Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,305cataloged exploits
36,465CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,466Referência 23,051GitHub PoC 15,051VulnCheck XDB 8,883Nuclei 4,361Metasploit 3,493✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
SimpCMS - 'keyword' SQL Injection
CVE-2007-4953—webappsphp
SQL injection vulnerability in index.php in SimpCMS allows remote attackers to execute arbitrary SQL commands via the ke
23RISK
open ↗
Referência✓ VexDay Proof
KwsPHP 1.0 sondages Module - SQL Injection
CVE-2007-4979—webappsphp
SQL injection vulnerability in index.php in the sondages module in KwsPHP 1.0 allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
MW6 Technologies QRCode ActiveX 3.0 - Remote File Overwrite
CVE-2007-4982—remotewindows
Multiple absolute path traversal vulnerabilities in the MW6QRCode.QRCode.1 ActiveX control in MW6QRCode.dll in MW6 Techn
28RISK
open ↗
Referência✓ VexDay Proof
Zervit Web Server 0.02 - Remote Buffer Overflow (PoC)
CVE-2009-1353—doswindows
Buffer overflow in the http_parse_hex function in libz/misc.c in Zervit Webserver 0.02 allows remote attackers to cause
23RISK
open ↗
Referência✓ VexDay Proof
Elecard AVC HD Player - '.XPL' Stack Buffer Overflow (SEH) (PoC)
CVE-2009-1356—doswindows
Stack-based buffer overflow in Elecard AVC HD Player allows remote attackers to execute arbitrary code via a long MP3 fi
23RISK
open ↗
Referência✓ VexDay Proof
Teraway LiveHelp 2.0 - Insecure Cookie Handling
CVE-2009-1618—webappsphp
Teraway LiveHelp 2.0 allows remote attackers to bypass authentication and gain administrative access via a pwd=&lvl=1&us
23RISK
open ↗
Referência✓ VexDay Proof
Soulseek 157 NS x/156.x - Remote Distributed Search Code Execution
CVE-2009-1830—doswindows
Stack-based buffer overflow in Soulseek 156 and 157 NS allows remote attackers to execute arbitrary code via a long sear
23RISK
open ↗
Referência✓ VexDay Proof
Winamp 5.55 - MAKI Script Universal Overwrite (SEH)
CVE-2009-1831—localwindows
The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute
50RISK
open ↗
Referência✓ VexDay Proof
phpBugTracker 1.0.3 - Authentication Bypass
CVE-2009-1850—webappsphp
SQL injection vulnerability in index.php in phpBugTracker 1.0.3 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
OCS Inventory NG 1.02 - Remote File Disclosure
CVE-2009-2166—webappsphp
Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to re
23RISK
open ↗
Referência✓ VexDay Proof
vBulletin Radio and TV Player AddOn - HTML Injection
CVE-2009-2172—webappsphp
Cross-site scripting (XSS) vulnerability in forum/radioandtv.php in the Radio and TV Player addon for vBulletin allows r
23RISK
open ↗
Referência✓ VexDay Proof
Advanced Poll 2.0.5-dev - Remote Admin Session Generator
CVE-2007-0845—webappsphp
admin/index.php in Advanced Poll 2.0.0 through 2.0.5-dev allows remote attackers to bypass authentication and gain admin
23RISK
open ↗
Referência✓ VexDay Proof
Open-Realty 2.4.3 - 'last_module' Remote Code Execution
CVE-2007-5056—webappsphp
Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including
28RISK
open ↗
Referência✓ VexDay Proof
ClanSphere 2007.4 - 'cat_id' SQL Injection
CVE-2007-5061—webappsphp
SQL injection vulnerability in mods/banners/navlist.php in Clansphere 2007.4 allows remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Connectix Boards 0.7 - 'p_skin' Multiple Vulnerabilities
CVE-2007-1254—webappsphp
SQL injection vulnerability in part.userprofile.php in Connectix Boards 0.7 and earlier allows remote authenticated user
