Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,186cataloged exploits

40,156CVEs with public exploitation

24,696lab-tested

All Referência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

PHPMyInventory 2.8 - 'global.inc.php' Remote File Inclusion

CVE-2007-3270—webappsphp

PHP remote file inclusion vulnerability in Includes/global.inc.php in phpMyInventory 2.8 allows remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

WebSVN 2.0 - Cross-Site Scripting / File Handling / Code Execution

CVE-2008-5920—webappsphp

The create_anchors function in utils.inc in WebSVN 1.x allows remote attackers to execute arbitrary PHP code via a craft

23RISK

open ↗

Referência✓ VexDay Proof

ShoutPro 1.5.2 - 'shout.php' Remote Code Injection

CVE-2007-2141—webappsphp

Direct static code injection vulnerability in shoutbox.php in ShoutPro 1.5.2 allows remote attackers to inject arbitrary

35RISK

open ↗

Referência✓ VexDay Proof

Dart Communications PowerTCP FTP module - Remote Buffer Overflow

CVE-2008-4652—remotewindows

Buffer overflow in the ActiveX control (DartFtp.dll) in Dart Communications PowerTCP FTP for ActiveX 2.0.2 0 allows remo

28RISK

open ↗

Referência✓ VexDay Proof

ASX to MP3 Converter - '.m3u' Local Stack Overflow (PoC)

CVE-2009-1324—doswindows

Stack-based buffer overflow in Mini-stream ASX to MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary cod

28RISK

open ↗

Referência✓ VexDay Proof

CyberLink PowerDVD - CreateNewFile Remote Rewrite Denial of Service

CVE-2007-5219—doswindows

Directory traversal vulnerability in the CLAVSetting.CLSetting.1 ActiveX control in CLAVSetting.DLL 1.00.1829 in the CLA

28RISK

open ↗

Referência✓ VexDay Proof

eLineStudio Site Composer (ESC) 2.6 - Multiple Vulnerabilities

CVE-2008-2861—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote atta

23RISK

open ↗

Referência✓ VexDay Proof

pPIM 1.0 - Arbitrary File Delete / Cross-Site Scripting

CVE-2008-4425—webappsphp

Directory traversal vulnerability in upload.php in Phlatline's Personal Information Manager (pPIM) 1.0 allows remote att

23RISK

open ↗

Referência✓ VexDay Proof

MODx CMS 0.9.2.1 - 'FCKeditor' Remote File Inclusion

CVE-2006-5730—webappsphp

PHP remote file inclusion vulnerability in manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php in Modx CMS

23RISK

open ↗

Referência✓ VexDay Proof

ClaSS 0.8.60 - 'export.php' Local File Inclusion

CVE-2008-5856—webappsphp

Directory traversal vulnerability in scripts/export.php in ClaSS before 0.8.61 allows remote attackers to read arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Durian Web Application Server 3.02 - Remote Buffer Overflow

CVE-2006-6853—remotewindows

Buffer overflow in Durian Web Application Server 3.02 freeware on Windows allows remote attackers to execute arbitrary c

23RISK

open ↗

Referência✓ VexDay Proof

phpEventCalendar 0.2.3 - 'eventdisplay.php' SQL Injection

CVE-2007-3519—webappsphp

SQL injection vulnerability in eventdisplay.php in phpEventCalendar 0.2.3 and earlier allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

Keller Web Admin CMS 0.94 Pro - Local File Inclusion (1)

CVE-2008-6734—webappsphp

Directory traversal vulnerability in Public/index.php in Keller Web Admin CMS 0.94 Pro allows remote attackers to includ

23RISK

open ↗

Referência✓ VexDay Proof

Max.Blog 1.0.6 - Arbitrary Delete Post

CVE-2009-0383—webappsphp

delete.php in Max.Blog 1.0.6 does not properly restrict access, which allows remote attackers to delete arbitrary blog p

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component MMP 1.2 - Remote File Inclusion

CVE-2006-4203—webappsphp

PHP remote file inclusion vulnerability in help.mmp.php in the MMP Component (com_mmp) 1.2 and earlier for Mambo allows

