Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,883cataloged exploits

40,037CVEs with public exploitation

24,696lab-tested

All Referência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

Quick Poll Script - 'id' SQL Injection

CVE-2008-3765—webappsphp

SQL injection vulnerability in code.php in Quick Poll Script allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência✓ VexDay Proof

phpBazar 2.0.2 - 'adid' SQL Injection

CVE-2008-3767—webappsphp

SQL injection vulnerability in classified.php in phpBazar 2.0.2 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

CMME 1.12 - Local File Inclusion / Cross-Site Scripting / Cross-Site Request Forgery/Download Backup/Make Directory

CVE-2008-3924—webappsphp

The "Make a backup" functionality in Content Management Made Easy (CMME) 1.12 stores sensitive information under the web

23RISK

open ↗

Referência✓ VexDay Proof

AJ HYIP ACME - 'comment.php' SQL Injection

CVE-2008-4043—webappsphp

Multiple SQL injection vulnerabilities in AJ Square AJ HYIP Acme allow remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

CustomCMS 4.0 - 'print.php' SQL Injection

CVE-2008-4156—webappsphp

SQL injection vulnerability in print.php in CustomCms (CCMS) Gaming Portal 4.0, when magic_quotes_gpc is disabled, allow

23RISK

open ↗

Referência✓ VexDay Proof

Zanfi CMS lite / Jaw Portal free - 'page' SQL Injection

CVE-2008-4159—webappsphp

SQL injection vulnerability in index.php in Jaw Portal and Zanfi CMS lite and allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

iScripts EasyIndex - 'produid' SQL Injection

CVE-2008-4169—webappsphp

SQL injection vulnerability in detaillist.php in iScripts EasyIndex, possibly 1.0, allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

openEngine 2.0 beta4 - Remote File Inclusion

CVE-2008-4329—webappsphp

PHP remote file inclusion vulnerability in cms/system/openengine.php in openEngine 2.0 beta4 and earlier allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

phpsmartcom 0.2 - Local File Inclusion / SQL Injection

CVE-2008-4352—webappsphp

SQL injection vulnerability in inc/pages/viewprofile.php in phpSmartCom 0.2 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

iBoutique 4.0 - 'cat' SQL Injection

CVE-2008-4354—webappsphp

SQL injection vulnerability in the products module in NetArt Media iBoutique 4.0 allows remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

Hammer Software MetaGauge 1.0.0.17 - Directory Traversal

CVE-2008-4421—remotewindows

Directory traversal vulnerability in MetaGauge 1.0.0.17, and probably other versions before 1.0.3.38, allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

FOSS Gallery Public 1.0 - Arbitrary File Upload (PoC)

CVE-2008-4509—webappsphp

Unrestricted file upload vulnerability in processFiles.php in FOSS Gallery Admin and FOSS Gallery Public 1.0 beta allows

23RISK

open ↗

Referência✓ VexDay Proof

geccBBlite 2.0 - 'id' SQL Injection

CVE-2008-4517—webappsphp

SQL injection vulnerability in leggi.php in geccBBlite 2.0 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

JMweb - 'src' Local File Inclusion

CVE-2008-4522—webappsphp

Multiple directory traversal vulnerabilities in JMweb MP3 Music Audio Search and Download Script allow remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Solaris 9 (UltraSPARC) - 'sadmind' Remote Code Execution

CVE-2008-4556—remotesolaris

Stack-based buffer overflow in the adm_build_path function in sadmind in Sun Solstice AdminSuite on Solaris 8 and 9 allo

50RISK

open ↗

Referência✓ VexDay Proof

Ayco Okul Portali - 'linkid' SQL Injection

CVE-2008-4574—webappsasp

SQL injection vulnerability in default.asp in Ayco Okul Portali allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

Eserv 3.x - FTP Server (ABOR) Remote Stack Overflow (PoC)

CVE-2008-4588—doswindows

Stack-based buffer overflow in the FTP server in Etype Eserv 3.x, possibly 3.26, allows remote attackers to cause a deni

23RISK

open ↗

Referência✓ VexDay Proof

SezHoo 0.1 - Remote File Inclusion

CVE-2008-4704—webappsphp

PHP remote file inclusion vulnerability in SezHooTabsAndActions.php in SezHoo 0.1 allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

X7 Chat 2.0.1A1 - Local File Inclusion

CVE-2008-4718—webappsphp

Directory traversal vulnerability in help/mini.php in X7 Chat 2.0.1 A1 and earlier allows remote attackers to include an

23RISK

open ↗

Referência✓ VexDay Proof

Hummingbird Deployment Wizard 2008 - ActiveX Command Execution

CVE-2008-4728—remotewindows

Multiple insecure method vulnerabilities in the DeployRun.DeploymentSetup.1 (DeployRun.dll) ActiveX control 10.0.0.44 in

35RISK

open ↗

Referência✓ VexDay Proof

db Software Laboratory VImpX - 'VImpX.ocx' Multiple Vulnerabilities

CVE-2008-4750—remotewindows

Stack-based buffer overflow in the VImpX.VImpAX ActiveX control (VImpX.ocx) 4.8.8.0 in DB Software Laboratory VImp X, po

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_extplorer 2.0.0 RC2 - Local Directory Traversal

CVE-2008-4764—webappsphp

Directory traversal vulnerability in the eXtplorer module (com_extplorer) 2.0.0 RC2 and earlier in Joomla! allows remote

43RISK

open ↗

Referência✓ VexDay Proof

KGB 1.87 - Local File Inclusion / Remote Code Execution

CVE-2006-5115—webappsphp

Directory traversal vulnerability in kgcall.php in KGB 1.87 allows remote attackers to include and execute arbitrary loc

23RISK

open ↗

Referência✓ VexDay Proof

WebCards 1.3 - SQL Injection

CVE-2008-4877—webappsphp

SQL injection vulnerability in admin.php in WebCards 1.3, when magic_quotes_gpc is disabled, allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

SmallNuke 2.0.4 - Pass Recovery SQL Injection

CVE-2008-0147—webappsphp

SQL injection vulnerability in index.php in SmallNuke 2.0.4 and earlier, when magic_quotes_gpc is disabled, allows remot

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component JooBlog 0.1.1 - 'PostID' SQL Injection

CVE-2008-5051—webappsphp

SQL injection vulnerability in the JooBlog (com_jb2) component 0.1.1 for Joomla! allows remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

phpMyWebmin 1.0 - 'window.php' Remote File Inclusion

CVE-2006-5124—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Joshua Muheim phpMyWebmin 1.0 allow remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

phpMyWebmin 1.0 - 'window.php' Remote File Inclusion

CVE-2006-5125—webappsphp

Directory traversal vulnerability in window.php, possibly used by home.php, in Joshua Muheim phpMyWebmin 1.0 allows remo

23RISK

open ↗

Referência✓ VexDay Proof

Drinks Complete Website 2.1.0 - 'drinkid' SQL Injection

CVE-2008-5169—webappsphp

SQL injection vulnerability in drinks/drink.php in Drinks Complete Website 2.1.0 allows remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Office - Communicator 'SIP' Remote Denial of Service

CVE-2008-5180MEDIUMdoswindows

Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of ser

45RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.