Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
398,893 CVEs1,728 in CISA KEV17,272 with EPSS ≥ 10%25,049 with a public exploitUpdated 29 September 2026
25,049 results · page 374 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2006-5514 | SQL injection vulnerability in quiz.php in Web Group Communication Center (WGCC) 0.5.6b and earlier allows remote attackers to execute arbitrary SQL commands via the qzid parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.15% | 26 October 2006 |
| CVE-2006-5512 | Cross-site scripting (XSS) vulnerability in article.htm in Zwahlen Online Shop allows remote attackers to inject arbitrary web script or HTML via the cat parameter. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.71% | 25 October 2006 |
| CVE-2006-5511 | Direct static code injection vulnerability in delete.php in JaxUltraBB (JUBB) 2.0, when register_globals is enabled, allows remote attackers to inject arbitrary web script, HTML, or PHP via the contents parameter, whose value is prepended to the file… | EXPLOIT ✓LOW 2.6EPSS 1.90% | 25 October 2006 |
| CVE-2006-5510 | Directory traversal vulnerability in explorer_load_lang.php in PH Pexplorer 0.24 allows remote attackers to include arbitrary local files via ".." sequences in the Language cookie, as demonstrated by uploading a .gif file that contains PHP code. | EXPLOIT ✓MEDIUM 6.4EPSS 2.92% | 25 October 2006 |
| CVE-2006-5509 | Eval injection vulnerability in addentry.php in WoltLab Burning Book 1.1.2 allows remote attackers to execute arbitrary PHP code via crafted POST requests that store PHP code in a database that is later processed by eval, as demonstrated using SQL… | EXPLOIT ✓HIGH 7.5EPSS 1.25% | 25 October 2006 |
| CVE-2006-5508 | Multiple SQL injection vulnerabilities in addentry.php in WoltLab Burning Book 1.1.2 allow remote attackers to execute arbitrary SQL commands via (1) the n parameter and (2) the User-Agent HTTP header. | EXPLOIT ✓HIGH 7.5EPSS 1.10% | 25 October 2006 |
| CVE-2006-5506 | Multiple PHP remote file inclusion vulnerabilities in WiClear 0.10 allow remote attackers to execute arbitrary PHP code via the path parameter in (1) inc/prepend.inc.php, (2) inc/lib/boxes.lib.php, (3) inc/lib/tools.lib.php, (4)… | EXPLOIT ✓HIGH 7.5EPSS 16.3% | 25 October 2006 |
| CVE-2006-5505 | Multiple PHP file inclusion vulnerabilities in 2BGal 3.0 allow remote attackers to execute arbitrary PHP code via the lang parameter to (1) admin/configuration.inc.php, (2) admin/creer_album.inc.php, (3) admin/changepwd.php.inc, and unspecified other… | EXPLOIT ✓HIGH 7.5EPSS 2.76% | 25 October 2006 |
| CVE-2006-5503 | Cross-site scripting (XSS) vulnerability in index.php in Simple Machines Forum (SMF) 1.1 RC2 allows remote attackers to inject arbitrary web script or HTML via the action parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.68% | 25 October 2006 |
| CVE-2006-5497 | PHP remote file inclusion vulnerability in themes/program/themesettings.inc.php in Segue CMS 1.5.8 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the themesdir parameter. | EXPLOIT ✓HIGH 7.5EPSS 3.29% | 25 October 2006 |
| CVE-2006-5495 | Multiple PHP remote file inclusion vulnerabilities in Trawler Web CMS 1.8.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) path_red2 parameter to (a) _msdazu_pdata/redaktion/artikel/up/index.php; (b) addtort.php,… | EXPLOIT ✓HIGH 7.5EPSS 7.36% | 25 October 2006 |
| CVE-2006-5494 | Multiple PHP remote file inclusion vulnerabilities in modules/My_eGallery/public/displayCategory.php in the pandaBB module for PHP-Nuke allow remote attackers to execute arbitrary PHP code via a URL in the (1) adminpath or (2) basepath parameters. | EXPLOIT ✓HIGH 7.5EPSS 3.16% | 25 October 2006 |
| CVE-2006-5493 | PHP remote file inclusion vulnerability in template/purpletech/base_include.php in DigitalHive 2.0 RC2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. | EXPLOIT ✓HIGH 7.5EPSS 3.27% | 25 October 2006 |
| CVE-2006-5485 | Multiple PHP remote file inclusion vulnerabilities in SpeedBerg 1.2beta1 allow remote attackers to execute arbitrary PHP code via a URL in the SPEEDBERG_PATH parameter to (1) entrancePage.tpl.php, (2) generalToolBox.tlb.php, (3) myToolBox.tlb.php, (4)… | EXPLOIT ✓HIGH 7.5EPSS 2.76% | 24 October 2006 |
| CVE-2006-5483 | p1003_1b.c in FreeBSD 6.1 allows local users to cause an unspecified denial of service by setting a scheduler policy, which should only be settable by root. | EXPLOIT ✓LOW 2.1EPSS 0.67% | 24 October 2006 |
