Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
398,554 CVEs1,728 in CISA KEV17,267 with EPSS ≥ 10%25,049 with a public exploitUpdated 28 September 2026
25,049 results · page 316 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2007-6147 | Multiple PHP remote file inclusion vulnerabilities in IAPR COMMENCE 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the (a) php_root_path and sometimes the (b) privilege_root_path parameter to various PHP scripts under (1)… | EXPLOIT ✓MEDIUM 6.8EPSS 1.99% | 27 November 2007 |
| CVE-2007-6141 | Cross-site scripting (XSS) vulnerability in vBTube.php in vBTube 1.1 Beta allows remote attackers to inject arbitrary web script or HTML via the search parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.46% | 27 November 2007 |
| CVE-2007-6139 | PHP remote file inclusion vulnerability in index.php in Mp3 ToolBox 1.0 beta 5 allows remote attackers to execute arbitrary PHP code via a URL in the skin_file parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 2.07% | 27 November 2007 |
| CVE-2007-6138 | SQL injection vulnerability in redir.asp in VU Mass Mailer allows remote attackers to execute arbitrary SQL commands via the password parameter to Default.asp (aka the Login Page). | EXPLOIT ✓HIGH 7.5EPSS 1.14% | 27 November 2007 |
| CVE-2007-6137 | SQL injection vulnerability in news.php in Content Injector 1.52 allows remote attackers to execute arbitrary SQL commands via the cat parameter to index.php. | EXPLOIT ✓HIGH 7.5EPSS 1.20% | 27 November 2007 |
| CVE-2007-6136 | Multiple cross-site scripting (XSS) vulnerabilities in index.php in M2Scripts MySpace Scripts Poll Creator allow remote attackers to inject arbitrary web script or HTML via the (1) title, (2) intro, and (3) question parameters, and (4) unspecified… | EXPLOIT ✓MEDIUM 4.3EPSS 1.51% | 27 November 2007 |
| CVE-2007-6135 | Cross-site scripting (XSS) vulnerability in phpslideshow.php in PHPSlideShow 0.9.9.2, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the directory parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 2.22% | 27 November 2007 |
| CVE-2007-6134 | SQL injection vulnerability in pkinc/public/article.php in PHPKIT 1.6.4pl1 allows remote attackers to execute arbitrary SQL commands via the contentid parameter in an article action to include.php, a different vector than CVE-2006-1773. | EXPLOIT ✓HIGH 7.5EPSS 1.09% | 27 November 2007 |
| CVE-2007-6133 | PHP remote file inclusion vulnerability in admin/kfm/initialise.php in DevMass Shopping Cart 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the kfm_base_path parameter. | EXPLOIT ✓MEDIUM 5.8EPSS 2.88% | 27 November 2007 |
| CVE-2007-6129 | Directory traversal vulnerability in scripts/include/show_content.php in Amber Script 1.0 allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 5.8EPSS 3.22% | 26 November 2007 |
| CVE-2007-6128 | SQL injection vulnerability in events.php in WorkingOnWeb 2.0.1400 allows remote attackers to execute arbitrary SQL commands via the idevent parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 26 November 2007 |
| CVE-2007-6127 | Multiple SQL injection vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the year parameter to (1) view.page.inc.php, which is reachable through a view action to index.php; or (2) the year… | EXPLOIT ✓HIGH 7.5EPSS 1.02% | 26 November 2007 |
| CVE-2007-6126 | Multiple cross-site scripting (XSS) vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the year parameter to (1) xml/index.php; or (2) the year parameter to view.page.inc.php, which is… | EXPLOIT ✓MEDIUM 4.3EPSS 1.73% | 26 November 2007 |
| CVE-2007-6125 | SQL injection vulnerability in search_form.php in Softbiz Freelancers Script 1 allows remote attackers to execute arbitrary SQL commands via the sb_protype parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.50% | 26 November 2007 |
| CVE-2007-6124 | Cross-site scripting (XSS) vulnerability in signin.php in Softbiz Freelancers Script 1 allows remote attackers to inject arbitrary web script or HTML via the errmsg parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 2.00% | 26 November 2007 |
| CVE-2007-6113 | Integer signedness error in the DNP3 dissector in Wireshark (formerly Ethereal) 0.10.12 to 0.99.6 allows remote attackers to cause a denial of service (long loop) via a malformed DNP3 packet. | EXPLOIT ✓MEDIUM 4.3EPSS 6.96% | 23 November 2007 |
