Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
398,576 CVEs1,728 in CISA KEV17,267 with EPSS ≥ 10%25,049 with a public exploitUpdated 28 September 2026
25,049 results · page 322 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2007-5174 | Directory traversal vulnerability in phpinc/news.php in actSite 1.56 allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 3.03% | 3 October 2007 |
| CVE-2007-5173 | PHP remote file inclusion vulnerability in includes/openid/Auth/OpenID/BBStore.php in phpBB Openid 0.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the openid_root_path parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 2.80% | 3 October 2007 |
| CVE-2007-5082 | Multiple stack-based buffer overflows in Computer Associates (CA) BrightStor Hierarchical Storage Manager (HSM) before r11.6 allow remote attackers to execute arbitrary code via unspecified CsAgent service commands with certain opcodes, related to… | EXPLOIT ×2 ✓HIGH 10.0EPSS 63.5% | 1 October 2007 |
| CVE-2007-5003 | Multiple stack-based buffer overflows in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 allow remote attackers to execute arbitrary code via a long (1) username or (2) password to the rxrLogin command in… | EXPLOIT ✓HIGH 10.0EPSS 67.2% | 1 October 2007 |
| CVE-2007-5158 | The focus handling for the onkeydown event in Microsoft Internet Explorer 6.0 allows remote attackers to change field focus and copy keystrokes via a certain use of a JavaScript htmlFor attribute, as demonstrated by changing focus from a textarea to a… | EXPLOIT ✓MEDIUM 4.3EPSS 15.0% | 1 October 2007 |
| CVE-2007-5157 | PHP remote file inclusion vulnerability in phfito-post.php in Alex Kocharin PHP Fidonet Tosser (PhFiTo) 1.3.0 in phpFidoNode allows remote attackers to execute arbitrary PHP code via a URL in the SRC_PATH parameter to phfito-post. | EXPLOIT ✓MEDIUM 6.8EPSS 2.37% | 1 October 2007 |
| CVE-2007-5156 | Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP… | EXPLOIT ×2 ✓HIGH 7.5EPSS 8.00% | 1 October 2007 |
| CVE-2007-5149 | PHP remote file inclusion vulnerability in NewsCMS/news/newstopic_inc.php in North Country Public Radio Public Media Manager (PMM) 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the indir parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 3.01% | 1 October 2007 |
| CVE-2007-5142 | Cross-site scripting (XSS) vulnerability in buscar.asp in Solidweb Novus 1.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.20% | 28 September 2007 |
| CVE-2007-5140 | PHP remote file inclusion vulnerability in includes/archive/archive_topic.php in IntegraMOD Nederland 1.4.2 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 2.37% | 28 September 2007 |
| CVE-2007-5139 | PHP remote file inclusion vulnerability in admin/include/header.php in chupix 0.2.3, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the repertoire parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 2.07% | 28 September 2007 |
| CVE-2007-5138 | PHP remote file inclusion vulnerability in forum/forum.php in lustig.cms BETA 2.5 allows remote attackers to execute arbitrary PHP code via a URL in the view parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 2.07% | 28 September 2007 |
| CVE-2007-4880 | Buffer overflow in the Client Acceptor Daemon (CAD), dsmcad.exe, in certain IBM Tivoli Storage Manager (TSM) clients 5.1 before 5.1.8.1, 5.2 before 5.2.5.2, 5.3 before 5.3.5.3, and 5.4 before 5.4.1.2 allows remote attackers to execute arbitrary code via… | EXPLOIT ×2 ✓HIGH 10.0EPSS 75.9% | 28 September 2007 |
| CVE-2007-5133 | Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service (CPU consumption) via a certain PNG file with a large tEXt chunk that possibly triggers an integer overflow in PNG chunk size handling, as… | EXPLOIT ✓HIGH 7.1EPSS 22.9% | 27 September 2007 |
| CVE-2007-5131 | SQL injection vulnerability in index.php in Interspire ActiveKB NX 2.x allows remote attackers to execute arbitrary SQL commands via the catId parameter in a browse action. | EXPLOIT ✓HIGH 7.5EPSS 1.17% | 27 September 2007 |
| CVE-2007-5127 | Multiple cross-site scripting (XSS) vulnerabilities in SimpGB 1.46.02 allow remote attackers to inject arbitrary web script or HTML via (1) the l_username parameter to the default URI under admin/ or (2) the l_emoticonlist parameter to… | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.93% | 27 September 2007 |
