Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,305cataloged exploits
36,465CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,466Referência 23,051GitHub PoC 15,051VulnCheck XDB 8,883Nuclei 4,361Metasploit 3,493✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
FishCart 3.2 RC2 - 'fc_example.php' Remote File Inclusion
CVE-2007-4287—webappsphp
PHP remote file inclusion vulnerability in fc_functions/fc_example.php in FishCart 3.2 RC2 and earlier allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
eLineStudio Site Composer (ESC) 2.6 - Multiple Vulnerabilities
CVE-2008-2862—webappsphp
Multiple SQL injection vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
Simple HTTPd 1.38 - Multiple Vulnerabilities
CVE-2007-6405—remotewindows
Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI progra
23RISK
open ↗
Referência✓ VexDay Proof
Mapbender 2.4.4 - 'gaz' SQL Injection
CVE-2008-0301—webappsphp
Multiple SQL injection vulnerabilities in Mapbender 2.4.4 allow remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Referência✓ VexDay Proof
NewLife Blogger 3.0 - Insecure Cookie Handling / SQL Injection
CVE-2008-6180—webappsphp
SQL injection vulnerability in system/nlb_user.class.php in NewLife Blogger 3.0 and earlier, and possibly 3.3.1, allows
23RISK
open ↗
Referência✓ VexDay Proof
ComVironment 4.0 - 'grab_globals.lib.php' Remote File Inclusion
CVE-2007-0395—webappsphp
PHP remote file inclusion vulnerability in libraries/grab_globals.lib.php in ComVironment 4.0 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Phaos R4000 Version - 'file' Remote File Disclosure
CVE-2008-1755—webappsphp
Directory traversal vulnerability in the showSource function in showSource.php in World of Phaos 4.0.1 allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
BbZL.php 0.92 - 'lien_2' Local Directory Traversal
CVE-2008-4707—webappsphp
Directory traversal vulnerability in index.php in BbZL.PhP 0.92 allows remote attackers to access unauthorized directori
23RISK
open ↗
Referência✓ VexDay Proof
VS-Link-Partner 2.1 - 'script_pfad' Remote File Inclusion
CVE-2007-1025—webappsphp
PHP remote file inclusion vulnerability in inc/functions_inc.php in VS-Link-Partner 2.1 and earlier allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
WebKalk2 1.9.0 - 'absolute_path' Remote File Inclusion
CVE-2007-2307—webappsphp
PHP remote file inclusion vulnerability in engine/engine.inc.php in WebKalk2 1.9.0 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
TorrentTrader Classic 1.07 - Multiple Vulnerabilities
CVE-2007-5312—webappsphp
Cross-site scripting (XSS) vulnerability in TorrentTrader Classic 1.07 allows remote attackers to inject arbitrary web s
23RISK
open ↗
Referência✓ VexDay Proof
LiveAlbum 0.9.0 - 'common.php' Remote File Inclusion
CVE-2007-5315—webappsphp
PHP remote file inclusion vulnerability in common.php in LiveAlbum 0.9.0, when register_globals is enabled, allows remot
35RISK
open ↗
Referência✓ VexDay Proof
SG Real Estate Portal 2.0 - Blind SQL Injection / Local File Inclusion
CVE-2008-6010—webappsphp
Multiple directory traversal vulnerabilities in SG Real Estate Portal 2.0 allow remote attackers to read arbitrary files
23RISK
open ↗
Referência✓ VexDay Proof
Minigal b13 - Remote File Disclosure
CVE-2008-6933—webappsphp
Directory traversal vulnerability in index.php in MiniGal b13 (aka MG2) allows remote attackers to read the source code
23RISK
open ↗
Referência✓ VexDay Proof
CcMail 1.0.1 - 'functions_dir' Remote File Inclusion
CVE-2007-1516—webappsphp
PHP remote file inclusion vulnerability in functions/update.php in Cicoandcico CcMail 1.0 allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
OWL Intranet Engine 0.82 - 'xrms_file_root' Code Execution
CVE-2006-1149—webappsphp
PHP remote file inclusion vulnerability in lib/OWL_API.php in OWL Intranet Engine 0.82, when register_globals is enabled
23RISK
open ↗
Referência✓ VexDay Proof
FreeCMS.us 0.2 - 'index.php' SQL Injection
CVE-2008-2796—webappsphp
SQL injection vulnerability in index.php in FreeCMS 0.2 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
mystats - 'hits.php' Multiple Vulnerabilities
CVE-2008-4644—webappsphp
hits.php in myWebland myStats allows remote attackers to bypass IP address restrictions via a modified X-Forwarded-For H
23RISK
open ↗
Referência✓ VexDay Proof
Yerba SACphp 6.3 - Multiple Vulnerabilities
CVE-2008-5873—webappsphp
Yerba SACphp 6.3 and earlier allows remote attackers to bypass authentication and gain administrative access via a galle
23RISK
open ↗
Referência✓ VexDay Proof
ravennuke 2.3.0 - Multiple Vulnerabilities
CVE-2009-0673—webappsphp
Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.3
23RISK
open ↗
Referência✓ VexDay Proof
Easy-Clanpage 3.0b1 - 'section' Local File Inclusion
CVE-2008-2818—webappsphp
Directory traversal vulnerability in Easy-Clanpage 3.0 b1 allows remote attackers to include and execute arbitrary local
23RISK
open ↗
Referência✓ VexDay Proof
registroTL - 'main.php' Remote File Inclusion
CVE-2006-5316—webappsphp
registroTL stores sensitive information under the web root with insufficient access control, which allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
DodosMail 2.0.1 - 'dodosmail.php' Remote File Inclusion
CVE-2006-5841—webappsphp
Multiple PHP remote file inclusion vulnerabilities in dodosmail.php in DodosMail 2.0.1 and earlier, and possibly 2.1, al
23RISK
open ↗
Referência✓ VexDay Proof
PHPEasyNews 1.13 RC2 - 'POST' SQL Injection
CVE-2008-2823—webappsphp
SQL injection vulnerability in newsarchive.php in PHPeasyblog (formerly phpeasynews) 1.13 RC2 and earlier allows remote
23RISK
open ↗
Referência✓ VexDay Proof
gCards 1.45 - Multiple Vulnerabilities
CVE-2006-1347—webappsphp
SQL injection vulnerability in loginfunction.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
APC ActionApps CMS 2.8.1 - Remote File Inclusion
CVE-2006-2686—webappsphp
PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a
28RISK
open ↗
Referência✓ VexDay Proof
Socketwiz BookMarks 2.0 - 'root_dir' Remote File Inclusion
CVE-2006-7069—webappsphp
PHP remote file inclusion vulnerability in smarty_config.php in Socketwiz Bookmarks 2.0 and earlier allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
NetProxy 4.03 - Web Filter Evasion / Bypass Logging
CVE-2007-1224—remotewindows
Grok Developments NetProxy 4.03 allows remote attackers to bypass URL filtering via a request that omits "http://" from
23RISK
open ↗
Referência✓ VexDay Proof
Hot Open Tickets 11012004 - 'CLASS_PATH' Remote File Inclusion
CVE-2006-2730—webappsphp
PHP remote file inclusion vulnerability in admin/lib_action_step.php in Hot Open Tickets (HOT) 11012004_ver2f, when regi
23RISK
open ↗
Referência✓ VexDay Proof
Maxtrade AIO 1.3.23 - 'categori' SQL Injection
CVE-2008-2847—webappsphp
SQL injection vulnerability in the Trade module in Maxtrade AIO 1.3.23 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
← previouspage 152 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.