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Module Calendar (Agenda) 1.5.5 - Remote File Inclusion
CVE-2007-2049—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the Calendar Module (com_calendar) 1.5.5 for Mambo allow remote at
23RISK
open ↗
Referência✓ VexDay Proof
RicarGBooK 1.2.1 - 'lang' Local File Inclusion
CVE-2007-2050—webappsphp
Multiple directory traversal vulnerabilities in header.php in RicarGBooK 1.2.1 allow remote attackers to include and exe
23RISK
open ↗
Referência✓ VexDay Proof
Flip 3.0 - Remote Password Hash Disclosure
CVE-2007-5063—webappsphp
Adam Scheinberg Flip 3.0 and earlier stores sensitive information under the web root with insufficient access control, w
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_slideshow - Remote File Inclusion
CVE-2007-5065—webappsphp
PHP remote file inclusion vulnerability in admin.slideshow1.php in the Flash Slide Show (com_slideshow) component for Jo
35RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke addon Nuke Mobile Entartainment 1.0 - Local File Inclusion
CVE-2007-5069—webappsphp
Directory traversal vulnerability in data/compatible.php in the Nuke Mobile Entertainment 1 addon for PHP-Nuke allows re
23RISK
open ↗
Referência✓ VexDay Proof
Chupix CMS 0.2.3 - 'repertoire' Remote File Inclusion
CVE-2007-5139—webappsphp
PHP remote file inclusion vulnerability in admin/include/header.php in chupix 0.2.3, when register_globals is enabled, a
23RISK
open ↗
Referência✓ VexDay Proof
SyntaxCMS 1.3 - 'FCKeditor' Arbitrary File Upload
CVE-2007-5156—webappsphp
Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.
23RISK
open ↗
Referência✓ VexDay Proof
actSite 1.56 - 'news.php' Local File Inclusion
CVE-2007-5174—webappsphp
Directory traversal vulnerability in phpinc/news.php in actSite 1.56 allows remote attackers to include and execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component Mambads 1.5 - SQL Injection
CVE-2007-5177—webappsphp
SQL injection vulnerability in index.php in the MambAds (com_mambads) 1.5 and earlier component for Mambo allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Zomplog 3.8.1 - Arbitrary File Upload
CVE-2007-5230—webappsphp
admin/upload_files.php in Zomplog 3.8.1 and earlier does not check for administrative credentials, which allows remote a
23RISK
open ↗
Referência✓ VexDay Proof
Zomplog 3.8.1 - Arbitrary File Upload
CVE-2007-5231—webappsphp
Unrestricted file upload vulnerability in admin/upload_files.php in Zomplog 3.8.1 and earlier allows remote authenticate
23RISK
open ↗
Referência✓ VexDay Proof
Web Template Management System 1.3 - SQL Injection
CVE-2007-5233—webappsphp
SQL injection vulnerability in index.php in Web Template Management System 1.3 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
CMS Faethon 2.2 Ultimate - Remote File Inclusion / Cross-Site Scripting
CVE-2008-2127—webappsphp
Cross-site scripting (XSS) vulnerability in search.php in CMS Faethon 2.2 Ultimate allows remote attackers to inject arb
23RISK
open ↗
Referência✓ VexDay Proof
Phpjobscheduler 3.0 - 'installed_config_file' File Inclusion
CVE-2006-5928—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Phpjobscheduler 3.0 allow remote attackers to execute arbitrary PH
23RISK
open ↗
Referência✓ VexDay Proof
RsGallery2 < 1.11.2 - 'rsgallery.html.php' File Inclusion
CVE-2006-6962—webappsphp
PHP remote file inclusion vulnerability in rsgallery2.html.php in the RS Gallery2 component (com_rsgallery2) 1.11.2 for
23RISK
open ↗
← previouspage 148 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.