| CVE-2007-5125 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. | EXPLOIT ✓UnscoredEPSS — | 27 September 2007 |
| CVE-2007-5123 | SQL injection vulnerability in notas.asp in Novus 1.0 allows remote attackers to execute arbitrary SQL commands via the nota_id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.02% | 27 September 2007 |
| CVE-2007-5122 | SQL injection vulnerability in store_info.php in SoftBiz Classifieds PLUS allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 27 September 2007 |
| CVE-2007-5120 | Multiple cross-site scripting (XSS) vulnerabilities in JSPWiki 2.4.103 and 2.5.139-beta allow remote attackers to inject arbitrary web script or HTML via the (1) group and (2) members parameters in (a) NewGroup.jsp; the (3) edittime parameter in (b)… | EXPLOIT ×6 ✓MEDIUM 4.3EPSS 2.36% | 27 September 2007 |
| CVE-2007-5117 | Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.13, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_to_root parameter to (1) access/login.php and (2)… | EXPLOIT ✓HIGH 9.3EPSS 3.55% | 27 September 2007 |
| CVE-2007-4993 | pygrub (tools/pygrub/src/GrubConf.py) in Xen 3.0.3, when booting a guest domain, allows local users with elevated privileges in the guest domain to execute arbitrary commands in domain 0 via a crafted grub.conf file whose contents are used in exec… | EXPLOIT ✓MEDIUM 6.9EPSS 0.63% | 27 September 2007 |
| CVE-2007-5113 | report.cgi in Google Urchin allows remote attackers to bypass authentication and obtain sensitive information (web server logs) via certain modified query parameters, as demonstrated using the profile, rid, prefs, n, vid, bd, ed, dt, and gtype… | EXPLOIT ✓MEDIUM 5.0EPSS 2.98% | 26 September 2007 |
| CVE-2007-5112 | Cross-site scripting (XSS) vulnerability in session.cgi (aka the login page) in Google Urchin 5 5.7.03 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, a different vulnerability than CVE-2007-4713. | EXPLOIT ✓MEDIUM 4.3EPSS 2.32% | 26 September 2007 |
| CVE-2007-5111 | A certain ActiveX control in EBCRYPT.DLL 2.0 in EB Design ebCrypt allows remote attackers to cause a denial of service (crash) via a string argument to the AddString method. | EXPLOIT ✓MEDIUM 4.3EPSS 4.33% | 26 September 2007 |
| CVE-2007-5110 | Absolute path traversal vulnerability in the EbCrypt.eb_c_PRNGenerator.1 ActiveX control in EBCRYPT.DLL 2.0.0.2087 and earlier in EB Design ebCrypt allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the… | EXPLOIT ✓HIGH 7.5EPSS 7.20% | 26 September 2007 |
| CVE-2007-5108 | Unspecified vulnerability in IAC Search & Media ask.com toolbar has unknown impact and remote attack vectors. | EXPLOIT ✓HIGH 10.0EPSS 2.50% | 26 September 2007 |
| CVE-2007-5107 | Stack-based buffer overflow in the AskJeevesToolBar.SettingsPlugin.1 ActiveX control in askBar.dll in IAC Search & Media ask.com Ask Toolbar 4.0.2.53 and earlier allows remote attackers to execute arbitrary code via a long ShortFormat property value. | EXPLOIT ×2 ✓HIGH 9.3EPSS 35.9% | 26 September 2007 |
| CVE-2007-5105 | Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 and 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the user_email parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 4.38% | 26 September 2007 |
| CVE-2007-5102 | PHP remote file inclusion vulnerability in config.inc.php in Wordsmith 1.0 RC1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the _path parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 38.6% | 26 September 2007 |
| CVE-2007-5099 | PHP remote file inclusion vulnerability in show.php in David Watters Helplink 0.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the file parameter. | EXPLOIT ✓HIGH 7.5EPSS 53.0% | 26 September 2007 |
| CVE-2007-5098 | Multiple PHP remote file inclusion vulnerabilities in DFD Cart 1.1.4 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the set_depth parameter to (1)… | EXPLOIT ✓MEDIUM 6.8EPSS 46.0% | 26 September 2007 |
| CVE-2007-5094 | Heap-based buffer overflow in iaspam.dll in the SMTP Server in Ipswitch IMail Server 8.01 through 8.11 allows remote attackers to execute arbitrary code via a set of four different e-mail messages with a long boundary parameter in a certain malformed… | EXPLOIT ✓HIGH 7.5EPSS 4.36% | 26 September 2007 |