| CVE-2006-5482 | ufs_vnops.c in FreeBSD 6.1 allows local users to cause an unspecified denial of service by calling the ftruncate function on a file type that is not VREG, VLNK or VDIR, which is not defined in POSIX. | EXPLOIT ✓LOW 2.1EPSS 0.66% | 24 October 2006 |
| CVE-2006-5480 | PHP remote file inclusion vulnerability in lib/rs.php in 2le.net Castor PHP Web Builder 1.1.1 allows remote attackers to execute arbitrary PHP code via the rootpath parameter. | EXPLOIT ✓MEDIUM 5.1EPSS 2.60% | 24 October 2006 |
| CVE-2006-5478 | Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e FTF2, allow remote attackers to execute arbitrary code via (1) a long HTTP Host header, which triggers an overflow… | EXPLOIT ×4 ✓HIGH 7.5EPSS 85.1% | 24 October 2006 |
| CVE-2006-5472 | PHP remote file inclusion vulnerability in Softerra PHP Developer Library 1.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the lib_dir parameter in (1) lib/registry.lib.php, (2) lib/sqlcompose.lib.php, and (3)… | EXPLOIT ✓HIGH 7.5EPSS 8.89% | 24 October 2006 |
| CVE-2006-5471 | PHP remote file inclusion vulnerability in example/lib/grid3.lib.php in Softerra PHP Developer Library 1.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the (1) cfg_dir and (2) lib_dir parameters. | EXPLOIT ✓HIGH 7.5EPSS 2.95% | 24 October 2006 |
| CVE-2006-5458 | PHP remote file inclusion vulnerability in common.php in Hinton Design phpht Topsites allows remote attackers to execute arbitrary PHP code via a URL in the phpht_real_path parameter. | EXPLOIT ✓HIGH 7.5EPSS 3.23% | 23 October 2006 |
| CVE-2006-5450 | SQL injection vulnerability in index.asp in Kinesis Interactive Cinema System (KICS) CMS allows remote attackers to execute arbitrary SQL commands via the (1) txtUsername (user) or (2) txtPassword (pass) parameters. | EXPLOIT ✓HIGH 7.5EPSS 1.27% | 23 October 2006 |
| CVE-2006-5446 | SQL injection vulnerability in lobby/config.php in Casinosoft Casino Script (aka Masvet) 3.2 allows remote attackers to execute arbitrary SQL commands via the cfam parameter. | EXPLOIT ✓MEDIUM 5.1EPSS 1.01% | 23 October 2006 |
| CVE-2006-5444 | Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value… | EXPLOIT ✓HIGH 7.5EPSS 86.5% | 23 October 2006 |
| CVE-2006-5436 | PHP remote file inclusion vulnerability in index.php in FreeFAQ 1.0.e allows remote attackers to execute arbitrary PHP code via a URL in the faqpath parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.13% | 20 October 2006 |
| CVE-2006-5434 | PHP remote file inclusion vulnerability in p-news.php in P-News 1.16 and 1.17 allows remote attackers to execute arbitrary PHP code via a URL in the pn_lang parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.63% | 20 October 2006 |
| CVE-2006-5433 | PHP remote file inclusion vulnerability in modules/guestbook/index.php in ALiCE-CMS 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[local_root] parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.63% | 20 October 2006 |
| CVE-2006-5432 | Multiple direct static code injection vulnerabilities in db/txt.inc.php in phpPowerCards 2.10, when register_globals is enabled, allow remote attackers to create or overwrite arbitrary files via the (1) email[to], (2) email[from], (3) name[to], (4)… | EXPLOIT ✓LOW 2.6EPSS 2.59% | 20 October 2006 |
| CVE-2006-4926 | The NDIS-TDI Hooking Engine, as used in the (1) KLICK (KLICK.SYS) and (2) KLIN (KLIN.SYS) device drivers 2.0.0.281 for in Kaspersky Labs Anti-Virus 6.0.0.303 and other Anti-Virus and Internet Security products, allows local users to execute arbitrary… | EXPLOIT ✓HIGH 7.2EPSS 1.27% | 20 October 2006 |
| CVE-2006-5431 | PHP remote file inclusion vulnerability in gorum/dbproperty.php in PHPOutsourcing Zorum 3.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the appDirName parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.50% | 20 October 2006 |
| CVE-2006-5429 | Multiple PHP remote file inclusion vulnerabilities in Barry Nauta BRIM 1.2.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the renderer parameter in template.tpl.php in (1) templates/barrel/, (2) templates/sidebar/, (3)… | EXPLOIT ✓HIGH 7.5EPSS 2.77% | 20 October 2006 |
| CVE-2006-5428 | rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a display_get_requesters operation, which allows remote attackers to bypass the GUI login and obtain sensitive information (ticket data) via a direct request. | EXPLOIT ✓MEDIUM 5.0EPSS 2.80% | 20 October 2006 |
