CVE / KEV 查詢
輸入 CVE 編號，即可在一個頁面查看嚴重程度（CVSS）、被利用機率（EPSS）、是否已有實際利用確認（CISA KEV）以及修復線索。優先讀取本站自有的情報來源資料庫，沒有時再從 NVD/FIRST 取得。
- 傳送
- 將CVE編號傳送到本站伺服器
- 儲存
- 不儲存查詢內容（編號可能留在URL與紀錄中）
- 外部API
- 伺服器向NVD、OSV.dev、FIRST傳送CVE編號
- 對象
- 僅查詢公開的CVE編號
詳細說明
- 執行查詢時，CVE編號會傳送到本站伺服器。伺服器查詢本站資料庫，並在需要時向NVD、OSV.dev、FIRST（EPSS）的公開API傳送CVE編號。
- 查詢內容不會記錄到資料庫。CVE編號包含在URL中，因此可能留在瀏覽器紀錄與存取紀錄中。
- 在結果頁面的版本、設定比對欄中輸入的值只在瀏覽器內處理。請勿輸入CVE編號以外的資訊（密碼、個人資料、認證資訊）。
- 頁面本身的瀏覽會記錄在存取紀錄中（IP位址、時間、使用者代理等）。工具頁面不載入廣告與流量分析。 隱私權政策
NVD record state: Received
This describes NVD analysis work, not whether your product/version is affected. Pending, unscheduled or missing analysis does not establish safety or lack of impact.
NVD state stored by this site; the latest state was not rechecked for this lookup.
Reported state: Received
NVD record modification: 2026-11-10T22:18:27.533ZThis is not the retrieval or rejection time. Consult the original for the full change history.
Stored description; verify against the original record
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Stored representative assessment
Assessor: psirt@adobe.com / primary
Reported vector (score not recalculated): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Compare CVSS assessors, versions and vectors (1)
CVSS Base describes severity, not the probability your system is compromised. For NVD records the display policy is the latest available version, then Primary within that version, then reported order. This does not maximize scores or identify Primary as NVD. Examine the platform and vectors; do not average different assessments.
Assessments below are from a stored NVD record, not a current recheck or complete history. At most the first 16 per version. An assessor is not inferred for legacy representative-only data.
CVSS 3.1 / 9.9
Assessor: psirt@adobe.com / primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA KEV records confirmed real-world exploitation, not continuous attack monitoring or compromise of your environment. EPSS forecasts observed exploitation over the next 30 days from its evaluation date, not the probability your site is compromised. Percentile is relative rank; the trend shows earlier daily forecasts. Low EPSS does not cancel confirmed KEV evidence. A CISA catalog due date is not treated as a universal legal deadline.
This product uses the NVD API but is not endorsed or certified by the NVD. Exploited-vulnerability data: CISA KEV (CC0). EPSS: see EPSS at https://www.first.org/epss. CWE™ is a trademark of The MITRE Corporation. Open source package data: OSV.dev / GitHub Advisory Database (CC BY 4.0).
使用方法
- 1
輸入您關注的 CVE 編號（範例：CVE-2021-44228）。
- 2
頁面會顯示 CVSS、EPSS、KEV（是否有利用確認）以及修復線索。
- 3
透過「本站的解讀文章」或「NVD 官方」頁面進一步了解詳情。
為什麼重要
常見問題
Q什麼是 KEV？
這是 CISA 收錄已確認在實際環境中被利用之弱點的目錄。應優先考慮這些證據，但收錄不代表攻擊現在仍在持續，也不證明您的環境已受害。
QEPSS 和 CVSS 有何區別？
CVSS 基礎分數表示嚴重程度。EPSS 是從評估日期起未來 30 天內在實際環境中觀測到利用的估計機率，並非您的系統受害機率。仍須確認產品、版本及暴露情況。
Q任何 CVE 都能查詢嗎？
本站優先讀取資料庫，缺少的資訊再查詢 NVD。本機沒有記錄或取得失敗，均不能證明 KEV 未收錄或沒有影響。