Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,883cataloged exploits

40,037CVEs with public exploitation

24,696lab-tested

All Referência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

pLink 2.07 - 'linkto.php' Blind SQL Injection

CVE-2008-4357—webappsphp

SQL injection vulnerability in linkto.php in Powie pLink 2.07 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

YourFreeWorld Autoresponder Hosting - 'tr.php' SQL Injection

CVE-2008-4882—webappsphp

SQL injection vulnerability in tr.php in YourFreeWorld Autoresponder Hosting Script allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

WebCal - 'webCal3_detail.asp?event_id' SQL Injection

CVE-2009-1945—webappsphp

SQL injection vulnerability in webCal3_detail.asp in WebCal 3.04 allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

Open Biller 0.1 - 'Username' Blind SQL Injection

CVE-2009-2036—webappsphp

SQL injection vulnerability in index.php in Open Biller 0.1 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

project alumni 1.0.9 - 'index.php?act' Local File Inclusion

CVE-2007-6184—webappsphp

Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute ar

23RISK

open ↗

Referência✓ VexDay Proof

phpBB Garage 1.2.0 Beta3 - SQL Injection

CVE-2007-6223—webappsphp

SQL injection vulnerability in garage.php in phpBB Garage 1.2.0 Beta3 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Riddles Complete Website 1.2.1 - 'riddleid' SQL Injection

CVE-2008-5166—webappsphp

SQL injection vulnerability in riddle.php in Riddles Website 1.2.1 allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

PG Job Site - Blind SQL Injection

CVE-2008-6117—webappsphp

SQL injection vulnerability in homepage.php in PG Job Site Pro allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

phpBB 3 - Mod Tag Board 4 Blind SQL Injection

CVE-2008-6314—webappsphp

SQL injection vulnerability in tag_board.php in the Tag Board module 4.0 and earlier for phpBB allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

WEBBDOMAIN Post Card 1.02 - Authentication Bypass

CVE-2008-6623—webappsphp

SQL injection vulnerability in getin.php in WEBBDOMAIN Post Card (aka Web Postcards) 1.02 and earlier allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

Snitz Forums 2000 - 'Active.asp' SQL Injection

CVE-2007-6240—webappsasp

SQL injection vulnerability in active.asp in Snitz Forums 2000 3.4.06 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

EZContents 1.4.5 - 'index.php?link' Remote File Disclosure

CVE-2007-6368—webappsphp

Directory traversal vulnerability in index.php in ezContents 1.4.5 allows remote attackers to read arbitrary files via a

23RISK

open ↗

Referência✓ VexDay Proof

SH-News 3.0 - 'comments.php' SQL Injection

CVE-2007-6391—webappsphp

SQL injection vulnerability in patch/comments.php in SH-News 3.0 allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

YACS CMS 6.6.1 - context[path_to_root] Remote File Inclusion

CVE-2006-4532—webappsphp

PHP remote file inclusion vulnerability in articles/article.php in Yet Another Community System (YACS) CMS 6.6.1 and ear

23RISK

open ↗

Referência✓ VexDay Proof

GuildFTPd 0.999.8.11/0.999.14 - Heap Corruption (PoC) / Denial of Service

CVE-2008-4572—doswindows

GuildFTPd 0.999.14, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possib

50RISK

open ↗

Referência✓ VexDay Proof

PhpReactor 1.2.7pl1 - 'pathtohomedir' Remote File Inclusion

CVE-2006-3983—webappsphp

PHP remote file inclusion vulnerability in editprofile.php in php(Reactor) 1.27pl1 allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

MunzurSoft Wep Portal W3 - 'kat' SQL Injection

CVE-2008-4573—webappsasp

SQL injection vulnerability in kategori.asp in MunzurSoft Wep Portal W3 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

PG Matchmaking Script - Multiple SQL Injections

CVE-2008-4665—webappsphp

SQL injection vulnerability in PG Matchmaking allows remote attackers to execute arbitrary SQL commands via the id param

23RISK

open ↗

Referência✓ VexDay Proof

Libera CMS 1.12 - 'cookie' SQL Injection

CVE-2008-4700—webappsphp

SQL injection vulnerability in admin.php in Libera CMS 1.12 and earlier, when magic_quotes_gpc is disabled, allows remot

23RISK

open ↗

Referência✓ VexDay Proof

k_shoutbox 4.4 - Remote File Inclusion

CVE-2006-3989—webappsphp

PHP remote file inclusion vulnerability in index.php in Knusperleicht Shoutbox 4.4 and earlier allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

QuestCMS - Cross-Site Scripting / Directory Traversal / SQL Injection

CVE-2008-4772—webappsphp

SQL injection vulnerability in main/main.php in QuestCMS allows remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência✓ VexDay Proof

RunCMS 1.6 - Multiple Vulnerabilities

CVE-2007-6545—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in RunCMS before 1.6.1 allow remote attackers to inject arbitrary we

23RISK

open ↗

Referência✓ VexDay Proof

1024 CMS 1.3.1 - Local File Inclusion / SQL Injection

CVE-2007-6583—webappsphp

SQL injection vulnerability in admin/ops/findip/ajax/search.php in 1024 CMS 1.3.1 allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

NoseRub 0.5.2 - Login SQL Injection

CVE-2007-6602—webappsphp

SQL injection vulnerability in app/models/identity.php in NoseRub 0.5.2 and earlier allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

Hot or Not Clone by Jnshosts.com - Database Backup Dump

CVE-2007-6603—webappsphp

Hot or Not Clone has insufficient access control for producing and reading database backups, which allows remote attacke

23RISK

open ↗

Referência✓ VexDay Proof

VideoLAN VLC Media Player 0.8.6d - 'httpd_FileCallBack' Remote Format String

CVE-2007-6682—remotewindows

Format string vulnerability in the httpd_FileCallBack function (network/httpd.c) in VideoLAN VLC 0.8.6d allows remote at

28RISK

open ↗

Referência✓ VexDay Proof

snetworks PHP Classifieds 5.0 - Remote File Inclusion

CVE-2008-0137—webappsphp

PHP remote file inclusion vulnerability in config.inc.php in SNETWORKS PHP CLASSIFIEDS 5.0 allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

samPHPweb 4.2.2 - 'db.php' Remote File Inclusion

CVE-2008-0143—webappsphp

PHP remote file inclusion vulnerability in common/db.php in samPHPweb, possibly 4.2.2 and others, as provided with SAM B

23RISK

open ↗

Referência✓ VexDay Proof

Myiosoft EasyBookMarker 4 - 'Parent' SQL Injection

CVE-2008-5651—webappsphp

SQL injection vulnerability in plugins/bookmarker/bookmarker_backend.php in MyioSoft EasyBookMarker 4.0 allows remote at

23RISK

open ↗

Referência✓ VexDay Proof

4Images 1.7.x - 'search.php' SQL Injection

CVE-2006-5236—webappsphp

SQL injection vulnerability in search.php in 4images 1.7.x allows remote authenticated users to execute arbitrary SQL co

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.