Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,211cataloged exploits
36,421CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,464Referência 23,022GitHub PoC 15,027VulnCheck XDB 8,846Nuclei 4,361Metasploit 3,491✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
OpenX 2.6 - 'bannerid' Blind SQL Injection
CVE-2008-6163—webappsphp
SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
DevelopItEasy Events Calendar 1.2 - Multiple SQL Injections
CVE-2008-6608—webappsphp
Multiple SQL injection vulnerabilities in DevelopItEasy Events Calendar 1.2 allow remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Podcast Generator 1.1 - Remote Code Execution
CVE-2009-1226—webappsphp
core/admin/delete.php in Podcast Generator 1.1 and earlier does not properly restrict access to administrative functions
23RISK
open ↗
Referência✓ VexDay Proof
PHP Net Tools 2.7.1 - Remote Code Execution
CVE-2006-1921—webappsphp
nettools.php in PHP Net Tools 2.7.1 allows remote attackers to execute arbitrary commands via shell metacharacters in th
23RISK
open ↗
Referência✓ VexDay Proof
GuestCal 2.1 - 'index.php?lang' Local File Inclusion
CVE-2009-1319—webappsphp
Directory traversal vulnerability in includes/ini.inc.php in GuestCal 2.1 allows remote attackers to include and execute
23RISK
open ↗
Referência✓ VexDay Proof
FdWeB Espace Membre 2.01 - 'path' Remote File Inclusion
CVE-2007-0301—webappsphp
PHP remote file inclusion vulnerability in _admin/admin_menu.php in FdWeB Espace Membre 2.1 and earlier allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
Motorola Wimax modem CPEi300 - File Disclosure / Cross-Site Scripting
CVE-2009-0392—remotehardware
Directory traversal vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated users to re
23RISK
open ↗
Referência✓ VexDay Proof
Mutant 0.9.2 - 'mutant_functions.php' Remote File Inclusion
CVE-2007-1961—webappsphp
PHP remote file inclusion vulnerability in mutant_functions.php in the Mutant 0.9.2 portal for phpBB 2.2 allows remote a
23RISK
open ↗
Referência✓ VexDay Proof
WebPortal CMS 0.8b - Multiple Local/Remote File Inclusions
CVE-2009-1444—webappsphp
PHP remote file inclusion vulnerability in indexk.php in WebPortal CMS 0.8-beta allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
Expow 0.8 - 'autoindex.php?cfg_file' Remote File Inclusion
CVE-2007-2302—webappsphp
PHP remote file inclusion vulnerability in autoindex.php in Expow 0.8 allows remote attackers to execute arbitrary PHP c
23RISK
open ↗
Referência✓ VexDay Proof
NewsSync for phpBB 1.5.0rc6 - Remote File Inclusion
CVE-2007-3136—webappsphp
PHP remote file inclusion vulnerability in inc/nuke_include.php in newsSync 1.5.0rc6 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
MyCMS 0.9.8 - Remote Command Execution (2)
CVE-2007-3585—webappsphp
PHP remote file inclusion vulnerability in games.php in MyCMS 0.9.8 and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
eXtremail 2.1.1 - Remote Heap Overflow (PoC)
CVE-2007-5466—doslinux
Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending
28RISK
open ↗
Referência✓ VexDay Proof
eXtremail 2.1.1 - 'LOGIN' Remote Stack Overflow
CVE-2007-5466—remotelinux
Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending
28RISK
open ↗
Referência✓ VexDay Proof
Chipmunk Blog - (Authentication Bypass) Add Admin
CVE-2009-0399—webappsphp
Chipmunk Blogger Script allows remote attackers to gain administrator privileges via a direct request to admin/reguser.p
23RISK
open ↗
Referência✓ VexDay Proof
Syntax Desktop 2.7 - 'synTarget' Local File Inclusion
