Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
398,554 CVEs1,728 in CISA KEV17,267 with EPSS ≥ 10%25,049 with a public exploitUpdated 28 September 2026
25,049 results · page 315 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2007-6266 | Multiple SQL injection vulnerabilities in bcoos 1.0.10 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the gid parameter to modules/arcade/index.php in a show_stats action, or the lid parameter to (2)… | EXPLOIT ×2 ✓HIGH 7.5EPSS 1.12% | 7 December 2007 |
| CVE-2007-6262 | A certain ActiveX control in axvlc.dll in VideoLAN VLC 0.8.6 before 0.8.6d allows remote attackers to execute arbitrary code via crafted arguments to the (1) addTarget, (2) getVariable, or (3) setVariable function, resulting from a "bad initialized… | EXPLOIT ✓MEDIUM 6.8EPSS 11.1% | 6 December 2007 |
| CVE-2007-6261 | Integer overflow in the load_threadstack function in the Mach-O loader (mach_loader.c) in the xnu kernel in Apple Mac OS X 10.4 through 10.5.1 allows local users to cause a denial of service (infinite loop) via a crafted Mach-O binary. | EXPLOIT ✓MEDIUM 4.9EPSS 0.78% | 6 December 2007 |
| CVE-2007-6240 | SQL injection vulnerability in active.asp in Snitz Forums 2000 3.4.06 allows remote attackers to execute arbitrary SQL commands via the BuildTime parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.02% | 5 December 2007 |
| CVE-2007-6237 | cp.php in DeluxeBB 1.09 does not verify that the membercookie parameter corresponds to the authenticated member during a profile update, which allows remote authenticated users to change the e-mail addresses of arbitrary accounts via a modified… | EXPLOIT ✓HIGH 9.0EPSS 2.74% | 4 December 2007 |
| CVE-2007-6236 | Microsoft Windows Media Player (WMP) allows remote attackers to cause a denial of service (application crash) via a certain AIFF file that triggers a divide-by-zero error, as demonstrated by kr.aiff. | EXPLOIT ✓MEDIUM 5.0EPSS 18.6% | 4 December 2007 |
| CVE-2007-6235 | A certain ActiveX control in RealNetworks RealPlayer 11 allows remote attackers to cause a denial of service (application crash) via a malformed .au file that triggers a divide-by-zero error. | EXPLOIT ✓MEDIUM 5.0EPSS 2.77% | 4 December 2007 |
| CVE-2007-6234 | index.php in FTP Admin 0.1.0 allows remote attackers to bypass authentication and obtain administrative access via a loggedin parameter with a value of true, as demonstrated by adding a user account. | EXPLOIT ✓HIGH 10.0EPSS 4.27% | 4 December 2007 |
| CVE-2007-6233 | Directory traversal vulnerability in index.php in FTP Admin 0.1.0 allows remote authenticated users to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 4.9EPSS 1.91% | 4 December 2007 |
| CVE-2007-6232 | Cross-site scripting (XSS) vulnerability in index.php in FTP Admin 0.1.0 allows remote attackers to inject arbitrary web script or HTML via the error parameter in an error page action. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.55% | 4 December 2007 |
| CVE-2007-6231 | Multiple PHP remote file inclusion vulnerabilities in tellmatic 1.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the tm_includepath parameter to (1) Classes.inc.php, (2) statistic.inc.php, (3) status.inc.php, (4)… | EXPLOIT ✓HIGH 7.5EPSS 3.44% | 4 December 2007 |
| CVE-2007-6230 | Directory traversal vulnerability in common/classes/class_HeaderHandler.lib.php in Rayzz Script 2.0 allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 6.26% | 4 December 2007 |
| CVE-2007-6229 | PHP remote file inclusion vulnerability in common/classes/class_HeaderHandler.lib.php in Rayzz Script 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the CFG[site][project_path] parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.42% | 4 December 2007 |
| CVE-2007-6228 | Stack-based buffer overflow in the Helper class in the yt.ythelper.2 ActiveX control in Yahoo! | EXPLOIT ✓MEDIUM 6.8EPSS 2.11% | 4 December 2007 |
| CVE-2007-6227 | QEMU 0.9.0 allows local users of a Windows XP SP2 guest operating system to overwrite the TranslationBlock (code_gen_buffer) buffer, and probably have unspecified other impacts related to an "overflow," via certain Windows executable programs, as… | EXPLOIT ✓HIGH 7.2EPSS 0.71% | 4 December 2007 |
