Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
398,899 CVEs1,728 in CISA KEV17,272 with EPSS ≥ 10%25,049 with a public exploitUpdated 29 September 2026
25,049 results · page 380 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2006-4852 | SQL injection vulnerability in browse.asp in QuadComm Q-Shop 3.5 allows remote attackers to execute arbitrary SQL commands via the OrderBy parameter. | EXPLOIT ✓HIGH 7.5EPSS 5.13% | 19 September 2006 |
| CVE-2006-4850 | PHP remote file inclusion vulnerability in system/_b/contentFiles/gBIndex.php in BolinOS 4.5.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the gBRootPath parameter. | EXPLOIT ✓MEDIUM 5.1EPSS 7.73% | 19 September 2006 |
| CVE-2006-4849 | PHP remote file inclusion vulnerability in header.php in MobilePublisherPHP 1.5 RC2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter. | EXPLOIT ✓HIGH 7.5EPSS 8.14% | 19 September 2006 |
| CVE-2006-4848 | Multiple PHP remote file inclusion vulnerabilities in Brian Fraval Hitweb 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REP_CLASS parameter to (1) index.php, (2) arbo.php, (3) framepoint.php, (4) genpage.php, (5)… | EXPLOIT ✓HIGH 7.5EPSS 6.46% | 19 September 2006 |
| CVE-2006-4847 | Multiple buffer overflows in Ipswitch WS_FTP Server 5.05 before Hotfix 1 allow remote authenticated users to execute arbitrary code via long (1) XCRC, (2) XSHA1, or (3) XMD5 commands. | EXPLOIT ×2 ✓MEDIUM 6.5EPSS 85.3% | 19 September 2006 |
| CVE-2006-4845 | PHP remote file inclusion vulnerability in includes/footer.html.inc.php in TeamCal Pro 2.8.001 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the tc_config[app_root] parameter. | EXPLOIT ✓MEDIUM 5.1EPSS 7.49% | 19 September 2006 |
| CVE-2006-4844 | PHP remote file inclusion vulnerability in inc/claro_init_local.inc.php in Claroline 1.7.7 and earlier, as used in Dokeos and possibly other products, allows remote attackers to execute arbitrary PHP code via a URL in the extAuthSource[newUser] parameter. | EXPLOITMEDIUM 5.1EPSS 10.4% | 19 September 2006 |
| CVE-2006-4838 | Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal SE 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) root_url and (2) dcp_version parameters in (a) admin/inc/footer.inc.php, and the root_url, (3)… | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 4.07% | 15 September 2006 |
| CVE-2006-4836 | SQL injection vulnerability in login.php in DCP-Portal SE 6.0 allows remote attackers to execute arbitrary SQL commands via the username parameter. | EXPLOIT ✓MEDIUM 5.1EPSS 2.14% | 15 September 2006 |
| CVE-2006-4834 | PHP remote file inclusion vulnerability in index.php in Jule Slootbeek phpQuiz 0.01 allows remote attackers to execute arbitrary PHP code via a URL in the pagename parameter. | EXPLOIT ✓HIGH 7.5EPSS 7.88% | 15 September 2006 |
| CVE-2006-4832 | Buffer overflow in the telnet service in Verso NetPerformer FRAD ACT SDM-95xx 7.xx (R1) and earlier, SDM-93xx 10.x.x (R2) and earlier, and SDM-92xx 9.x.x (R1) and earlier allows remote attackers to cause a denial of service (reboot) and possibly execute… | EXPLOIT ✓HIGH 7.5EPSS 11.4% | 15 September 2006 |
| CVE-2006-4829 | Multiple cross-site scripting (XSS) vulnerabilities in David Czarnecki Blojsom 2.31 allow remote attackers to inject arbitrary web script or HTML via the (1) blog-category-description, (2) blog-entry-title, (3) rss-enclosure-url, (4) technorati-tagsi,… | EXPLOIT ✓MEDIUM 6.8EPSS 8.88% | 15 September 2006 |
| CVE-2006-4828 | PHP remote file inclusion vulnerability in zipndownload.php in PhotoPost 4.0 through 4.6 allows remote attackers to execute arbitrary PHP code via a URL in the PP_PATH parameter. | EXPLOIT ✓HIGH 7.5EPSS 6.53% | 15 September 2006 |
| CVE-2006-4827 | Multiple PHP remote file inclusion vulnerabilities in Vmist Downstat 1.8 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the art parameter to (1) admin.php, (2) chart.php, (3) modes.php, or (4) stats.php. | EXPLOIT ✓MEDIUM 5.1EPSS 6.62% | 15 September 2006 |
| CVE-2006-4826 | PHP remote file inclusion vulnerability in bottom.php in Shadowed Portal 5.599 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root parameter. | EXPLOIT ✓HIGH 7.5EPSS 9.54% | 15 September 2006 |