CVE-2009-0448—webappsphp
Directory traversal vulnerability in admin/modules/aa/preview.php in Syntax Desktop 2.7 allows remote attackers to inclu
23RISK
open ↗
Referência✓ VexDay Proof
CNStats 2.9 - 'who_r.php?bj' Remote File Inclusion
CVE-2007-2086—webappsphp
Multiple PHP remote file inclusion vulnerabilities in CNStats 2.9 allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗
Referência✓ VexDay Proof
Flip 3.0 - Remote Admin Creation
CVE-2007-5062—webappsphp
account.php in Adam Scheinberg Flip 3.0 and earlier allows remote attackers to create administrative accounts via the un
23RISK
open ↗
Referência✓ VexDay Proof
Catviz 0.4.0 beta1 - Local File Inclusion / Cross-Site Scripting
CVE-2009-1748—webappsphp
Multiple directory traversal vulnerabilities in index.php in Catviz 0.4.0 Beta 1 allow remote attackers to read arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Verlihub Control Panel 1.7.x - Local File Inclusion
CVE-2007-5321—webappsphp
Directory traversal vulnerability in index.php in Verlihub Control Panel (VHCP) 1.7 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
UploadImage/UploadScript 1.0 - Remote Change Admin Password
CVE-2008-0245—webappsphp
admin.php in UploadImage 1.0 does not check for the original password before making a change to a new password, which al
23RISK
open ↗
Referência✓ VexDay Proof
vm Watermark for Gallery 0.4.1 - Remote File Inclusion
CVE-2007-2575—webappsphp
PHP remote file inclusion vulnerability in watermark.php in the vm (aka Jean-Francois Laflamme) watermark 0.4.1 mod for
23RISK
open ↗
Referência✓ VexDay Proof
CoAST 0.95 - 'sections_file' Remote File Inclusion
CVE-2008-4735—webappsphp
PHP remote file inclusion vulnerability in header.php in Concord Asset, Software, and Ticket system (CoAST) 0.95 allows
23RISK
open ↗
Referência✓ VexDay Proof
AV Tutorial Script 1.0 - Remote User Pass Change
CVE-2007-3630—webappsphp
changePW.php in AV Tutorial Script (avtutorial) 1.0 does not require authentication or knowledge of an old password for
23RISK
open ↗
Referência✓ VexDay Proof
Sisfo Kampus 2006 - 'blanko.preview.php' Local File Disclosure
CVE-2007-4820—webappsphp
Absolute path traversal vulnerability in blanko.preview.php in Sisfo Kampus 2006 allows remote attackers to read arbitra
23RISK
open ↗
Referência✓ VexDay Proof
The Net Guys ASPired2Poll - Remote Database Disclosure
CVE-2008-6354—webappsasp
The Net Guys ASPired2poll stores sensitive information under the web root with insufficient access control, which allows
23RISK
open ↗
Referência✓ VexDay Proof
Mailist 3.0 - Insecure Backup / Local File Inclusion
CVE-2009-0571—webappsphp
admin.php in Ninja Designs Mailist 3.0 stores backup copies of maillist.php under the web root with insufficient access
23RISK
open ↗
Referência✓ VexDay Proof
Easy Scripts Answer and Question Script - Multiple Vulnerabilities
CVE-2009-1665—webappsphp
myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to remove arbitrary user accounts via a
23RISK
open ↗
Referência✓ VexDay Proof
MySpeach 3.0.7 - Local/Remote File Inclusion
CVE-2007-1895—webappsphp
PHP remote file inclusion vulnerability in chat.php in Sky GUNNING MySpeach 3.0.7 and earlier, when used with PHP 5, all
23RISK
open ↗
Referência✓ VexDay Proof
yourplace 1.0.2 - Multiple Vulnerabilities / Remote Code Execution
CVE-2008-6772—webappsphp
login/register_form.php in YourPlace 1.0.2 and earlier does not check that a username already exists when a new account
23RISK
open ↗
← previouspage 113 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.