Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,682cataloged exploits

39,953CVEs with public exploitation

24,696lab-tested

All Referência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

DigiLeave 1.2 - 'book_id' Blind SQL Injection

CVE-2008-3309—webappsasp

SQL injection vulnerability in info_book.asp in DigiLeave 1.2 and earlier allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

ZEELYRICS 2.0 - 'bannerclick.php' SQL Injection

CVE-2008-4717—webappsphp

SQL injection vulnerability in bannerclick.php in ZEELYRICS 2.0 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

phpFullAnnu (PFA) 6.0 - SQL Injection

CVE-2007-5068—webappsphp

SQL injection vulnerability in index.php in phpFullAnnu (PFA) 6.0 allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

BluSky CMS - 'news_id' SQL Injection

CVE-2009-1548—webappsphp

SQL injection vulnerability in index.php in BluSky CMS allows remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência✓ VexDay Proof

JobSite Professional 2.0 - 'file.php' SQL Injection

CVE-2007-5785—webappsphp

SQL injection vulnerability in file.php in JobSite Professional 2.0 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

FLDS 1.2a - 'lpro.php' SQL Injection

CVE-2008-5779—webappsphp

SQL injection vulnerability in lpro.php in Free Links Directory Script (FLDS) 1.2a allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

AskPert - Authentication Bypass

CVE-2008-6309—webappsphp

SQL injection vulnerability in index.php in W3matter AskPert allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência✓ VexDay Proof

Groone's GLink ORGanizer - 'index.php?cat' SQL Injection

CVE-2009-0299—webappsphp

SQL injection vulnerability in index.php in Groone GLinks 2.1 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

phpsmartcom 0.2 - Local File Inclusion / SQL Injection

CVE-2008-4351—webappsphp

Directory traversal vulnerability in index.php in phpSmartCom 0.2 allows remote attackers to include and execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

FLDS 1.2a - 'redir.php' SQL Injection

CVE-2008-5928—webappsphp

SQL injection vulnerability in redir.php in Free Links Directory Script (FLDS) 1.2a allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

SFS EZ Hosting Directory - 'cat_id' SQL Injection

CVE-2008-6782—webappsphp

SQL injection vulnerability in directory.php in Sites for Scripts (SFS) EZ Hosting Directory allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

PHPAuctionSystem - Cross-Site Scripting / SQL Injection

CVE-2009-0106—webappsphp

SQL injection vulnerability in profile.php in PHPAuctions (aka PHPAuctionSystem) allows remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

BusinessSpace 1.2 - 'id' SQL Injection

CVE-2009-0516—webappsphp

SQL injection vulnerability in the classified page (classified.php) in BusinessSpace 1.2 and earlier allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

My Game Script 2.0 - Authentication Bypass

CVE-2009-1816—webappsphp

SQL injection vulnerability in admin.php in My Game Script 2.0 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

Linkarity - 'link.php' SQL Injection

CVE-2008-4353—webappsphp

SQL injection vulnerability in link.php in Linkarity allows remote attackers to execute arbitrary SQL commands via the c

23RISK

open ↗

Referência✓ VexDay Proof

Butterfly ORGanizer 2.0.0 - SQL Injection / Cross-Site Scripting

CVE-2008-6328—webappsphp

SQL injection vulnerability in view.php in Butterfly Organizer 2.0.0 and 2.0.1 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

jPORTAL 2 - 'mailer.php' SQL Injection

CVE-2007-5974—webappsphp

SQL injection vulnerability in mailer.php in JPortal 2 allows remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência✓ VexDay Proof

Active Force Matrix 2 - Authentication Bypass

CVE-2008-5634—webappsasp

SQL injection vulnerability in account.asp in Active Force Matrix 2.0 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Ktools Photostore 3.5.1 - 'gid' SQL Injection

CVE-2008-6647—webappsphp

SQL injection vulnerability in gallery.php in Ktools PhotoStore 3.4.3 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Tiger Dms - Authentication Bypass

CVE-2009-1503—webappsphp

Multiple SQL injection vulnerabilities in login.php in Tiger Document Management System (DMS) allow remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

MaxCMS 2.0 - 'm_username' Arbitrary Create Admin

CVE-2009-1818—webappsphp

SQL injection vulnerability in admin/admin_manager.asp in MaxCMS 2.0 allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

Toko Instan 7.6 - Multiple SQL Injections

CVE-2007-6004—webappsphp

Multiple SQL injection vulnerabilities in index.php in Toko Instan 7.6 allow remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Symantec BackupExec Calendar Control - 'PVCalendar.ocx' Remote Buffer Overflow

CVE-2007-6016—remotewindows

Multiple stack-based buffer overflows in the PVATLCalendar.PVCalendar.1 ActiveX control in pvcalendar.ocx in the schedul

50RISK

open ↗

Referência✓ VexDay Proof

Vigile CMS 1.4 - Multiple Vulnerabilities

CVE-2007-6086—webappsphp

Directory traversal vulnerability in index.php in VigileCMS 1.4 allows remote attackers to include and execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

meBiblio 0.4.5 - 'action' Remote File Inclusion

CVE-2007-6089—webappsphp

PHP remote file inclusion vulnerability in index.php in meBiblio 0.4.5 allows remote attackers to execute arbitrary PHP

23RISK

open ↗

Referência✓ VexDay Proof

w-Agora 4.2.1 - 'cat' SQL Injection

CVE-2007-6647—webappsphp

SQL injection vulnerability in index.php in w-Agora 4.2.1 and earlier allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

XOOPS Module eEmpregos - 'cid' SQL Injection

CVE-2008-0874—webappsphp

SQL injection vulnerability in index.php in the eEmpregos module for XOOPS allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Prozilla Freelancers - 'project' SQL Injection

CVE-2008-1864—webappsphp

SQL injection vulnerability in project.php in Prozilla Freelancers allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

Netious CMS 0.4 - 'pageid' SQL Injection

CVE-2008-2461—webappsphp

SQL injection vulnerability in index.php in Netious CMS 0.4 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

MojoClassifieds 2.0 - Blind SQL Injection

CVE-2008-3382—webappscgi

SQL injection vulnerability in mojoClassified.cgi in MojoClassifieds 2.0 allows remote attackers to execute arbitrary SQ

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.