It doesn't help that people rated a CVE 9.something for a PHP vuln in a barely used method of an extension that can be exploited if you use .. I forgot .. ah yes .. IIS.

Peter says wolf too many times?

Maybe a CVE should have a complex score (severity / spread): 9.9 / 4.

severity 9.9 : easy to exploit if you run this .. you're cooked

spread 4 : you most likely are not running this or it's by default in a way that you're not cooked