Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
398,567 CVEs1,728 in CISA KEV17,267 with EPSS ≥ 10%25,049 with a public exploitUpdated 28 September 2026
25,049 results · page 319 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2007-2983 | Multiple buffer overflows in the British Telecommunications Consumer webhelper ActiveX control before 2.0.0.8 in btwebcontrol.dll allow remote attackers to execute arbitrary code via unspecified vectors. | EXPLOIT ✓HIGH 9.3EPSS 8.76% | 25 October 2007 |
| CVE-2007-5679 | SQL injection vulnerability in index.php in DeeEmm.com DM CMS 0.7.0.Beta allows remote attackers to execute arbitrary SQL commands via the id parameter in the media page (build_media_content.php). | EXPLOIT ✓HIGH 7.5EPSS 1.18% | 25 October 2007 |
| CVE-2007-5677 | Cross-site scripting (XSS) vulnerability in shoutbox/blocco.php in Hackish BETA 1.1 allows remote attackers to inject arbitrary web script or HTML via the go_shout parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.47% | 24 October 2007 |
| CVE-2007-5676 | PHP remote file inclusion vulnerability in modules/Forums/favorites.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary PHP code via a URL in the nuke_bb_root_path parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 2.29% | 24 October 2007 |
| CVE-2007-5674 | Directory traversal vulnerability in index.php in InstaGuide Weather (aka Weather for PHP) 1.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 2.10% | 24 October 2007 |
| CVE-2007-5654 | LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed by a new extension, as demonstrated by reading PHP source code via requests for .php%00.txt files, aka "Mime… | EXPLOIT ✓MEDIUM 5.0EPSS 41.1% | 23 October 2007 |
| CVE-2007-5653 | The Component Object Model (COM) functions in PHP 5.x on Windows do not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by executing objects with the kill bit… | EXPLOIT ✓HIGH 9.3EPSS 4.82% | 23 October 2007 |
| CVE-2007-5650 | Directory traversal vulnerability in system.php in ReloadCMS 1.2.7 allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.37% | 23 October 2007 |
| CVE-2007-5649 | Cross-site scripting (XSS) vulnerability in lostpwd.php in Creative Digital Resources SocketMail 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the lost_id parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.52% | 23 October 2007 |
| CVE-2007-5648 | Multiple cross-site scripting (XSS) vulnerabilities in rnote.php in rNote 0.9.7.5 allow remote attackers to inject arbitrary web script or HTML via the (1) d or the (2) u parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.45% | 23 October 2007 |
| CVE-2007-5647 | Multiple cross-site scripting (XSS) vulnerabilities in SocketKB 1.1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) art_id or (2) node parameter in an article action to the default URI. | EXPLOIT ✓MEDIUM 4.3EPSS 1.48% | 23 October 2007 |
| CVE-2007-5646 | SQL injection vulnerability in Sources/Search.php in Simple Machines Forum (SMF) 1.1.3, when MySQL 5 is used, allows remote attackers to execute arbitrary SQL commands via the userspec parameter in a search2 action to index.php. | EXPLOIT ✓MEDIUM 6.8EPSS 2.99% | 23 October 2007 |
| CVE-2007-5644 | Lussumo Vanilla 1.1.3 and earlier does not require admin privileges for (1) ajax/sortcategories.php and (2) ajax/sortroles.php, which allows remote attackers to conduct unauthorized sort operations and other activities. | EXPLOIT ✓HIGH 7.5EPSS 2.13% | 23 October 2007 |
| CVE-2007-5643 | Multiple SQL injection vulnerabilities in Lussumo Vanilla 1.1.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the CategoryID parameter to ajax/sortcategories.php or (2) an unspecified vector to ajax/sortroles.php. | EXPLOIT ✓HIGH 7.5EPSS 1.21% | 23 October 2007 |
| CVE-2007-5642 | Multiple directory traversal vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 6.22% | 23 October 2007 |
| CVE-2007-5641 | Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the full_path parameter to (1) certinfo/index.php, (2) emails/index.php, (3)… | EXPLOIT ✓MEDIUM 6.8EPSS 40.3% | 23 October 2007 |
