Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
398,548 CVEs1,728 in CISA KEV17,265 with EPSS ≥ 10%25,049 with a public exploitUpdated 27 September 2026
25,049 results · page 311 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2007-6650 | Unrestricted file upload vulnerability in fisheye/upload.php in Bitweaver R2 CMS allows remote attackers to upload arbitrary files by using the image/gif content type, and possibly other image and PDF content types, as demonstrated by uploading a… | EXPLOIT ✓HIGH 7.5EPSS 2.89% | 4 January 2008 |
| CVE-2007-6649 | PHP remote file inclusion vulnerability in includes/tumbnail.php in MatPo Bilder Galerie 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter. | EXPLOIT ✓HIGH 7.5EPSS 6.03% | 4 January 2008 |
| CVE-2007-6648 | Directory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter. | EXPLOIT ✓MEDIUM 5.0EPSS 5.54% | 4 January 2008 |
| CVE-2007-6647 | SQL injection vulnerability in index.php in w-Agora 4.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cat parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 4 January 2008 |
| CVE-2008-0092 | Cross-site scripting (XSS) vulnerability in index.php in the search module in Appalachian State University phpWebSite 1.4.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.73% | 4 January 2008 |
| CVE-2008-0091 | Directory traversal vulnerability in download2.php in AGENCY4NET WEBFTP 1 allows remote attackers to read and delete arbitrary files via a .. | EXPLOIT ✓MEDIUM 6.4EPSS 2.77% | 4 January 2008 |
| CVE-2008-0090 | A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long argument to the SetPassword method. | EXPLOIT ✓MEDIUM 5.0EPSS 22.5% | 4 January 2008 |
| CVE-2008-0089 | SQL injection vulnerability in uprofile.php in ClipShare allows remote attackers to execute arbitrary SQL commands via the UID parameter. | EXPLOIT ×2 ✓HIGH 7.5EPSS 1.01% | 4 January 2008 |
| CVE-2007-6646 | Multiple cross-site scripting (XSS) vulnerabilities in LiveCart 1.0.1, and possibly other versions before 1.1.0, allow remote attackers to inject arbitrary web script or HTML via (1) the return parameter to user/remindPassword, (2) the q parameter to… | EXPLOIT ×4 ✓MEDIUM 4.3EPSS 4.09% | 4 January 2008 |
| CVE-2007-6641 | Cross-site scripting (XSS) vulnerability in dir.php in milliscripts Redirection allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a browse action. | EXPLOIT ✓MEDIUM 4.3EPSS 1.73% | 4 January 2008 |
| CVE-2007-6639 | SQL injection vulnerability in index.php in IPTBB 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewdir action. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 4 January 2008 |
| CVE-2007-6638 | March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, passwords, device names, and IP addresses via a direct request for scripts/logfiles.tar.gz. | EXPLOIT ✓HIGH 10.0EPSS 12.6% | 4 January 2008 |
| CVE-2007-6634 | Multiple SQL injection vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to execute arbitrary SQL commands via the category_id parameter to faq.php, and unspecified other vectors involving additional scripts. | EXPLOIT ✓MEDIUM 6.8EPSS 1.08% | 4 January 2008 |
| CVE-2007-6633 | Multiple cross-site scripting (XSS) vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to inject arbitrary web script or HTML via (1) the cat_name parameter to faq.php; and unspecified parameters to the (2) add… | EXPLOIT ✓MEDIUM 4.3EPSS 1.73% | 4 January 2008 |
| CVE-2007-6632 | showCode.php in xml2owl 0.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 2.47% | 4 January 2008 |
| CVE-2007-6631 | Multiple buffer overflows in LScube libnemesi 0.6.4-rc1 and earlier allow remote attackers to execute arbitrary code via (1) a reply that begins with a long version string, which triggers an overflow in handle_rtsp_pkt in rtsp_handlers.c; long headers… | EXPLOIT ✓HIGH 7.5EPSS 9.08% | 4 January 2008 |
| CVE-2007-6630 | The Url_init function in utils/url.c in Netembryo 0.0.4, when used by LScube Feng, allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a malformed URI containing a "/:" sequence, as demonstrated by a "DESCRIBE /:… | EXPLOIT ✓MEDIUM 5.0EPSS 3.40% | 4 January 2008 |