| CVE-2007-6110 | Cross-site scripting (XSS) vulnerability in htsearch in htdig 3.2.0b6 allows remote attackers to inject arbitrary web script or HTML via the sort parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 4.39% | 23 November 2007 |
| CVE-2007-6106 | SQL injection vulnerability in index.php in AlstraSoft E-Friends 4.98 and earlier allows remote attackers to execute arbitrary SQL commands via the seid parameter in a viewevent action. | EXPLOIT ✓HIGH 7.5EPSS 1.41% | 23 November 2007 |
| CVE-2007-6105 | Multiple PHP remote file inclusion vulnerabilities in TalkBack 2.2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) language_file parameter to (a) comments-display-tpl.php and (b)… | EXPLOIT ✓MEDIUM 6.8EPSS 6.72% | 23 November 2007 |
| CVE-2007-6103 | I Hear U (IHU) 0.5.6 and earlier allows remote attackers to cause (1) a denial of service (infinite loop) via a packet that contains zero in the size field in its header, which is improperly handled by the Receiver::processPacket function; and (2) a… | EXPLOIT ✓MEDIUM 5.0EPSS 4.96% | 23 November 2007 |
| CVE-2007-6091 | Multiple SQL injection vulnerabilities in files/login.asp in JiRo's Banner System (JBS) 2.0, and possibly JiRo's Upload Manager (aka JiRo's Upload System or JUS), allow remote attackers to execute arbitrary SQL commands via the (1) Username (aka Login… | EXPLOIT ✓HIGH 7.5EPSS 2.26% | 22 November 2007 |
| CVE-2007-6089 | PHP remote file inclusion vulnerability in index.php in meBiblio 0.4.5 allows remote attackers to execute arbitrary PHP code via a URL in the action parameter. | EXPLOIT ✓HIGH 9.3EPSS 4.60% | 22 November 2007 |
| CVE-2007-6088 | PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBBViet 02.03.07 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. | EXPLOIT ✓HIGH 9.3EPSS 6.83% | 22 November 2007 |
| CVE-2007-6087 | Cross-site request forgery (CSRF) vulnerability in index.php in VigileCMS 1.4 allows remote attackers to change the admin password via certain parameters to the changepass module. | EXPLOIT ✓MEDIUM 6.8EPSS 0.99% | 22 November 2007 |
| CVE-2007-6086 | Directory traversal vulnerability in index.php in VigileCMS 1.4 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the module parameter. | EXPLOIT ✓HIGH 9.3EPSS 2.94% | 22 November 2007 |
| CVE-2007-6085 | Multiple cross-site scripting (XSS) vulnerabilities in index.php in VigileCMS 1.4 allow remote attackers to inject arbitrary web script or HTML via the message field in the (1) vedipm or (2) live_chat module. | EXPLOIT ✓MEDIUM 4.3EPSS 1.52% | 22 November 2007 |
| CVE-2007-6084 | SQL injection vulnerability in software-description.php in HotScripts Clone Script allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 22 November 2007 |
| CVE-2007-6083 | SQL injection vulnerability in admin/index.php in IceBB 1.0-rc6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header. | EXPLOIT ✓HIGH 7.5EPSS 1.96% | 22 November 2007 |
| CVE-2007-6082 | Direct static code injection vulnerability in acp/savenews.php in Sciurus Hosting Panel, possibly 2.0.3, allows remote attackers to inject arbitrary PHP code via the filecontents parameter, which can be executed by accessing includes/news.php. | EXPLOIT ✓HIGH 9.3EPSS 3.64% | 22 November 2007 |
| CVE-2007-6080 | SQL injection vulnerability in modules/banners/click.php in the banners module for bcoos 1.0.10 allows remote attackers to execute arbitrary SQL commands via the bid parameter. | EXPLOIT ×2 ✓HIGH 7.5EPSS 1.22% | 21 November 2007 |
| CVE-2007-6079 | Directory traversal vulnerability in include/common.php in bcoos 1.0.10 allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 1.88% | 21 November 2007 |
| CVE-2007-6078 | Multiple SQL injection vulnerabilities in SkyPortal RC6 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) nc_top.asp; (2) inc_bookmarks.asp, possibly involving a parameter passed from cp_main.asp; (3)… | EXPLOIT ✓HIGH 7.5EPSS 1.35% | 21 November 2007 |
| CVE-2007-6058 | Multiple SQL injection vulnerabilities in index.php in ProfileCMS 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) codes action in the profile-codes module, (2) videos action in the video-codes… | EXPLOIT ✓HIGH 7.5EPSS 1.23% | 20 November 2007 |
| CVE-2007-6057 | PHP remote file inclusion vulnerability in index.php in datecomm Social Networking Script (aka Myspace Clone Script) allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 5.79% | 20 November 2007 |