| CVE-2007-5637 | The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other product lines allow remote attackers to eavesdrop on the physical environment via an Open Audio… | EXPLOIT ✓MEDIUM 4.3EPSS 3.13% | 23 October 2007 |
| CVE-2007-5636 | Buffer overflow in the Nortel UNIStim IP Softphone 2050 allows remote attackers to cause a denial of service (application abort) and possibly execute arbitrary code via a flood of invalid characters to the RTCP port (5678/udp) that triggers a Windows… | EXPLOIT ✓HIGH 7.5EPSS 6.69% | 23 October 2007 |
| CVE-2007-5633 | Speedfan.sys in Alfredo Milani Comparetti SpeedFan 4.33, when used on Microsoft Windows Vista x64, allows local users to read or write arbitrary MSRs, and gain privileges and load unsigned drivers, via the (1) IOCTL_RDMSR 0x9C402438 and (2) IOCTL_WRMSR… | EXPLOIT ✓HIGH 7.2EPSS 0.94% | 23 October 2007 |
| CVE-2007-5631 | Multiple PHP remote file inclusion vulnerabilities in PeopleAggregator 1.2pre6, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the current_blockmodule_path parameter to (1)… | EXPLOIT ✓MEDIUM 6.8EPSS 39.4% | 23 October 2007 |
| CVE-2007-5630 | SQL injection vulnerability in tnews.php in BBsProcesS BBPortalS 1.5.10 through 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a tnews action. | EXPLOIT ✓HIGH 7.5EPSS 1.15% | 23 October 2007 |
| CVE-2007-5628 | PHP remote file inclusion vulnerability in src/scripture.php in The Online Web Library Site (TOWels) 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the pageHeaderFile parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 27.8% | 23 October 2007 |
| CVE-2007-5627 | PHP remote file inclusion vulnerability in content/fnc-readmail3.php in SocketMail 2.2.8 allows remote attackers to execute arbitrary PHP code via a URL in the __SOCKETMAIL_ROOT parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 2.07% | 23 October 2007 |
| CVE-2007-5625 | Cross-site scripting (XSS) vulnerability in filename.asp in ASP Site Search SearchSimon Lite 1.0 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 3.39% | 23 October 2007 |
| CVE-2007-5620 | Directory traversal vulnerability in admin/inc/help.php in ZZ:FlashChat 3.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 6.27% | 22 October 2007 |
| CVE-2007-5190 | Multiple cross-site scripting (XSS) vulnerabilities in Alcatel OmniVista 4760 R4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the action parameter to php-bin/Webclient.php or (2) the Langue parameter to the default… | EXPLOIT ✓MEDIUM 4.3EPSS 1.99% | 22 October 2007 |
| CVE-2007-5601 | Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and earlier versions including 10, RealOne Player, and RealOne Player 2, allows remote attackers to execute arbitrary code via certain… | EXPLOIT ×2 ✓HIGH 9.3EPSS 42.4% | 20 October 2007 |
| CVE-2007-5600 | Incomplete blacklist vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to execute arbitrary PHP code via a (1) UNC share pathname, or a (2) ftps, (3) ssh2.sftp, or (4) ssh2.scp URL, in the page parameter, for which PHP… | EXPLOIT ✓MEDIUM 6.8EPSS 1.88% | 19 October 2007 |
| CVE-2007-5592 | Multiple PHP remote file inclusion vulnerabilities in awzMB 4.2 beta 1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the Setting[OPT_includepath] parameter to (1) adminhelp.php; and (2) admin.incl.php, (3) reg.incl.php,… | EXPLOIT ✓MEDIUM 6.8EPSS 28.7% | 19 October 2007 |
| CVE-2007-5589 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in (1) PHP_SELF in (a) server_status.php, and (b) grab_globals.lib.php, (c)… | EXPLOIT ✓MEDIUM 4.3EPSS 3.33% | 19 October 2007 |
| CVE-2007-5587 | Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0, as shipped in Microsoft Windows XP SP2, XP Professional x64 and x64 SP2, Server 2003 SP1 and SP2, and Server 2003 x64 and x64 SP2 allows local users to overwrite arbitrary memory… | EXPLOIT ✓MEDIUM 6.9EPSS 2.90% | 19 October 2007 |
| CVE-2007-5579 | login.php in Pligg CMS 9.5 uses a guessable confirmation code when resetting a forgotten password, which allows remote attackers with knowledge of a username to reset that user's password by calculating the confirmationcode parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.35% | 18 October 2007 |
| CVE-2007-5574 | PHP remote file inclusion vulnerability in djpage.php in PHPDJ 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 27.6% | 18 October 2007 |