| CVE-2007-6624 | Directory traversal vulnerability in printview.php in PNphpBB2 1.2i and earlier allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 1.94% | 4 January 2008 |
| CVE-2007-6623 | Absolute path traversal vulnerability in ZeusCMS 0.3 and earlier might allow remote attackers to list arbitrary directories via a full pathname in the dir parameter. | EXPLOIT ✓MEDIUM 5.0EPSS 5.38% | 4 January 2008 |
| CVE-2007-6622 | SQL injection vulnerability in security.php in ZeusCMS 0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 4 January 2008 |
| CVE-2007-6621 | Directory traversal vulnerability in joovili.images.php in Joovili 3.0.0 through 3.0.6 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 6.4EPSS 2.37% | 4 January 2008 |
| CVE-2007-6620 | Directory traversal vulnerability in include/images.inc.php in Joovili 2.x allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 6.4EPSS 6.73% | 4 January 2008 |
| CVE-2007-6615 | Directory traversal vulnerability in includes/block.php in Agares Media phpAutoVideo 2.21 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the selected_provider parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 5.34% | 3 January 2008 |
| CVE-2007-6614 | PHP remote file inclusion vulnerability in admin/frontpage_right.php in Agares Media phpAutoVideo 2.21 allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter, a related issue to CVE-2007-6542. | EXPLOIT ✓MEDIUM 6.8EPSS 6.12% | 3 January 2008 |
| CVE-2007-6613 | Stack-based buffer overflow in the print_iso9660_recurse function in iso-info (src/iso-info.c) in GNU Compact Disc Input and Control Library (libcdio) 0.79 and earlier allows context-dependent attackers to cause a denial of service (core dump) and… | EXPLOIT ✓MEDIUM 5.0EPSS 12.7% | 3 January 2008 |
| CVE-2007-6609 | Multiple stack-based buffer overflows in the CPLI_ReadTag_OGG function in CPI_PlaylistItem.c in CoolPlayer 217 and earlier allow user-assisted remote attackers to execute arbitrary code via a long (1) cTag or (2) cValue field in an OGG Vorbis file. | EXPLOIT ✓MEDIUM 5.0EPSS 5.22% | 31 December 2007 |
| CVE-2007-6608 | Multiple cross-site scripting (XSS) vulnerabilities in OpenBiblio 0.5.2-pre4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) LAST and (2) FIRST parameters to admin/staff_del_confirm.php, (3) the name parameter to… | EXPLOIT ×3 ✓MEDIUM 4.3EPSS 4.57% | 31 December 2007 |
| CVE-2007-6605 | Buffer overflow in a certain ActiveX control in SkyFexClient.ocx 1.0.2.77 in SkyFex Client 1.0 allows remote attackers to execute arbitrary code via long strings in the first four arguments to the Start method. | EXPLOIT ✓MEDIUM 5.8EPSS 3.71% | 31 December 2007 |
| CVE-2007-6604 | Multiple directory traversal vulnerabilities in index.php in XCMS 1.82 and earlier allow remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 3.62% | 31 December 2007 |
| CVE-2007-6603 | Hot or Not Clone has insufficient access control for producing and reading database backups, which allows remote attackers to obtain the administrator username and password via a direct request to control/backup/backup.php, which generates a… | EXPLOIT ✓MEDIUM 5.0EPSS 2.86% | 31 December 2007 |
| CVE-2007-6602 | SQL injection vulnerability in app/models/identity.php in NoseRub 0.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the username field to the login script. | EXPLOIT ✓HIGH 7.5EPSS 1.28% | 31 December 2007 |
| CVE-2007-6597 | Multiple cross-site scripting (XSS) vulnerabilities in IPortalX before Build 033 allow remote attackers to inject arbitrary web script or HTML via the (1) KW and (2) SF parameters to forum/login_user.asp, and (3) the Date parameter to blogs.asp. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 2.21% | 31 December 2007 |