23RISK

open ↗

Referência✓ VexDay Proof

AEP SmartGate 4.3b - 'GET' Arbitrary File Download

CVE-2006-5596—remotewindows

Directory traversal vulnerability in the SSL server in AEP Smartgate 4.3b allows remote attackers to download arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

EasyNews PRO News Publishing 4.0 - Password Disclosure

CVE-2006-6866—webappsphp

STphp EasyNews PRO 4.0 stores sensitive information under the web root with insufficient access control, which allows re

23RISK

open ↗

Referência✓ VexDay Proof

Adobe Photoshop CS2 / CS3 - '.bmp' Local Buffer Overflow

CVE-2007-2244—localwindows

Multiple buffer overflows in Adobe Photoshop CS2 and CS3, Illustrator CS3, and GoLive 9 allow user-assisted remote attac

35RISK

open ↗

Referência✓ VexDay Proof

MG-SOFT Net Inspector 6.5.0.828 - Multiple Vulnerabilities

CVE-2008-1400—remotewindows

Directory traversal vulnerability in the Net Inspector HTTP Server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earl

23RISK

open ↗

Referência✓ VexDay Proof

gelato CMS 0.95 - 'img' Remote File Disclosure

CVE-2008-3675—webappsphp

Directory traversal vulnerability in classes/imgsize.php in Gelato 0.95 allows remote attackers to read arbitrary files

23RISK

open ↗

Referência✓ VexDay Proof

Falt4 CMS RC4 - 'FCKeditor' Arbitrary File Upload

CVE-2008-6178—webappsphp

Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2

23RISK

open ↗

Referência✓ VexDay Proof

Newswriter SW 1.42 - 'editfunc.inc.php' File Inclusion

CVE-2006-5102—webappsphp

PHP remote file inclusion vulnerability in include/editfunc.inc.php in Sebastian Baumann and Philipp Wolfer Newswriter S

23RISK

open ↗

Referência✓ VexDay Proof

Vivvo Article Manager 3.4 - 'root' Local File Inclusion

CVE-2007-1031—webappsphp

Directory traversal vulnerability in include/db_conn.php in SpoonLabs Vivvo Article Management CMS 3.4 allows remote att

23RISK

open ↗

Referência✓ VexDay Proof

Ext 1.0 - 'feed-proxy.php?feed' Remote File Disclosure

CVE-2007-2285—webappsphp

Directory traversal vulnerability in examples/layout/feed-proxy.php in Jack Slocum Ext 1.0 alpha1 (Ext JS) allows remote

28RISK

open ↗

Referência✓ VexDay Proof

xeCMS 1.x - 'view.php' Remote File Disclosure

CVE-2007-6508—webappsphp

Directory traversal vulnerability in view.php in xeCMS 1.0 allows remote attackers to read arbitrary files via a ..%2F (

23RISK

open ↗

Referência✓ VexDay Proof

Pollbooth 2.0 - 'pollID' SQL Injection

CVE-2008-4765—webappsphp

SQL injection vulnerability in pollBooth.php in osCommerce Poll Booth Add-On 2.0 allows remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

CyberBrau 0.9.4 - '/forum/track.php' Remote File Inclusion

CVE-2006-5400—webappsphp

PHP remote file inclusion vulnerability in forum/track.php in CyberBrau 0.9.4, when register_globals is enabled, allows

23RISK

open ↗

Referência✓ VexDay Proof

NMDeluxe 1.0.1 - 'footer.php?template' Local File Inclusion

CVE-2007-2303—webappsphp

Directory traversal vulnerability in includes/footer.php in News Manager Deluxe (NMDeluxe) 1.0.1 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

PHP-Stats 0.1.9.2 - Multiple Vulnerabilities

CVE-2007-5452—webappsphp

Multiple SQL injection vulnerabilities in php-stats.recjs.php in Php-Stats 0.1.9.2 allow remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

aflog 1.01 - Multiple Insecure Cookie Handling Vulnerabilities

CVE-2008-4784—webappsphp

aflog 1.01 allows remote attackers to bypass authentication and gain administrative access by setting the aflog_auth_a c

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.