| CVE-2006-5427 | PHP remote file inclusion vulnerability in plugins/main.php in Php AMX 0.9.0, when register_globals is enabled or magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plug_path parameter. | EXPLOIT ✓MEDIUM 5.1EPSS 3.05% | 20 October 2006 |
| CVE-2006-5426 | PHP remote file inclusion vulnerability in lib/lcUser.php in LoCal Calendar System 1.1 remote attackers to execute arbitrary PHP code via a URL in the LIBDIR parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.76% | 20 October 2006 |
| CVE-2006-5423 | PHP remote file inclusion vulnerability in admin/admin_module.php in Lou Portail 1.4.1, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the g_admin_rep parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.47% | 20 October 2006 |
| CVE-2006-5422 | PHP remote file inclusion vulnerability in calcul-page.php in Lodel (patchlodel) 0.7.3 allows remote attackers to execute arbitrary PHP code via a URL in the home parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.76% | 20 October 2006 |
| CVE-2006-5421 | WSN Forum 1.3.4 and earlier allows remote attackers to execute arbitrary PHP code via a modified pathname in the pathtoconfig parameter that points to an avatar image that contains PHP code, which is then accessed from prestart.php. | EXPLOIT ✓HIGH 7.5EPSS 2.95% | 20 October 2006 |
| CVE-2006-5419 | PHP remote file inclusion vulnerability in client.php in University of Glasgow Specimen Image Database (SID), when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.77% | 20 October 2006 |
| CVE-2006-5418 | PHP remote file inclusion vulnerability in archive/archive_topic.php in pbpbb archive for search engines (SearchIndexer) (aka phpBBSEI) for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 5.71% | 20 October 2006 |
| CVE-2006-5415 | PHP remote file inclusion vulnerability in includes/functions_newshr.php in the News Defilante Horizontale 4.1.1 and earlier module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. | EXPLOIT ✓HIGH 7.5EPSS 3.29% | 20 October 2006 |
| CVE-2006-5413 | Multiple PHP remote file inclusion vulnerabilities in SuperMod 3.0.0 for YABB (YaBBSM) allow remote attackers to execute arbitrary PHP code via a URL in the sourcedir parameter to (1) Offline.php, (2) Sources/Admin.php, (3) Sources/Offline.php, or (4)… | EXPLOIT ✓HIGH 7.5EPSS 3.19% | 20 October 2006 |
| CVE-2006-5412 | admin.php in PHP Outburst Easynews 4.4.1 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication, and gain the ability to execute arbitrary code, via the en_login_id parameter. | EXPLOIT ✓MEDIUM 5.1EPSS 3.94% | 20 October 2006 |
| CVE-2006-5411 | Unrestricted file upload vulnerability in upload.php for Free Web Publishing System (FreeWPS), possibly 2.11 and earlier, allows remote attackers to upload and execute arbitrary PHP programs. | EXPLOIT ✓HIGH 7.5EPSS 2.64% | 20 October 2006 |
| CVE-2006-5402 | Multiple PHP remote file inclusion vulnerabilities in PHPmybibli 3.0.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) class_path, (2) javascript_path, and (3) include_path parameters in (a) cart.php; the (4)… | EXPLOIT ✓HIGH 7.5EPSS 3.62% | 18 October 2006 |
| CVE-2006-5401 | PHP remote file inclusion vulnerability in template/barnraiser_01/p_new_password.tpl.php in AROUNDMe 0.5.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the templatePath parameter. | EXPLOIT ✓HIGH 7.5EPSS 3.25% | 18 October 2006 |
| CVE-2006-5400 | PHP remote file inclusion vulnerability in forum/track.php in CyberBrau 0.9.4, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. | EXPLOIT ✓MEDIUM 5.1EPSS 3.08% | 18 October 2006 |
| CVE-2006-5399 | PHP remote file inclusion vulnerability in classes/Import_MM.class.php in PHPRecipeBook 2.36, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the g_rb_basedir parameter. | EXPLOIT ✓HIGH 7.5EPSS 3.81% | 18 October 2006 |
| CVE-2006-5398 | SQL injection vulnerability in comments.php in Simplog 0.9.3.1 allows remote attackers to execute arbitrary SQL commands via the cid parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.27% | 18 October 2006 |
| CVE-2006-5395 | Buffer overflow in Microsoft Class Package Export Tool (aka clspack.exe) allows context-dependent attackers to execute arbitrary code via a long string. | EXPLOIT ✓HIGH 7.5EPSS 8.09% | 18 October 2006 |
| CVE-2006-5392 | Multiple PHP remote file inclusion vulnerabilities in OpenDock FullCore 4.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the doc_directory parameter in (1) sw/index_sw.php; (2) cart.php, (3) lib_cart.php, (4)… | EXPLOIT ✓HIGH 7.5EPSS 16.5% | 18 October 2006 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.