| CVE-2007-6223 | SQL injection vulnerability in garage.php in phpBB Garage 1.2.0 Beta3 allows remote attackers to execute arbitrary SQL commands via the make_id parameter in a search action in browse mode. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 4 December 2007 |
| CVE-2007-6221 | TuMusika Evolution 1.7R5 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function. | EXPLOIT ✓HIGH 7.8EPSS 2.26% | 4 December 2007 |
| CVE-2007-6218 | Multiple PHP remote file inclusion vulnerabilities in Ossigeno CMS 2.2 pre1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) level parameter to (a) install_module.php and (b) uninstall_module.php in upload/xax/admin/modules/,… | EXPLOIT ×6 ✓MEDIUM 5.0EPSS 4.13% | 4 December 2007 |
| CVE-2007-6217 | Multiple SQL injection vulnerabilities in login.asp in Irola My-Time (aka Timesheet) 3.5 allow remote attackers to execute arbitrary SQL commands via the (1) login (aka Username) and (2) password parameters. | EXPLOIT ✓HIGH 7.5EPSS 1.72% | 4 December 2007 |
| CVE-2007-6215 | Multiple directory traversal vulnerabilities in play.php in Web-MeetMe 3.0.3 allow remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 2.82% | 4 December 2007 |
| CVE-2007-6214 | Directory traversal vulnerability in include/file_download.php in LearnLoop 2.0 beta7 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 4.3EPSS 2.28% | 4 December 2007 |
| CVE-2007-6213 | Multiple directory traversal vulnerabilities in mod/chat/index.php in WebED 0.0.9 allow remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 6.75% | 4 December 2007 |
| CVE-2007-6212 | Directory traversal vulnerability in region.php in KML share 1.1 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 1.48% | 4 December 2007 |
| CVE-2007-6211 | Send ICMP Nasty Garbage (sing) on Debian GNU/Linux allows local users to append to arbitrary files and gain privileges via the -L (output log file) option. | EXPLOIT ✓HIGH 7.2EPSS 0.89% | 4 December 2007 |
| CVE-2007-6210 | zabbix_agentd 1.1.4 in ZABBIX before 1.4.3 runs "UserParameter" scripts with gid 0, which might allow local users to gain privileges. | EXPLOIT ✓LOW 2.1EPSS 0.78% | 4 December 2007 |
| CVE-2007-6203 | Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web… | EXPLOIT ✓MEDIUM 4.3EPSS 80.7% | 3 December 2007 |
| CVE-2007-6202 | SQL injection vulnerability in plugins/search/search.php in Neocrome Seditio CMS 121 and earlier allows remote attackers to execute arbitrary SQL commands via the pag_sub[] parameter to plug.php. | EXPLOIT ✓MEDIUM 6.8EPSS 2.22% | 1 December 2007 |
| CVE-2007-6198 | portal/server.pt in the Plumtree portal in BEA AquaLogic Interaction 5.0.2 through 5.0.4 and 6.0.1.218452 allows wildcards in advanced searches for usernames, which allows remote attackers to enumerate valid usernames via the in_tx_fulltext parameter. | EXPLOIT ✓MEDIUM 5.0EPSS 7.04% | 1 December 2007 |
| CVE-2007-6191 | Multiple PHP remote file inclusion vulnerabilities in Armin Burger p.mapper 3.2.0 beta3 allow remote attackers to execute arbitrary PHP code via a URL in the _SESSION[PM_INCPHP] parameter to (1) incphp/globals.php or (2) plugins/export/mc_table.php. | EXPLOIT ×2 ✓MEDIUM 6.8EPSS 2.19% | 30 November 2007 |
| CVE-2007-6189 | A certain ActiveX control in (1) OScan8.ocx and (2) Oscan81.ocx in BitDefender Online Anti-Virus Scanner 8.0 allows remote attackers to execute arbitrary code via a long argument to the InitX method that begins with a "%%" sequence, which is… | EXPLOIT ✓HIGH 9.3EPSS 8.08% | 30 November 2007 |
| CVE-2007-6188 | Multiple directory traversal vulnerabilities in TuMusika Evolution 1.7R5 allow remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 3.98% | 30 November 2007 |
| CVE-2007-6187 | Multiple directory traversal vulnerabilities in PHP Content Architect (aka NoAh) 0.9 pre 1.2 and earlier allow remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 3.48% | 30 November 2007 |
| CVE-2007-6185 | Directory traversal vulnerability in users/files.php in Eurologon CMS allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓HIGH 7.5EPSS 7.39% | 30 November 2007 |