| CVE-2006-4825 | Multiple cross-site scripting (XSS) vulnerabilities in cl_files/index.php in SoftComplex PHP Event Calendar 1.5.1, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) ti, (2) bi, or (3) cbgi parameters. | EXPLOIT ✓MEDIUM 4.3EPSS 4.02% | 15 September 2006 |
| CVE-2006-4824 | PHP remote file inclusion vulnerability in lib/activeutil.php in Quicksilver Forums (QSF) 1.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the set[include_path] parameter. | EXPLOIT ✓HIGH 7.5EPSS 7.85% | 15 September 2006 |
| CVE-2006-4823 | PHP remote file inclusion vulnerability in scripts/news_page.php in Reamday Enterprises Magic News Pro 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the script_path parameter. | EXPLOIT ✓HIGH 7.5EPSS 8.65% | 15 September 2006 |
| CVE-2006-4437 | Eval injection vulnerability in Tagger LE allows remote attackers to execute arbitrary PHP code via the query string in (1) tags.php, (2) sign.php, and (3) admin/index.php. | EXPLOIT ✓HIGH 7.5EPSS 8.48% | 14 September 2006 |
| CVE-2006-4796 | Cross-site scripting (XSS) vulnerability in forum.asp in Snitz Forums 2000 3.4.06 allows remote attackers to inject arbitrary web script or HTML via the sortorder parameter (strtopicsortord variable). | EXPLOIT ✓MEDIUM 4.3EPSS 2.46% | 14 September 2006 |
| CVE-2006-4794 | Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the query string (PATH_INFO) in (1) contact.php, (2) download.php, (3) admin.php, (4) fpw.php, (5) news.php, (6)… | EXPLOIT ×9 ✓MEDIUM 4.3EPSS 4.88% | 14 September 2006 |
| CVE-2006-4793 | Multiple SQL injection vulnerabilities in icerik.asp in TualBLOG 1.0 allow remote attackers to execute arbitrary SQL commands, as demonstrated by the icerikno parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.26% | 14 September 2006 |
| CVE-2006-4789 | Buffer overflow in Open Movie Editor 0.0.20060901 allows local users to cause a denial of service (system crash) or execute arbitrary code via a long project name in an open_movie_editor_project XML tag. | EXPLOIT ✓MEDIUM 4.6EPSS 0.97% | 14 September 2006 |
| CVE-2006-4788 | PHP remote file inclusion vulnerability in includes/log.inc.php in Telekorn SignKorn Guestbook (SL) 1.3 and earlier, when register_globals is enabled and _SESSION[permission] parameter is set to "yes", allows remote attackers to execute arbitrary PHP… | EXPLOIT ✓MEDIUM 5.1EPSS 7.67% | 14 September 2006 |
| CVE-2006-4782 | src/index.php in WebSPELL 4.01.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication and gain sensitive information stored in the database via a modified userID parameter in a write action to… | EXPLOIT ✓MEDIUM 5.4EPSS 3.18% | 14 September 2006 |
| CVE-2006-4781 | Heap-based buffer overflow in FutureSoft TFTP Server Multithreaded (MT) 1.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by sending a crafted packet to port 69/UDP, which triggers the overflow when… | EXPLOIT ✓HIGH 7.5EPSS 5.73% | 14 September 2006 |
| CVE-2006-4780 | PHP remote file inclusion vulnerability in includes/functions.php in phpBB XS 0.58 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. | EXPLOIT ✓HIGH 7.5EPSS 8.66% | 14 September 2006 |
| CVE-2006-4779 | PHP remote file inclusion vulnerability in includes/functions_portal.php in Vitrax Premodded phpBB 1.0.6-R3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.95% | 14 September 2006 |
| CVE-2006-4777 | Heap-based buffer overflow in the DirectAnimation Path Control (DirectAnimation.PathControl) COM object (daxctle.ocx) for Internet Explorer 6.0 SP1, on Chinese and possibly other Windows distributions, allows remote attackers to execute arbitrary code… | EXPLOIT ×2 ✓HIGH 7.6EPSS 79.8% | 14 September 2006 |
| CVE-2006-4771 | Cross-site scripting (XSS) vulnerability in haut.php in ForumJBC 4 allows remote attackers to inject arbitrary web script or HTML via the nb_connecte parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.67% | 14 September 2006 |
| CVE-2006-4770 | PHP remote file inclusion vulnerability in menu.php in MiniPort@l 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the skiny parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.49% | 13 September 2006 |
| CVE-2006-4769 | PHP remote file inclusion vulnerability in abf_js.php in p4CMS 1.05 allows remote attackers to execute arbitrary PHP code via a URL in the abs_pfad parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.77% | 13 September 2006 |
