Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,186cataloged exploits

40,156CVEs with public exploitation

24,696lab-tested

All Referência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

E-topbiz ViralDX 2.07 - 'bannerid' SQL Injection

CVE-2008-2867—webappsphp

SQL injection vulnerability in adclick.php in E-topbiz Viral DX 1 2.07 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Efestech Shop 2.0 - 'cat_id' SQL Injection

CVE-2008-3030—webappsphp

SQL injection vulnerability in default.asp in EfesTECH Shop 2.0 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

XchangeBoard 1.70 - 'boardID' SQL Injection

CVE-2008-3035—webappsphp

SQL injection vulnerability in newThread.php in XchangeBoard 1.70 Final and earlier allows remote authenticated users to

23RISK

open ↗

Referência✓ VexDay Proof

CMS little 0.0.1 - 'template' Local File Inclusion

CVE-2008-3036—webappsphp

Directory traversal vulnerability in index.php in CMS little 0.0.1 allows remote attackers to include and execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Gateway Weblaunch - ActiveX Control Insecure Method

CVE-2008-0220—remotewindows

Multiple stack-based buffer overflows in the WebLaunch.WeblaunchCtl.1 (aka CWebLaunchCtl) ActiveX control in weblaunch.o

28RISK

open ↗

Referência✓ VexDay Proof

Gateway WebLaunch - ActiveX Remote Buffer Overflow

CVE-2008-0220—remotewindows

Multiple stack-based buffer overflows in the WebLaunch.WeblaunchCtl.1 (aka CWebLaunchCtl) ActiveX control in weblaunch.o

28RISK

open ↗

Referência✓ VexDay Proof

AShop Deluxe 4.x - 'catalogue.php' SQL Injection

CVE-2008-3136—webappsphp

SQL injection vulnerability in catalogue.php in AShop Deluxe 4.x allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

SmartPPC Pay Per Click Script - 'idDirectory' Blind SQL Injection (1)

CVE-2008-3152—webappsphp

SQL injection vulnerability in directory.php in SmartPPC and SmartPPC Pro allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

SmartPPC Pay Per Click Script - 'idDirectory' Blind SQL Injection (2)

CVE-2008-3152—webappsphp

SQL injection vulnerability in directory.php in SmartPPC and SmartPPC Pro allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

Binn SBuilder - 'nid' Blind SQL Injection

CVE-2008-0253—webappsphp

SQL injection vulnerability in full_text.php in Binn SBuilder allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

TutorialCMS 1.02 - 'Username' SQL Injection

CVE-2008-0254—webappsphp

SQL injection vulnerability in activate.php in TutorialCMS (aka Photoshop Tutorials) 1.02, when magic_quotes_gpc is disa

23RISK

open ↗

Referência✓ VexDay Proof

Pluck CMS 4.5.1 (Windows) - 'blogpost' Local File Inclusion

CVE-2008-3194—webappsphp

Multiple directory traversal vulnerabilities in data/inc/themes/predefined_variables.php in pluck 4.5.1 allow remote att

23RISK

open ↗

Referência✓ VexDay Proof

WebCMS Portal Edition - 'id' SQL Injection

CVE-2008-3213—webappsphp

SQL injection vulnerability in secciones/tablon/tablon.php in WebCMS Portal Edition allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

Arctic Issue Tracker 2.0.0 - 'filter' SQL Injection (2)

CVE-2008-3250—webappsphp

SQL injection vulnerability in index.php in Arctic Issue Tracker 2.0.0 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

phpMyRealty 2.0.0 - 'location' SQL Injection

CVE-2008-3445—webappsphp

SQL injection vulnerability in index.php in phpMyRealty (PMR) 2.0.0 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

F-PROT AntiVirus 6.2.1.4252 - Malformed Archive Infinite Loop Denial of Service

CVE-2008-3447—dosmultiple

The scanning engine in F-Prot Antivirus 6.2.1 4252 allows remote attackers to cause a denial of service (infinite loop)

23RISK

open ↗

Referência✓ VexDay Proof

aflog 1.01 - Cross-Site Scripting / SQL Injection

CVE-2008-0398—webappsphp

Cross-site scripting (XSS) vulnerability in aflog 1.01, and possibly earlier versions, allows remote attackers to inject

23RISK

open ↗

Referência✓ VexDay Proof

eStoreAff 0.1 - 'cid' SQL Injection

CVE-2008-3484—webappsphp

SQL injection vulnerability in eStoreAff 0.1 allows remote attackers to execute arbitrary SQL commands via the cid param

23RISK

open ↗

Referência✓ VexDay Proof

phpAuction GPL Enhanced 2.51 - 'profile.php' SQL Injection

CVE-2008-3487—webappsphp

SQL injection vulnerability in profile.php in PHPAuction GPL Enhanced 2.51 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

cyberBB 0.6 - Multiple SQL Injections

CVE-2008-3718—webappsphp

Multiple SQL injection vulnerabilities in cyberBB 0.6 allow remote authenticated users to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

Ad Board - 'id' SQL Injection

CVE-2008-3725—webappsphp

SQL injection vulnerability in trr.php in YourFreeWorld Ad Board Script allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Crafty Syntax Live Help 2.14.6 - 'department' SQL Injection

CVE-2008-3845—webappsphp

Multiple SQL injection vulnerabilities in Crafty Syntax Live Help (CSLH) 2.14.6 and earlier allow remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Windows - 'WRITE_ANDX' SMB Command Handling Kernel Denial of Service (Metasploit)

CVE-2008-4114—doswindows

srv.sys in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1

50RISK

open ↗

Referência✓ VexDay Proof

Attachmax Dolphin 2.1.0 - Multiple Vulnerabilities

CVE-2008-4206—webappsphp

PHP remote file inclusion vulnerability in config.php in Attachmax Dolphin 2.1.0 and earlier, when register_globals is e

23RISK

open ↗

Referência✓ VexDay Proof

CMS Buzz - 'id' SQL Injection

CVE-2008-4374—webappsphp

SQL injection vulnerability in index.php in CMS Buzz allows remote attackers to execute arbitrary SQL commands via the i

23RISK

open ↗

Referência✓ VexDay Proof

ibProArcade 3.3.0 - SQL Injection

CVE-2008-0770—webappsphp

SQL injection vulnerability in arcade.php in ibProArcade 3.3.0 and earlier allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component Comments 0.5.8.5g - SQL Injection

CVE-2008-0773—webappsphp

SQL injection vulnerability in Phil Taylor Comments (com_comments, aka Review Script) 0.5.8.5g and earlier component for

23RISK

open ↗

Referência✓ VexDay Proof

mIRC 6.34 - Remote Buffer Overflow

CVE-2008-4449—remotewindows

Stack-based buffer overflow in mIRC 6.34 allows remote attackers to execute arbitrary code via a long hostname in a PRIV

50RISK

open ↗

Referência✓ VexDay Proof

ESET SysInspector 1.1.1.0 - 'esiadrv.sys' (PoC)

CVE-2008-4451—doswindows

The SysInspector AntiStealth driver (esiasdrv.sys) 3.0.65535.0 in ESET System Analyzer Tool 1.1.1.0 allows local users t

23RISK

open ↗

Referência✓ VexDay Proof

more.groupware 0.74 - 'new_calendarid' SQL Injection

CVE-2006-4906—webappsphp

SQL injection vulnerability in modules/calendar/week.php in More.groupware 0.74 allows remote attackers to execute arbit

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.