| CVE-2007-6184 | Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.54% | 30 November 2007 |
| CVE-2007-6182 | The responder program in ISPsystem ISPmanager (aka ISPmgr) 4.2.15.1 allows local users to gain privileges via shell metacharacters in command line arguments. | EXPLOIT ✓HIGH 7.2EPSS 0.87% | 30 November 2007 |
| CVE-2007-6179 | Multiple PHP remote file inclusion vulnerabilities in Charray's CMS 0.9.3 allow remote attackers to execute arbitrary PHP code via a URL in the ccms_library_path parameter to (1) markdown.php and (2) gallery.php in decoder/. | EXPLOIT ✓HIGH 7.5EPSS 7.79% | 30 November 2007 |
| CVE-2007-6178 | Multiple PHP remote file inclusion vulnerabilities in Easy Hosting Control Panel for Ubuntu (EHCP) 0.22.8 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the confdir parameter to (1) dbutil.bck.php and (2) dbutil.php in… | EXPLOIT ✓HIGH 7.5EPSS 2.44% | 30 November 2007 |
| CVE-2007-6177 | PHP remote file inclusion vulnerability in Exchange/include.php in PHP_CON 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the webappcfg[APPPATH] parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.66% | 30 November 2007 |
| CVE-2007-6176 | kb_whois.cgi in K+B-Bestellsystem (aka KB-Bestellsystem) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) domain or (2) tld parameter in a check_owner action. | EXPLOIT ✓HIGH 10.0EPSS 4.58% | 30 November 2007 |
| CVE-2007-6173 | Cross-site scripting (XSS) vulnerability in c/portal/login in Liferay Enterprise Portal 4.3.1 allows remote attackers to inject arbitrary web script or HTML via the emailAddress parameter in a Send New Password action, a different vector than… | EXPLOIT ✓MEDIUM 4.3EPSS 2.31% | 30 November 2007 |
| CVE-2007-6172 | Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) viewimage.php and (2) comments.php. | EXPLOIT ✓HIGH 10.0EPSS 1.59% | 30 November 2007 |
| CVE-2007-6166 | Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long… | EXPLOIT ×8 ✓HIGH 9.3EPSS 41.9% | 29 November 2007 |
| CVE-2007-6165 | Mail in Apple Mac OS X Leopard (10.5.1) allows user-assisted remote attackers to execute arbitrary code via an AppleDouble attachment containing an apparently-safe file type and script in a resource fork, which does not warn the user that a separate… | EXPLOIT ×2 ✓HIGH 9.3EPSS 44.7% | 29 November 2007 |
| CVE-2007-6164 | Multiple SQL injection vulnerabilities in Eurologon CMS allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) reviews.php, (2) links.php and (3) articles.php. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 29 November 2007 |
| CVE-2007-6163 | SQL injection vulnerability in admin/index2.asp in GOUAE DWD Realty allows remote attackers to execute arbitrary SQL commands via the pword (aka Password) parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 29 November 2007 |
| CVE-2007-6162 | Cross-site scripting (XSS) vulnerability in index.php in FMDeluxe 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a category action. | EXPLOIT ✓MEDIUM 4.3EPSS 1.51% | 29 November 2007 |
| CVE-2007-6160 | Cross-site scripting (XSS) vulnerability in index.php in Tilde CMS 4.x and earlier allows remote attackers to inject arbitrary web script or HTML via the aarstal parameter in a yeardetail action. | EXPLOIT ✓MEDIUM 4.3EPSS 1.46% | 29 November 2007 |
| CVE-2007-6159 | SQL injection vulnerability in index.php in Tilde CMS 4.x and earlier allows remote attackers to execute arbitrary SQL commands via the aarstal parameter in a yeardetail action, a different vector than CVE-2006-1500. | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 29 November 2007 |
| CVE-2007-6158 | Multiple SQL injection vulnerabilities in caladmin.inc.php in Proverbs Web Calendar 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) loginname (aka Username) and (2) loginpass (aka Password) parameters to caladmin.php. | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 29 November 2007 |
| CVE-2007-6157 | Cross-site scripting (XSS) vulnerability in index.php in SimpleGallery 0.1.3 allows remote attackers to inject arbitrary web script or HTML via the album parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.45% | 29 November 2007 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.