| CVE-2007-5573 | PHP remote file inclusion vulnerability in classes/core/language.php in LimeSurvey 1.5.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 2.57% | 18 October 2007 |
| CVE-2007-5567 | PHP remote file inclusion vulnerability in _lib/fckeditor/upload_config.php in Galmeta Post 0.11 allows remote attackers to execute arbitrary PHP code via a URL in the DDS parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.28% | 18 October 2007 |
| CVE-2007-5562 | Cross-site scripting (XSS) vulnerability in cgi-bin/welcome (aka the login page) in Netgear SSL312 PROSAFE SSL VPN-Concentrator 25 allows remote attackers to inject arbitrary web script or HTML via the err parameter in the context of an error page. | EXPLOIT ✓MEDIUM 4.3EPSS 1.79% | 18 October 2007 |
| CVE-2007-5511 | SQL injection vulnerability in Workspace Manager for Oracle Database before OWM 10.2.0.4.1, OWM 10.1.0.8.0, and OWM 9.2.0.8.0 allows attackers to execute arbitrary SQL commands via the FINDRICSET procedure in the LT package. | EXPLOIT ×3 ✓MEDIUM 6.5EPSS 31.8% | 17 October 2007 |
| CVE-2007-5508 | Multiple SQL injection vulnerabilities in the CTXSYS Intermedia application for the Oracle Text component (CTX_DOC) in Oracle Database 10.1.0.5 and 10.2.0.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) THEMES, (2) GIST,… | EXPLOIT ✓MEDIUM 6.5EPSS 5.16% | 17 October 2007 |
| CVE-2007-5488 | Multiple SQL injection vulnerabilities in cdr_addon_mysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the (1) source and (2) destination numbers, and probably (3) SIP URI, when… | EXPLOIT ✓HIGH 7.5EPSS 2.71% | 17 October 2007 |
| CVE-2007-5490 | SQL injection vulnerability in default.asp in Okul Otomasyon Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 17 October 2007 |
| CVE-2007-5489 | Directory traversal vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.33% | 17 October 2007 |
| CVE-2007-5487 | Stack-based buffer overflow in COWON America jetAudio Basic 7.0.3 allows user-assisted remote attackers to execute arbitrary code via a long URL in an EXTM3U section of a .m3u file. | EXPLOIT ✓HIGH 9.3EPSS 5.76% | 16 October 2007 |
| CVE-2007-5485 | SQL injection vulnerability in index.php in the mg2 1.0 module for KwsPHP allows remote attackers to execute arbitrary SQL commands via the album parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 16 October 2007 |
| CVE-2007-5484 | Directory traversal vulnerability in wxis.exe in WWWISIS 7.1 allows local users to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 2.90% | 16 October 2007 |
| CVE-2007-5480 | Multiple cross-site scripting (XSS) vulnerabilities in InnovaAge InnovaShop allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter to msg.jsp, and the (2) contentid parameter to tc/contents/home001.jsp. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.76% | 16 October 2007 |
| CVE-2007-5478 | Cross-site scripting (XSS) vulnerability in projects in Nabh Stringbeans Portal (sbportal) 3.2 allows remote attackers to inject arbitrary web script or HTML via the project_name parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.51% | 16 October 2007 |
| CVE-2007-5467 | Integer overflow in eXtremail 2.1.1 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long USER command containing "%s" sequences to the pop3 port (110/tcp), which are expanded to "%%s" before… | EXPLOIT ×4 ✓HIGH 10.0EPSS 13.5% | 15 October 2007 |
| CVE-2007-5466 | Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending multiple long strings to the IMAP port (143/tcp); (2) execute arbitrary code via a long string in an IMAP AUTHENTICATE PLAIN action,… | EXPLOIT ×3 ✓HIGH 10.0EPSS 19.9% | 15 October 2007 |
| CVE-2007-5465 | Directory traversal vulnerability in doop CMS 1.3.7 and earlier allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.49% | 15 October 2007 |
| CVE-2007-5464 | Stack-based buffer overflow in Live for Speed 0.5X10 and earlier allows remote authenticated users to cause a denial of service (client crash) and possibly execute arbitrary code via a long skin name. | EXPLOIT ✓MEDIUM 6.5EPSS 4.35% | 15 October 2007 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.