Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Tribisur 2.0 - SQL Injection
CVE-2008-0133—webappsphp
Multiple SQL injection vulnerabilities in Tribisur 2.1 and earlier allow remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
1Book Guestbook Script 1.0.1 - Code Execution
CVE-2008-2638—webappsphp
Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitr
23RISK
open ↗
Referência✓ VexDay Proof
WebPortal CMS 0.6-beta - Remote Password Change
CVE-2008-0142—webappsphp
Multiple SQL injection vulnerabilities in WebPortal CMS 0.6-beta allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
Shop-Script 2.0 - 'index.php' Remote File Disclosure
CVE-2008-0158—webappsphp
Directory traversal vulnerability in index.php in Shop-Script 2.0 and possibly other versions allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Softbiz Ad Management plus Script 1 - SQL Injection
CVE-2007-5998—webappsphp
SQL injection vulnerability in ads.php in Softbiz Ad Management plus Script 1 allows remote authenticated users to execu
23RISK
open ↗
Referência✓ VexDay Proof
IceBB 1.0-rc6 - Remote Database Authentication Details
CVE-2007-6083—webappsphp
SQL injection vulnerability in admin/index.php in IceBB 1.0-rc6 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
ZeroCMS 1.0 Alpha - Arbitrary File Upload / SQL Injection
CVE-2008-0232—webappsphp
Multiple SQL injection vulnerabilities in Zero CMS 1.0 Alpha allow remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
ZeroCMS 1.0 Alpha - Arbitrary File Upload / SQL Injection
CVE-2008-0233—webappsphp
Unrestricted file upload vulnerability in Zero CMS 1.0 Alpha and earlier allows remote attackers to bypass intended acce
23RISK
open ↗
Referência✓ VexDay Proof
QuickTime Player 7.3.1.70 - 'RTSP' Buffer Overflow (PoC)
CVE-2008-0234—doswindows
Buffer overflow in Apple Quicktime Player 7.3.1.70 and other versions before 7.4.1, when RTSP tunneling is enabled, allo
28RISK
open ↗
Referência✓ VexDay Proof
ResearchGuide 0.5 - 'id' SQL Injection
CVE-2008-2964—webappsphp
SQL injection vulnerability in guide.php in ResearchGuide 0.5 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
project alumni 1.0.9 - Cross-Site Scripting / SQL Injection
CVE-2007-6126—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
WorkingOnWeb 2.0.1400 - 'events.php' SQL Injection
CVE-2007-6128—webappsphp
SQL injection vulnerability in events.php in WorkingOnWeb 2.0.1400 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
Small Axe 0.3.1 - 'cfile' Remote File Inclusion
CVE-2008-0376—webappsphp
PHP remote file inclusion vulnerability in inc/linkbar.php in Small Axe Weblog 0.3.1 allows remote attackers to execute
35RISK
open ↗
Referência✓ VexDay Proof
Crystal Reports XI Release 2 (Enterprise Tree Control) - ActiveX Buffer Overflow (Denial of Service) (PoC)
CVE-2008-0379—doswindows
Race condition in the Enterprise Tree ActiveX control (EnterpriseControls.dll 11.5.0.313) in Crystal Reports XI Release
23RISK
open ↗
Referência✓ VexDay Proof
IAPR COMMENCE 1.3 - Multiple Remote File Inclusions
CVE-2007-6147—webappsphp
Multiple PHP remote file inclusion vulnerabilities in IAPR COMMENCE 1.3 allow remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência✓ VexDay Proof
Toshiba Surveillance - 'MeIpCamX.dll 1.0.0.4' Remote Buffer Overflow
CVE-2008-0399—remotewindows
Multiple buffer overflows in Toshiba Surveillance (Surveillix) RecordSend ActiveX control (MeIpCamX.DLL 1.0.0.4) allow r
23RISK
open ↗
Referência✓ VexDay Proof
Invision Gallery 2.0.7 - SQL Injection
CVE-2008-0421—webappsphp
SQL injection vulnerability in Invision Gallery 2.0.7 and earlier allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
Liquid-Silver CMS 0.1 - 'update' Local File Inclusion
CVE-2008-0459—webappsphp
Directory traversal vulnerability in update/index.php in Liquid-Silver CMS 0.35, when magic_quotes_gpc is disabled, allo
23RISK
open ↗
Referência✓ VexDay Proof
Bigware Shop 2.0 - 'pollid' SQL Injection
CVE-2008-0498—webappsphp
SQL injection vulnerability in main_bigware_53.tpl.php in Bigware Shop 2.0 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Debian OpenSSH - (Authenticated) Remote SELinux Privilege Escalation
CVE-2008-3234—remotelinux
sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapshot, allows remote authenticated users to obtain ac
23RISK
open ↗
Referência✓ VexDay Proof
Borland Interbase 2007 - 'ibserver.exe' Buffer Overflow (PoC)
CVE-2008-1910—doswindows
Stack-based buffer overflow in the database service (ibserver.exe) in Borland InterBase 2007 SP2 allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
DivX Player 6.7 - '.srt' File Subtitle Parsing Buffer Overflow
CVE-2008-1912—localwindows
Stack-based buffer overflow in DivX Player 6.7 build 6.7.0.22 and earlier allows user-assisted remote attackers to cause
28RISK
open ↗
Referência✓ VexDay Proof
Vlbook 1.21 - Cross-Site Scripting / Local File Inclusion
CVE-2008-2072—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Virtual Design Studio vlbook 1.21 allows remote attackers to in
23RISK
open ↗
Referência✓ VexDay Proof
Vlbook 1.21 - Cross-Site Scripting / Local File Inclusion
CVE-2008-2073—webappsphp
Directory traversal vulnerability in include/global.inc.php in Virtual Design Studio vlbook 1.21 allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Project Based Calendaring System (PBCS) 0.7.1 - Multiple Vulnerabilities
CVE-2008-2216—webappsphp
Unrestricted file upload vulnerability in src/yopy_upload.php in Project-Based Calendaring System (PBCS) 0.7.1 allows re
23RISK
open ↗
Referência✓ VexDay Proof
Quicksilver Forums 1.2.1 - Remote File Inclusion
CVE-2006-4824—webappsphp
PHP remote file inclusion vulnerability in lib/activeutil.php in Quicksilver Forums (QSF) 1.2.1 and earlier allows remot
23RISK
open ↗
Referência✓ VexDay Proof
Content Management System for Phprojekt 0.6.1 - File Disclosure
CVE-2008-2217—webappsphp
Directory traversal vulnerability in cm/graphie.php in Content Management System 0.6.1 for Phprojekt allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
Shadowed Portal 5.599 - 'root' Remote File Inclusion
CVE-2006-4826—webappsphp
PHP remote file inclusion vulnerability in bottom.php in Shadowed Portal 5.599 and earlier allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
WebStudio eCatalogue - Blind SQL Injection
CVE-2008-5294—webappsphp
SQL injection vulnerability in index.php in WebStudio eCatalogue allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
PG Real Estate - Authentication Bypass
CVE-2008-5306—webappsphp
SQL injection vulnerability in admin/index.php in PG Real Estate Solution allows remote attackers to execute arbitrary S
23RISK
open ↗
← previouspage 137 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.