Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
RM Downloader - '.m3u' Local Stack Overflow (PoC)
CVE-2009-1326—doswindows
Stack-based buffer overflow in Mini-stream RM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a
23RISK
open ↗
Referência✓ VexDay Proof
SaveWeb Portal 3.4 - 'SITE_Path' Remote File Inclusion
CVE-2006-4012—webappsphp
Multiple PHP remote file inclusion vulnerabilities in circeOS SaveWeb Portal 3.4 allow remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
Connectix Boards 0.7 - 'p_skin' Multiple Vulnerabilities
CVE-2007-1255—webappsphp
Unrestricted file upload vulnerability in admin.bbcode.php in Connectix Boards 0.7 and earlier allows remote authenticat
23RISK
open ↗
Referência✓ VexDay Proof
HispaH textlinksads - 'index.php' SQL Injection
CVE-2008-6154—webappsphp
SQL injection vulnerability in index.php in Hispah Text Links Ads 1.1 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
Fully Modded phpBB 2021.4.40 - Multiple File Inclusions
CVE-2006-5526—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Teake Nutma Foing, as modified in Fully Modded phpBB (phpbbfm) 202
23RISK
open ↗
Referência✓ VexDay Proof
Formbankserver 1.9 - 'Name' Remote Denial of Service
CVE-2006-6910—doswindows
formbankcgi.exe in Fersch Formbankserver 1.9, when the PATH_INFO begins with Abfrage, allows remote attackers to cause a
23RISK
open ↗
Referência✓ VexDay Proof
Rigter Portal System (RPS) 6.2 - Blind SQL Injection
CVE-2007-1293—webappsphp
SQL injection vulnerability in Rigter Portal System (RPS) 6.2, when magic_quotes_gpc is disabled, allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
IndexScript 3.0 - 'parent_id' SQL Injection
CVE-2008-6179—webappsphp
SQL injection vulnerability in sug_cat.php in IndexScript 3.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Adobe 8.1.4/9.1 - 'customDictionaryOpen()' Code Execution
CVE-2009-1493—remotelinux
The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and
28RISK
open ↗
Referência✓ VexDay Proof
SourceForge 1.0.4 - 'database.php' Remote File Inclusion
CVE-2006-5562—webappsphp
PHP remote file inclusion vulnerability in include/database.php in SourceForge (aka alexandria) 1.0.4 allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
BitchX 1.1 Final - MODE Remote Heap Overflow
CVE-2007-4584—remotelinux
Stack-based buffer overflow in BitchX 1.1 Final allows remote IRC servers to execute arbitrary code via a long string in
28RISK
open ↗
Referência✓ VexDay Proof
Mooseguy Blog System 1.0 - 'month' SQL Injection
CVE-2008-0424—webappsphp
SQL injection vulnerability in blog.php in Mooseguy Blog System (MGBS) 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
ABC Advertise 1.0 - Admin Password Disclosure
CVE-2009-1550—webappsphp
Zakkis Technology ABC Advertise 1.0 does not properly restrict access to admin.inc.php, which allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Aconon Mail 2004 - Directory Traversal
CVE-2008-0464—webappscgi
Directory traversal vulnerability in archiv.cgi in absofort aconon Mail 2007 Enterprise SQL 11.7.0 and Mail 2004 Enterpr
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component com_Musica - 'id' SQL Injection
CVE-2008-6234—webappsphp
SQL injection vulnerability in the com_musica module in Joomla! and Mambo allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
Leap CMS 0.1.4 - SQL Injection / Cross-Site Scripting / Arbitrary File Upload
CVE-2009-1614—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Leap CMS 0.1.4 allow remote attackers to inject arbitrary web scr
23RISK
open ↗
Referência✓ VexDay Proof
phpBB Spider Friendly Module 1.3.10 - Remote File Inclusion
CVE-2006-5665—webappsphp
PHP remote file inclusion vulnerability in admin/modules_data.php in the phpBB module Spider Friendly 1.3.10 and earlier
23RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Top Sites - SQL Injection
CVE-2008-6247—webappsphp
SQL injection vulnerability in topsite.php in Scripts For Sites (SFS) EZ Top Sites allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
T-Dreams Job Career Package 3.0 - Insecure Cookie Handling
CVE-2009-1638—webappsasp
Techno Dreams Job Career Package 3.0 allows remote attackers to bypass authentication and obtain administrative access b
23RISK
open ↗
Referência✓ VexDay Proof
AEP SmartGate 4.3b - 'GET' Arbitrary File Download
CVE-2006-5725—remotewindows
The SSL server in AEP Smartgate 4.3b allows remote attackers to determine existence of directories via a direct request
23RISK
open ↗
Referência✓ VexDay Proof
Macromedia 10.1.4.20 - 'SwDir.dll' Internet Explorer Stack Overflow Denial of Service
CVE-2007-1403—doswindows
Multiple stack-based buffer overflows in an ActiveX control in SwDir.dll 10.1.4.20 in Macromedia Shockwave allow remote
28RISK
open ↗
Referência✓ VexDay Proof
RakhiSoftware Shopping Cart - SQL Injection
CVE-2008-6277—webappsphp
SQL injection vulnerability in product.php in RakhiSoftware Price Comparison Script (aka Shopping Cart) allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
DGNews 3.0 Beta - 'id' SQL Injection
CVE-2009-1746—webappsphp
SQL injection vulnerability in berita.php in Dian Gemilang DGNews 3.0 Beta allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
2DayBiz Template Monster Clone - 'edituser.php' Change Pass
CVE-2009-1767—webappsphp
admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote
23RISK
open ↗
Referência✓ VexDay Proof
phpBurningPortal 1.0.1 - 'lang_path' Remote File Inclusion
CVE-2006-7102—webappsphp
Multiple PHP remote file inclusion vulnerabilities in phpBurningPortal quiz-modul 1.0.1, and possibly earlier, allow rem
23RISK
open ↗
Referência✓ VexDay Proof
my-gesuad 0.9.14 - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2009-1811—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in myGesuad 0.9.14 (aka 0.9) allow remote attackers to inject arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Power Phlogger 2.0.9 - 'config.inc.php3' File Inclusion
CVE-2006-7106—webappsphp
PHP remote file inclusion vulnerability in config.inc.php3 in Power Phlogger 2.0.9 and earlier allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
Free Directory Script 1.1.1 - 'API_HOME_DIR' Remote File Inclusion
CVE-2008-6305—webappsphp
PHP remote file inclusion vulnerability in init.php in Free Directory Script 1.1.1, when register_globals is enabled, al
23RISK
open ↗
Referência✓ VexDay Proof
MyForum 1.3 - Authentication Bypass
CVE-2009-1852—webappsphp
Multiple SQL injection vulnerabilities in Graphiks MyForum 1.3 allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Soholaunch Pro 4.9 r36 - Remote File Inclusion
CVE-2006-5796—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Soholaunch Pro Edition 4.9 r46 and earlier, when register_globals
23RISK
open ↗
← previouspage 132 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.