Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,230cataloged exploits

36,424CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

MaxCMS 2.0 - 'm_username' Arbitrary Create Admin

CVE-2009-1818—webappsphp

SQL injection vulnerability in admin/admin_manager.asp in MaxCMS 2.0 allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Bible Study 1.5.0 - 'id' SQL Injection

CVE-2008-2643—webappsphp

SQL injection vulnerability in the Bible Study (com_biblestudy) component before 6.0.7c for Joomla! allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

Mybizz-Classifieds - 'cat' SQL Injection

CVE-2008-2845—webappsphp

SQL injection vulnerability in index.php in MyBizz-Classifieds allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

Webdevindo-CMS 0.1 - 'hal' SQL Injection

CVE-2008-2875—webappsphp

SQL injection vulnerability in index.php in Webdevindo-CMS 1.0.0 allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

geccBBlite 2.0 - 'id' SQL Injection

CVE-2008-4517—webappsphp

SQL injection vulnerability in leggi.php in geccBBlite 2.0 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

myEvent 1.6 - 'eventdate' SQL Injection

CVE-2008-4650—webappsphp

SQL injection vulnerability in viewevent.php in myEvent 1.6 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

Aj RSS Reader - 'url' SQL Injection

CVE-2008-4753—webappsphp

SQL injection vulnerability in EditUrl.php in AJ Square RSS Reader allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component mambads 1.0 RC1 Beta - SQL Injection

CVE-2008-5226—webappsphp

SQL injection vulnerability in the MambAds (com_mambads) component 1.0 RC1 Beta and 1.0 RC1 for Mambo allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

SHOP-INET 4 - 'grid' SQL Injection

CVE-2009-0292—webappsphp

SQL injection vulnerability in show_cat2.php in SHOP-INET 4 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

Script Toko Online 5.01 - SQL Injection

CVE-2009-0296—webappsphp

SQL injection vulnerability in shop_display_products.php in Script Toko Online 5.01 allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_waticketsystem - Blind SQL Injection

CVE-2009-0333—webappsphp

SQL injection vulnerability in the WebAmoeba (WA) Ticket System (com_waticketsystem) component for Joomla! allows remote

23RISK

open ↗

Referência✓ VexDay Proof

Prozilla Freelancers - 'project' SQL Injection

CVE-2008-1864—webappsphp

SQL injection vulnerability in project.php in Prozilla Freelancers allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

Netious CMS 0.4 - 'pageid' SQL Injection

CVE-2008-2461—webappsphp

SQL injection vulnerability in index.php in Netious CMS 0.4 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

Etomite CMS 0.6.1 - 'Username' SQL Injection (mq = off)

CVE-2006-3904—webappsphp

SQL injection vulnerability in manager/index.php in Etomite CMS 0.6.1 and earlier, with magic_quotes_gpc disabled, allow

23RISK

open ↗

Referência✓ VexDay Proof

MojoClassifieds 2.0 - Blind SQL Injection

CVE-2008-3382—webappscgi

SQL injection vulnerability in mojoClassified.cgi in MojoClassifieds 2.0 allows remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência✓ VexDay Proof

PHP Live! 3.2.1 - 'help.php' Remote File Inclusion

CVE-2006-3911—webappsphp

PHP remote file inclusion vulnerability in OSI Codes PHP Live! 3.2.1 and earlier allows remote attackers to execute arbi

28RISK

open ↗

Referência✓ VexDay Proof

Living Local Website - 'listtest.php' SQL Injection

CVE-2008-3943—webappsphp

SQL injection vulnerability in listtest.php in eZoneScripts Living Local 1.1 allows remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

Vastal I-Tech Cosmetics Zone - 'cat_id' SQL Injection

CVE-2008-4466—webappsphp

SQL injection vulnerability in view_products_cat.php in Vastal I-Tech Cosmetics Zone allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

w-Agora 4.2.1 - 'cat' SQL Injection

CVE-2007-6647—webappsphp

SQL injection vulnerability in index.php in w-Agora 4.2.1 and earlier allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

XOOPS Module eEmpregos - 'cid' SQL Injection

CVE-2008-0874—webappsphp

SQL injection vulnerability in index.php in the eEmpregos module for XOOPS allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Shahrood - Blind SQL Injection

CVE-2008-5003—webappsphp

SQL injection vulnerability in ndetail.php in Shahrood allows remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência✓ VexDay Proof

Nitrotech 0.0.3a - Remote File Inclusion / SQL Injection

CVE-2008-5333—webappsphp

SQL injection vulnerability in members.php in NitroTech 0.0.3a allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

eDNews 2.0 - SQL Injection

CVE-2008-5820—webappsphp

SQL injection vulnerability in eDNews_view.php in eDreamers eDNews 2 allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component mydyngallery 1.4.2 - SQL Injection

CVE-2008-5957—webappsphp

SQL injection vulnerability in the Mydyngallery (com_mydyngallery) component 1.4.2 for Joomla! allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

Ocean12 Membership Manager Pro - Authentication Bypass

CVE-2008-6390—webappsphp

SQL injection vulnerability in login.asp in Ocean12 Membership Manager Pro allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Easy Photo Gallery 2.1 - Cross-Site Scripting / File Disclosure/Bypass / SQL Injection

CVE-2008-6989—webappsphp

SQL injection vulnerability in gallery.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 allows remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

EasyWay CMS - 'mid' SQL Injection

CVE-2008-2555—webappsphp

SQL injection vulnerability in index.php in EasyWay CMS allows remote attackers to execute arbitrary SQL commands via th

23RISK

open ↗

Referência✓ VexDay Proof

chernobiLe Portal 1.0 - 'default.asp' SQL Injection

CVE-2007-0582—webappsasp

SQL injection vulnerability in default.asp in ChernobiLe 1.0 allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência✓ VexDay Proof

GLLCTS2 < 4.2.4 - 'detail' SQL Injection

CVE-2008-2746—webappsphp

SQL injection vulnerability in login.php in Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

WBB2-Addon: Acrotxt 1.0 - 'show' SQL Injection

CVE-2007-4581—webappsphp

SQL injection vulnerability in acrotxt.php in WBB2-Addon: Acrotxt 1 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.