| CVE-2006-4766 | Directory traversal vulnerability in print.php in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 3.02% | 13 September 2006 |
| CVE-2006-4764 | PHP remote file inclusion vulnerability in common.php in Thomas LETE WTools 0.0.1-ALPH allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.76% | 13 September 2006 |
| CVE-2006-4754 | Cross-site scripting (XSS) vulnerability in index.php in PHProg before 1.1 allows remote attackers to inject arbitrary web script or HTML via the album parameter, which is used in an opendir call. | EXPLOIT ✓MEDIUM 6.8EPSS 2.23% | 13 September 2006 |
| CVE-2006-4753 | Directory traversal vulnerability in index.php in PHProg before 1.1 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 3.47% | 13 September 2006 |
| CVE-2006-4751 | Cross-site scripting (XSS) vulnerability in index.php in Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5.1 allows remote attackers to inject arbitrary web script or HTML via the errcode parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 2.16% | 13 September 2006 |
| CVE-2006-4750 | PHP remote file inclusion vulnerability in openi-admin/base/fileloader.php in OPENi-CMS 1.0.1, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the config[openi_dir] parameter. | EXPLOIT ✓MEDIUM 5.1EPSS 3.02% | 13 September 2006 |
| CVE-2006-4749 | Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpATM) 1.20 allow remote attackers to execute arbitrary PHP code via the include_location parameter in (1) activate.php, (2) configure.php, (3) fileop.php, (4)… | EXPLOIT ✓HIGH 7.5EPSS 2.13% | 13 September 2006 |
| CVE-2006-4747 | Multiple cross-site scripting (XSS) vulnerabilities in IdevSpot TextAds allow remote attackers to inject arbitrary web script or HTML via (1) the id parameter in delete.php and (2) the error parameter in error.php. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.70% | 13 September 2006 |
| CVE-2006-4746 | PHP remote file inclusion vulnerability in news/include/customize.php in Web Server Creator 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the l parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.63% | 13 September 2006 |
| CVE-2006-4742 | Cross-site scripting (XSS) vulnerability in user_add.php in IDevSpot PhpLinkExchange 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.67% | 13 September 2006 |
| CVE-2006-4741 | PHP remote file inclusion vulnerability in bits_listings.php in IDevSpot PhpLinkExchange 1.0 allows remote attackers to execute arbitrary code via the svr_rootPhpStart parameter. | EXPLOIT ✓HIGH 7.5EPSS 4.21% | 13 September 2006 |
| CVE-2006-4733 | PHP remote file inclusion vulnerability in sipssys/code/box.inc.php in Haakon Nilsen simple, integrated publishing system (SIPS) 0.3.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the config[sipssys] parameter. | EXPLOIT ✓HIGH 7.5EPSS 3.17% | 13 September 2006 |
| CVE-2006-4731 | Multiple directory traversal vulnerabilities in (1) login.pl and (2) admin.pl in (a) SQL-Ledger before 2.6.19 and (b) LedgerSMB before 1.0.0p1 allow remote attackers to execute arbitrary Perl code via an unspecified terminal parameter value containing… | EXPLOIT ✓MEDIUM 5.0EPSS 6.09% | 13 September 2006 |
| CVE-2006-4384 | Heap-based buffer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via the COLOR_64 chunk in a FLIC (FLC) movie. | EXPLOIT ✓MEDIUM 5.1EPSS 16.2% | 12 September 2006 |
| CVE-2006-0032 | Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL,… | EXPLOIT ✓MEDIUM 4.3EPSS 24.6% | 12 September 2006 |
| CVE-2006-4723 | PHP remote file inclusion vulnerability in raidenhttpd-admin/slice/check.php in RaidenHTTPD 1.1.49, when register_globals and WebAdmin is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the SoftParserFileXml parameter. | EXPLOIT ✓MEDIUM 5.1EPSS 2.63% | 12 September 2006 |
| CVE-2006-4722 | PHP remote file inclusion vulnerability in Open Bulletin Board (OpenBB) 1.0.8 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) index.php and possibly (2) collector.php. | EXPLOIT ✓HIGH 7.5EPSS 2.83% | 12 September 2006 |
| CVE-2006-4721 | Directory traversal vulnerability in admin.php in CCleague Pro Sports CMS 1.0.1 RC1 allows remote attackers to read and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 5.1EPSS 2.65% | 12 September 2006 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.