| CVE-2007-6056 | frame.html in Aida-Web (Aida Web) allows remote attackers to bypass a protection mechanism and obtain comment and task details via modified values to the (1) Mehr and (2) SUPER parameters. | EXPLOIT ✓MEDIUM 5.0EPSS 2.78% | 20 November 2007 |
| CVE-2007-6055 | Cross-site scripting (XSS) vulnerability in c/portal/login in Liferay Portal 4.1.0 and 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the login parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 2.89% | 20 November 2007 |
| CVE-2007-6054 | Cross-site scripting (XSS) vulnerability in the login page in the management interface in the Aruba 800 Mobility Controller 2.5.4.18 and earlier, and 2.4.8.6-FIPS and earlier, allows remote attackers to inject arbitrary web script or HTML via the… | EXPLOIT ✓MEDIUM 4.3EPSS 2.36% | 20 November 2007 |
| CVE-2007-6041 | Buffer overflow in the Sequencer::queueMessage function in sequencer.cpp in the server in Rigs of Rods (RoR) before 0.33d SP1 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code by sending a nickname,… | EXPLOIT ✓HIGH 7.5EPSS 6.33% | 20 November 2007 |
| CVE-2007-6039 | PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in (1) the domain parameter to the dgettext function, the message parameter to the (2) dcgettext or (3) gettext function, the… | EXPLOIT ✓LOW 2.1EPSS 1.03% | 20 November 2007 |
| CVE-2007-6038 | PHP remote file inclusion vulnerability in xajax_functions.php in the JUser (com_juser) 1.0.14 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 27.8% | 20 November 2007 |
| CVE-2007-6037 | Cross-site scripting (XSS) vulnerability in ws/generic_api_call.pl in Citrix NetScaler 8.0 build 47.8 allows remote attackers to inject arbitrary web script or HTML via the standalone parameter and other unspecified parameters. | EXPLOIT ✓MEDIUM 4.3EPSS 3.58% | 20 November 2007 |
| CVE-2007-6036 | The parseRTSPRequestString function in LIVE555 Media Server 2007.11.01 and earlier allows remote attackers to cause a denial of service (daemon crash) via a short RTSP query, which causes a negative number to be used during memory allocation. | EXPLOIT ✓HIGH 7.1EPSS 4.41% | 20 November 2007 |
| CVE-2007-6032 | SQL injection vulnerability in calendar/page.asp in Aleris Web Publishing Server 3.0 allows remote attackers to execute arbitrary SQL commands via the mode parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.02% | 20 November 2007 |
| CVE-2007-6028 | Multiple stack-based buffer overflows in the VSFlexGrid.VSFlexGridL ActiveX control in ComponentOne FlexGrid 7.1 Light allow remote attackers to cause a denial of service and possibly execute arbitrary code via a long string in the (1) Text, (2)… | EXPLOIT ✓MEDIUM 6.8EPSS 3.47% | 20 November 2007 |
| CVE-2007-6027 | PHP remote file inclusion vulnerability in admin.jjgallery.php in the Carousel Flash Image Gallery (com_jjgallery) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 2.07% | 20 November 2007 |
| CVE-2007-6026 | Stack-based buffer overflow in Microsoft msjet40.dll 4.0.8618.0 (aka Microsoft Jet Engine), as used by Access 2003 in Microsoft Office 2003 SP3, allows user-assisted attackers to execute arbitrary code via a crafted MDB file database file containing a… | EXPLOIT ✓HIGH 9.3EPSS 28.3% | 20 November 2007 |
| CVE-2007-6005 | Unspecified vulnerability in the GpcContainer.GpcContainer.1 ActiveX control in WebEx allows remote attackers to cause a denial of service (memory access violation and crash) via (1) an invalid argument to the InitParam method or (2) an unspecified… | EXPLOIT ✓MEDIUM 4.3EPSS 2.15% | 15 November 2007 |
| CVE-2007-6004 | Multiple SQL injection vulnerabilities in index.php in Toko Instan 7.6 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in an artikel action or (2) the katid parameter in a produk action. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 15 November 2007 |
| CVE-2007-6003 | Cross-site scripting (XSS) vulnerability in cgi/b/ic/connect in the Thomson SpeedTouch 716 with firmware 5.4.0.14 allows remote attackers to inject arbitrary web script or HTML via the url parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.20% | 15 November 2007 |
| CVE-2007-6001 | Multiple cross-site scripting (XSS) vulnerabilities in index.php in Bandersnatch 0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) func or (2) date parameter, or the jid parameter in a (3) log or (4) user action, a different… | EXPLOIT ✓MEDIUM 4.3EPSS 2.03% | 15 November 2007 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.