CVE is the closest to a central database, although they describe themselves as "a dictionary, not a database".
It's aim is to provide a unique identifier for each known security issue. Before CVE there would often be confusion because names were used, so one network scanning tool might report "Buffer overrun in Windows Server Service", while another one would report "Code execution in Windows". CVE solves this problem by giving each issue a unique identifier like CVE-2008-4250. The take up of CVE is near universal - almost all vendors and researchers will contact CVE to obtain a unique number before issuing an advisory. One thing to be aware of is that it is not completely universal.
A CVE number corresponds to a known vulnerability in a particular piece of commercial or open source software. So, "cross-site scripting" is a generic issue and does not have it's own CVE (actually, that's what CWE is for). But "cross-site scripting in Apache Roller" would get a CVE. Vulnerabilities in bespoke software (e.g. XSS in Facebook) do not normally get a CVE.
CVE itself is not a detailed database. The database holds a brief description and references to other databases. For more detailed information, good sources are: Security Focus, Secunia, NIST, and the software vendor's advisories. If you're after exploits then Metasploit and Exploit DB are good places.