Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,880cataloged exploits
40,036CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,450VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Acidcat CMS 3.4.1 - Multiple Vulnerabilities
CVE-2008-1992—webappsphp
Acidcat CMS 3.4.1 does not properly restrict access to (1) default_mail_aspemail.asp, (2) default_mail_cdosys.asp or (3)
23RISK
open ↗
Referência✓ VexDay Proof
Watchfire Appscan 7.0 - ActiveX Multiple Insecure Methods
CVE-2008-2015—remotewindows
Multiple absolute path traversal vulnerabilities in certain ActiveX controls in WatchFire AppScan 7.0 allow remote attac
23RISK
open ↗
Referência✓ VexDay Proof
MiniBB 2.2 - Cross-Site Scripting / SQL Injection / Full Path Disclosure
CVE-2008-2028—webappsphp
miniBB 2.2, and possibly earlier, when register_globals is enabled, allows remote attackers to obtain the full path via
23RISK
open ↗
Referência✓ VexDay Proof
MiniBB 2.2 - Cross-Site Scripting / SQL Injection / Full Path Disclosure
CVE-2008-2029—webappsphp
Multiple SQL injection vulnerabilities in (1) setup_mysql.php and (2) setup_options.php in miniBB 2.2 and possibly earli
23RISK
open ↗
Referência✓ VexDay Proof
phpDirectorySource 1.1 - Multiple SQL Injections
CVE-2008-2177—webappsphp
Multiple SQL injection vulnerabilities in phpDirectorySource 1.1.06, when magic_quotes_gpc is disabled, allow remote att
23RISK
open ↗
Referência✓ VexDay Proof
ScorpNews 1.0 - 'site' Remote File Inclusion
CVE-2008-2193—webappsphp
PHP remote file inclusion vulnerability in example.php in Thomas Gossmann ScorpNews 2.0 allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
Kostenloses Linkmanagementscript - SQL Injection
CVE-2008-2301—webappsphp
SQL injection vulnerability in Kostenloses Linkmanagementscript allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
Barracuda Web Application Firewall - Authentication Bypass
CVE-2014-2595—remotehardware
Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a perm
28RISK
open ↗
Referência✓ VexDay Proof
newsmanager 2.0 - Remote File Inclusion / File Disclosure / SQL Injection
CVE-2008-2341—webappsphp
PHP remote file inclusion vulnerability in ch_readalso.php in News Manager 2.0 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
MeltingIce File System 1.0 - Arbitrary Add User
CVE-2008-2348—webappsphp
MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and e
23RISK
open ↗
Referência✓ VexDay Proof
WR-Meeting 1.0 - 'msnum' Local File Disclosure
CVE-2008-2355—webappsphp
Directory traversal vulnerability in index.php in WR-Meeting 1.0, when magic_quotes_gpc is disabled, allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
Web Group Communication Center (WGCC) 1.0.3 - SQL Injection
CVE-2008-2446—webappsphp
Multiple SQL injection vulnerabilities in Web Group Communication Center (WGCC) 1.0.3 PreRelease 1 and earlier allow rem
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component xsstream-dm 0.01b - SQL Injection
CVE-2008-2454—webappsphp
SQL injection vulnerability in the xsstream-dm (com_xsstream-dm) component 0.01 Beta for Joomla! allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
LibSPF2 < 1.2.8 - DNS TXT Record Parsing Bug Heap Overflow (PoC)
CVE-2008-2469—dosmultiple
Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remo
28RISK
open ↗
Referência✓ VexDay Proof
gf-3xplorer 2.4 - Cross-Site Scripting / Local File Inclusion
CVE-2007-6475—webappsphp
Multiple directory traversal vulnerabilities in GF-3XPLORER 2.4 allow remote attackers to include and execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Phoenix View CMS Pre Alpha2 - SQL Injection / Local File Inclusion / Cross-Site Scripting
CVE-2008-2533—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Phoenix View CMS Pre Alpha2 and earlier allow remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Phoenix View CMS Pre Alpha2 - SQL Injection / Local File Inclusion / Cross-Site Scripting
CVE-2008-2535—webappsphp
Multiple SQL injection vulnerabilities in Phoenix View CMS Pre Alpha2 and earlier allow remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
BP Blog 6.0 - 'id' Blind SQL Injection
CVE-2008-2554—webappsasp
Multiple SQL injection vulnerabilities in BP Blog 6.0 allow remote attackers to execute arbitrary SQL commands via the (
23RISK
open ↗
Referência✓ VexDay Proof
BrowserCRM 5.002.00 - 'clients.php' Remote File Inclusion
CVE-2008-2689—webappsphp
PHP remote file inclusion vulnerability in pub/clients.php in BrowserCRM 5.002.00 allows remote attackers to execute arb
35RISK
open ↗
Referência✓ VexDay Proof
JAMM CMS - 'id' Blind SQL Injection
CVE-2008-2755—webappsphp
SQL injection vulnerability in index.php in JAMM CMS allows remote attackers to execute arbitrary SQL commands via the i
23RISK
open ↗
Referência✓ VexDay Proof
CKGold Shopping Cart 2.5 - 'category_id' SQL Injection
CVE-2008-2774—webappsphp
SQL injection vulnerability in item.php in CartKeeper CKGold Shopping Cart 2.5 and 2.7 allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
traindepot 0.1 - Local File Inclusion / Cross-Site Scripting
CVE-2008-2839—webappsphp
Cross-site scripting (XSS) vulnerability in the search module in Traindepot 0.1 allows remote attackers to inject arbitr
23RISK
open ↗
Referência✓ VexDay Proof
OwnRS blog beta3 - SQL Injection / Cross-Site Scripting
CVE-2008-2855—webappsphp
Cross-site scripting (XSS) vulnerability in clanek.php in OwnRS Beta 3 allows remote attackers to inject arbitrary web s
23RISK
open ↗
Referência✓ VexDay Proof
Jokes & Funny Pics Script - 'sb_jokeid' SQL Injection
CVE-2008-2874—webappsphp
SQL injection vulnerability in index.php in Softbiz Jokes & Funny Pics Script allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component EXP Shop - 'catid' SQL Injection
CVE-2008-2892—webappsphp
SQL injection vulnerability in the EXP Shop (com_expshop) component 1.0 for Joomla! allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
aeDating 4.1 - dir[inc] Remote File Inclusion
CVE-2006-4870—webappsphp
Multiple PHP remote file inclusion vulnerabilities in AEDating 4.1, and possibly earlier versions, allow remote attacker
28RISK
open ↗
Referência✓ VexDay Proof
PageSquid CMS 0.3 Beta - 'index.php' SQL Injection
CVE-2008-2897—webappsphp
SQL injection vulnerability in index.php in PageSquid CMS 0.3 Beta allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
Dana IRC 1.3 - Remote Buffer Overflow (PoC)
CVE-2008-2922—doswindows
Stack-based buffer overflow in artegic Dana IRC client 1.3 and earlier allows remote attackers to cause a denial of serv
23RISK
open ↗
Referência✓ VexDay Proof
cmreams CMS 1.3.1.1 beta2 - Local File Inclusion / Cross-Site Scripting
CVE-2008-2984—webappsphp
Cross-site scripting (XSS) vulnerability in backend/umleitung.php in CMReams CMS 1.3.1.1 Beta 2 allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
pSys 0.7.0 Alpha - 'chatbox.php' SQL Injection
CVE-2008-3131—webappsphp
SQL injection vulnerability in chatbox.php in pSys 0.7.0 Alpha, when magic_quotes_gpc is disabled, allows remote attacke
23RISK
open ↗
← previouspage 107 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.