9.1.1 does not properly verify authentication, which allows remote attackers to add an arbitrary user account via a modified lilil parameter, in conjunction with the ubild and pa parameters. | EXPLOIT ✓HIGH 7.5EPSS 2.25% | 23 January 2008 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.