| CVE-2007-6593 | Multiple stack-based buffer overflows in l123sr.dll in Autonomy (formerly Verity) KeyView SDK, as used by IBM Lotus Notes 5.x through 8.x, allow user-assisted remote attackers to execute arbitrary code via the (1) Length and (2) Value fields for certain… | EXPLOIT ✓HIGH 8.8EPSS 6.30% | 28 December 2007 |
| CVE-2007-6587 | SQL injection vulnerability in plog-rss.php in Plogger 1.0 Beta 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 3.44% | 28 December 2007 |
| CVE-2007-6586 | SQL injection vulnerability in sezione_news.php in nicLOR-CMS allows remote attackers to execute arbitrary SQL commands via the id parameter in a sezione page action to index.php. | EXPLOIT ×2 ✓HIGH 7.5EPSS 1.00% | 28 December 2007 |
| CVE-2007-6585 | PHP remote file inclusion vulnerability in confirmUnsubscription.php in NmnNewsletter 1.0.7 allows remote attackers to execute arbitrary PHP code via a URL in the output parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 2.80% | 28 December 2007 |
| CVE-2007-6584 | Multiple directory traversal vulnerabilities in 1024 CMS 1.3.1 allow remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.4EPSS 8.56% | 28 December 2007 |
| CVE-2007-6583 | SQL injection vulnerability in admin/ops/findip/ajax/search.php in 1024 CMS 1.3.1 allows remote attackers to execute arbitrary SQL commands via the ip parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.84% | 28 December 2007 |
| CVE-2007-6582 | Directory traversal vulnerability in index.php in mBlog 1.2 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 6.4EPSS 2.36% | 28 December 2007 |
| CVE-2007-6581 | Multiple directory traversal vulnerabilities in Social Engine 2.0 allow remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.4EPSS 3.54% | 28 December 2007 |
| CVE-2007-6580 | Multiple SQL injection vulnerabilities in Wallpaper Site 1.0.09 allow remote attackers to execute arbitrary SQL commands via (1) the catid parameter to category.php or (2) the groupid parameter to editadgroup.php. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 28 December 2007 |
| CVE-2007-6579 | Multiple SQL injection vulnerabilities in Ip Reg 0.3 allow remote attackers to execute arbitrary SQL commands via the vlan_id parameter to (1) vlanview.php, (2) vlanedit.php, and (3) vlandel.php; the (4) assetclassgroup_id parameter to… | EXPLOIT ✓HIGH 7.5EPSS 1.71% | 28 December 2007 |
| CVE-2007-6578 | SQL injection vulnerability in go.php in PHP ZLink 0.3 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 28 December 2007 |
| CVE-2007-6577 | Multiple SQL injection vulnerabilities in index.php in zBlog 1.2 allow remote attackers to execute arbitrary SQL commands via (1) the categ parameter in a categ action or (2) the article parameter in an articles action. | EXPLOIT ✓HIGH 7.5EPSS 1.02% | 28 December 2007 |
| CVE-2007-6576 | Multiple SQL injection vulnerabilities in Adult Script 1.6.5 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) videolink_count.php or (2) links.php. | EXPLOIT ✓HIGH 7.5EPSS 1.21% | 28 December 2007 |
| CVE-2007-6575 | SQL injection vulnerability in default.php in MMSLamp allows remote attackers to execute arbitrary SQL commands via the idpro parameter in a prodotti_dettaglio action. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 28 December 2007 |
| CVE-2007-6574 | Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the origin parameter to work/work.php in a display_upload_form action, or the forum parameter to (2)… | EXPLOIT ×3 ✓MEDIUM 4.3EPSS 1.76% | 28 December 2007 |
| CVE-2007-6568 | PHP remote file inclusion vulnerability in config.inc.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path_escape parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.27% | 28 December 2007 |
| CVE-2007-6567 | Directory traversal vulnerability in index.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.4EPSS 7.02% | 28 December 2007 |
| CVE-2007-6566 | SQL injection vulnerability in post.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary SQL commands via the subcatid parameter to index.php. | EXPLOIT ✓HIGH 7.5EPSS 2.38% | 28 December 2007 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.