| CVE-2007-5092 | Directory traversal vulnerability in index.php in the Dance Music module for phpNuke, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 2.30% | 26 September 2007 |
| CVE-2007-5089 | PHP remote file inclusion vulnerability in php-inc/log.inc.php in sk.log 0.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the SKIN_URL parameter. | EXPLOIT ✓HIGH 7.5EPSS 3.46% | 26 September 2007 |
| CVE-2007-4874 | Multiple cross-site scripting (XSS) vulnerabilities in SimpNews 2.41.03 allow remote attackers to inject arbitrary web script or HTML via the (1) l_username parameter to admin/layout2b.php, and the (2) backurl parameter to comment.php. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.82% | 26 September 2007 |
| CVE-2007-4571 | The snd_mem_proc_read function in sound/core/memalloc.c in the Advanced Linux Sound Architecture (ALSA) in the Linux kernel before 2.6.22.8 does not return the correct write size, which allows local users to obtain sensitive information (kernel memory… | EXPLOIT ✓LOW 2.1EPSS 0.76% | 26 September 2007 |
| CVE-2007-5070 | Heap-based buffer overflow in the EasyMailMessagePrinter ActiveX control in emprint.DLL 6.0.1.0 in the Quiksoft EasyMail MessagePrinter Object allows remote attackers to execute arbitrary code via a long string in the first argument to the SetFont method. | EXPLOIT ✓HIGH 10.0EPSS 7.04% | 24 September 2007 |
| CVE-2007-5069 | Directory traversal vulnerability in data/compatible.php in the Nuke Mobile Entertainment 1 addon for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.98% | 24 September 2007 |
| CVE-2007-5068 | SQL injection vulnerability in index.php in phpFullAnnu (PFA) 6.0 allows remote attackers to execute arbitrary SQL commands via the mod parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.04% | 24 September 2007 |
| CVE-2007-5067 | Multiple buffer overflows in iMatix Xitami Web Server 2.5c2 allow remote attackers to execute arbitrary code via a long If-Modified-Since header to (1) xigui32.exe or (2) xitami.exe. | EXPLOIT ×2 ✓HIGH 7.5EPSS 73.2% | 24 September 2007 |
| CVE-2007-5065 | PHP remote file inclusion vulnerability in admin.slideshow1.php in the Flash Slide Show (com_slideshow) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter. | EXPLOIT ✓HIGH 7.5EPSS 42.3% | 24 September 2007 |
| CVE-2007-5064 | Buffer overflow in a certain ActiveX control in Xunlei Web Thunder 5.6.9.344, possibly the DapPlayer ActiveX control in DapPlayer_Now.dll, allows remote attackers to execute arbitrary code via a long first argument to the DownURL2 method. | EXPLOIT ✓MEDIUM 6.8EPSS 3.88% | 24 September 2007 |
| CVE-2007-5063 | Adam Scheinberg Flip 3.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing login credentials via a direct request for var/users.txt. | EXPLOIT ✓MEDIUM 5.0EPSS 6.24% | 24 September 2007 |
| CVE-2007-5062 | account.php in Adam Scheinberg Flip 3.0 and earlier allows remote attackers to create administrative accounts via the un parameter in a register action. | EXPLOIT ✓HIGH 7.5EPSS 2.33% | 24 September 2007 |
| CVE-2007-5061 | SQL injection vulnerability in mods/banners/navlist.php in Clansphere 2007.4 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to index.php in a banners action. | EXPLOIT ✓HIGH 7.5EPSS 1.17% | 24 September 2007 |
| CVE-2007-5060 | Cross-site request forgery (CSRF) vulnerability in the cpass functionality in an admin action in index.php in XCMS allows remote attackers to change arbitrary passwords via certain password_ and rpassword_ parameters, possibly related to timestamp values. | EXPLOIT ✓MEDIUM 4.3EPSS 0.88% | 24 September 2007 |
| CVE-2007-5056 | Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty, allows remote attackers to execute arbitrary code via PHP… | EXPLOIT ×5 ✓MEDIUM 6.8EPSS 27.9% | 24 September 2007 |
| CVE-2007-5055 | Multiple directory traversal vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.41% | 24 September 2007 |
| CVE-2007-5054 | Multiple PHP remote file inclusion vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the gsLanguage parameter to (1) search/search.php, (2) poll/inlinepoll.php, (3) poll/showpoll.php, (4)… | EXPLOIT ✓HIGH 7.5EPSS 42.3% | 24 September 2007 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.