Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,150cataloged exploits

39,601CVEs with public exploitation

24,695lab-tested

All Referência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

verlihub 0.9.8d-RC2 - Remote Command Execution

CVE-2008-5706—remotelinux

The cTrigger::DoIt function in src/ctrigger.cpp in the trigger mechanism in the daemon in Verlihub 0.9.8d-RC2 and earlie

23RISK

open ↗

Referência✓ VexDay Proof

TCPDB 3.8 - Arbitrary Add Admin Account

CVE-2009-1670—webappsphp

user/index.php in TCPDB 3.8 does not require administrative authentication, which allows remote attackers to add admin a

23RISK

open ↗

Referência✓ VexDay Proof

CMME 1.12 - Local File Inclusion / Cross-Site Scripting / Cross-Site Request Forgery/Download Backup/Make Directory

CVE-2008-3926—webappsphp

Multiple directory traversal vulnerabilities in Content Management Made Easy (CMME) 1.12 allow remote attackers to (1) r

23RISK

open ↗

Referência✓ VexDay Proof

Frontis 3.9.01.24 - 'source_class' SQL Injection

CVE-2009-2013—webappsphp

SQL injection vulnerability in bin/aps_browse_sources.php in Frontis 3.9.01.24 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

ViArt CMS/Shop/Helpdesk 3.3.2 - Remote File Inclusion

CVE-2007-6347—webappsphp

PHP remote file inclusion vulnerability in blocks/block_site_map.php in ViArt (1) CMS 3.3.2, (2) HelpDesk 3.3.2, (3) Sho

23RISK

open ↗

Referência✓ VexDay Proof

Virtue Book Store - 'cid' SQL Injection

CVE-2009-2017—webappsphp

SQL injection vulnerability in products.php in Virtue Book Store allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

FaceBook PhotoUploader 5.0.14.0 - Remote Buffer Overflow

CVE-2008-5711—remotewindows

Heap-based buffer overflow in the Facebook PhotoUploader ActiveX control 5.0.14.0 and earlier allows remote attackers to

50RISK

open ↗

Referência✓ VexDay Proof

SAWStudio 3.9i - '.prf' Local Buffer Overflow (PoC)

CVE-2008-5722—doswindows

Buffer overflow in SAWStudio 3.9i allows user-assisted remote attackers to cause a denial of service (application crash)

28RISK

open ↗

Referência✓ VexDay Proof

MyCars Automotive - Authentication Bypass

CVE-2009-2018—webappsphp

SQL injection vulnerability in admin/index.php in Jared Eckersley MyCars, when magic_quotes_gpc is disabled, allows remo

23RISK

open ↗

Referência✓ VexDay Proof

Active Web Mail 4 - Blind SQL Injection

CVE-2008-6873—webappsasp

SQL injection vulnerability in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL commands via the Tab

23RISK

open ↗

Referência✓ VexDay Proof

my-colex 1.4.2 - Authentication Bypass / SQL Injection / Cross-Site Scripting

CVE-2009-1825—webappsphp

modules/admuser.php in myColex 1.4.2 does not require administrative authentication, which allows remote authenticated u

23RISK

open ↗

Referência✓ VexDay Proof

my-gesuad 0.9.14 - Authentication Bypass / SQL Injection / Cross-Site Scripting

CVE-2009-1826—webappsphp

modules/admuser.php in myGesuad 0.9.14 (aka 0.9) does not require administrative authentication, which allows remote aut

23RISK

open ↗

Referência✓ VexDay Proof

virtue news - SQL Injection / Cross-Site Scripting

CVE-2009-2019—webappsphp

SQL injection vulnerability in news_detail.php in Virtue News Manager allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

EsFaq 2.0 - 'idcat' SQL Injection

CVE-2008-3952—webappsphp

SQL injection vulnerability in questions.php in EsFaq 2.0 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

TorrentVolve 1.4 - 'deleteTorrent' Delete Arbitrary File

CVE-2009-2101—webappsphp

Directory traversal vulnerability in archive.php in TorrentVolve 1.4, when register_globals is enabled, allows remote at

23RISK

open ↗

Referência✓ VexDay Proof

DB Top Sites 1.0 - Remote Command Execution

CVE-2009-2111—webappsphp

Static code injection vulnerability in add_reg.php in DB Top Sites 1.0 allows remote attackers to inject arbitrary PHP c

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component mosDirectory 2.3.2 - Remote File Inclusion

CVE-2007-6555—webappsphp

PHP remote file inclusion vulnerability in modules/mod_pxt_latest.php in the mosDirectory (com_directory) 2.3.2 componen

23RISK

open ↗

Referência✓ VexDay Proof

TekBase All-in-One 3.1 - Multiple SQL Injections

CVE-2009-2120—webappsphp

Multiple SQL injection vulnerabilities in TekBase All-in-One 3.1 allow remote authenticated users to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

OCS Inventory NG 1.02 - Remote File Disclosure

CVE-2009-2166—webappsphp

Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to re

23RISK

open ↗

Referência✓ VexDay Proof

EgyPlus 7ml 1.0.1 - Authentication Bypass

CVE-2009-2167—webappsphp

Multiple SQL injection vulnerabilities in cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier, when magic_quo

23RISK

open ↗

Referência✓ VexDay Proof

Easy Px 41 CMS 09.00.00B1 - 'fiche' Local File Inclusion

CVE-2009-1847—webappsphp

Directory traversal vulnerability in index.php in Easy PX 41 CMS 9.0 B1 allows remote attackers to include and execute a

23RISK

open ↗

Referência✓ VexDay Proof

vBulletin Radio and TV Player AddOn - HTML Injection

CVE-2009-2172—webappsphp

Cross-site scripting (XSS) vulnerability in forum/radioandtv.php in the Radio and TV Player addon for vBulletin allows r

23RISK

open ↗

Referência✓ VexDay Proof

WonderEdit Pro CMS (template_path) - Remote File Inclusion

CVE-2006-3422—webappsphp

PHP remote file inclusion vulnerability in WonderEdit Pro CMS allows remote attackers to execute arbitrary PHP code via

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component EZ Store Remote - Blind SQL Injection

CVE-2008-3586—webappsphp

SQL injection vulnerability in the EZ Store (com_ezstore) component for Joomla! allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

NmnNewsletter 1.0.7 - 'output' Remote File Inclusion

CVE-2007-6585—webappsphp

PHP remote file inclusion vulnerability in confirmUnsubscription.php in NmnNewsletter 1.0.7 allows remote attackers to e

23RISK

open ↗

Referência✓ VexDay Proof

OpenImpro 1.1 - 'image.php' SQL Injection

CVE-2008-3599—webappsphp

SQL injection vulnerability in image.php in OpenImpro 1.1 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

PozScripts Classified Ads Script - 'cid' SQL Injection

CVE-2008-3673—webappsphp

SQL injection vulnerability in browsecats.php in PozScripts Classified Ads allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

TubeGuru Video Sharing Script - 'UID' SQL Injection

CVE-2008-3674—webappsphp

SQL injection vulnerability in ugroups.php in PozScripts TubeGuru Video Sharing Script allows remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

CFAGCMS 1 - SQL Injection

CVE-2008-5781—webappsphp

SQL injection vulnerability in right.php in Cant Find A Gaming CMS (CFAGCMS) 1.0 Beta 1 allows remote attackers to execu

23RISK

open ↗

Referência✓ VexDay Proof

V3 Chat Live Support 3.0.4 - Insecure Cookie Handling

CVE-2008-5783—webappsphp

admin/index.php in V3 Chat Live Support 3.0.4 allows remote attackers to bypass authentication and gain administrative a

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.