Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,305cataloged exploits
36,465CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,466Referência 23,051GitHub PoC 15,051VulnCheck XDB 8,883Nuclei 4,361Metasploit 3,493✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
MODx CMS 0.9.6.2 - Remote File Inclusion / Cross-Site Scripting
CVE-2008-5938—webappsphp
PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier,
23RISK
open ↗
Referência✓ VexDay Proof
FTP Explorer 1.0.1 Build 047 - Remote CPU Consumption (Denial of Service)
CVE-2007-1082—doswindows
FTP Explorer 1.0.1 Build 047, and other versions before 1.0.1.52, allows remote servers to cause a denial of service (CP
23RISK
open ↗
Referência✓ VexDay Proof
XCMS 1.1 - 'Galerie.php' Local File Inclusion
CVE-2007-3523—webappsphp
Multiple directory traversal vulnerabilities in Module/Galerie.php in XCMS 1.1 allow remote attackers to include and exe
23RISK
open ↗
Referência✓ VexDay Proof
AJSquare Free Polling Script - 'DB' Multiple Vulnerabilities
CVE-2008-7045—webappsphp
AJ Square Free Polling Script (AJPoll) Database version allows remote attackers to bypass authentication and reset poll
23RISK
open ↗
Referência✓ VexDay Proof
PHPortal 1.0 - Insecure Cookie Handling
CVE-2009-2117—webappsphp
uye_paneli.php in phPortal 1.0 allows remote attackers to bypass authentication and obtain administrative access by sett
23RISK
open ↗
Referência✓ VexDay Proof
Contenido 4.8.4 - Remote File Inclusion / Cross-Site Scripting
CVE-2008-2912—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Contenido CMS 4.8.4 allow remote attackers to execute arbitrary PH
23RISK
open ↗
Referência✓ VexDay Proof
PHP Multiple Newsletters 2.7 - Local File Inclusion / Cross-Site Scripting
CVE-2008-5570—webappsphp
Directory traversal vulnerability in index.php in PHP Multiple Newsletters 2.7, when magic_quotes_gpc is disabled, allow
23RISK
open ↗
Referência✓ VexDay Proof
Apache Tomcat - 'WebDAV' Remote File Disclosure
CVE-2007-5461—remotemultiple
Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.
35RISK
open ↗
Referência✓ VexDay Proof
Mafia Scum Tools 2.0.0 - 'index.php?gen' Remote File Inclusion
CVE-2007-0501—webappsphp
PHP remote file inclusion vulnerability in index.php in Mafia Scum Tools 2.0.0 in Matthew Wardrop Advanced Random Genera
23RISK
open ↗
Referência✓ VexDay Proof
GNU/Gallery 1.1.1.0 - 'admin.php' Local File Inclusion
CVE-2008-2353—webappsphp
Directory traversal vulnerability in admin.php in GNU/Gallery 1.1.1.0 and earlier allows remote attackers to include and
23RISK
open ↗
Referência✓ VexDay Proof
PHP 4.4.6 - 'ibase_connect()' Local Buffer Overflow
CVE-2007-1475—localwindows
Multiple buffer overflows in the (1) ibase_connect and (2) ibase_pconnect functions in the interbase extension in PHP 4.
23RISK
open ↗
Referência✓ VexDay Proof
MyBlog: PHP and MySQL Blog/CMS software - SQL Injection / Cross-Site Scripting
CVE-2008-2963—webappsphp
Multiple SQL injection vulnerabilities in MyBlog allow remote attackers to execute arbitrary SQL commands via the (1) vi
23RISK
open ↗
Referência✓ VexDay Proof
Integramod Nederland 1.4.2 - Remote File Inclusion
CVE-2007-5140—webappsphp
PHP remote file inclusion vulnerability in includes/archive/archive_topic.php in IntegraMOD Nederland 1.4.2 allows remot
23RISK
open ↗
Referência✓ VexDay Proof
K-Lite Mega Codec Pack 3.5.7.0 - Local Windows Explorer Denial of Service (PoC)
CVE-2008-5072—doswindows
vsfilter.dll in K-Lite Mega Codec Pack 3.5.7.0 allows remote attackers to cause a denial of service (application crash)
23RISK
open ↗
Referência✓ VexDay Proof
teatro 1.6 - 'basePath' Remote File Inclusion
CVE-2007-5780—webappsphp
PHP remote file inclusion vulnerability in pub/pub08_comments.php in teatro 1.6 allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
VHD Web Pack 2.0 - 'index.php' Local File Inclusion
CVE-2008-0609—webappsphp
Directory traversal vulnerability in index.php in DivideConcept VHD Web Pack 2.0 allows remote attackers to include and
23RISK
open ↗
Referência✓ VexDay Proof
LightBlog 9.6 - 'Username' Local File Inclusion
CVE-2008-0840—webappsphp
Directory traversal vulnerability in view_member.php in Public Warehouse LightBlog 9.6 allows remote attackers to includ
23RISK
open ↗
Referência✓ VexDay Proof
Mini File Host 1.2 - 'language' Local File Inclusion
CVE-2008-0357—webappsphp
Directory traversal vulnerability in pages/upload.php in Galaxyscripts Mini File Host 1.2.1 and earlier allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
Kmita Tellfriend 2.0 - 'file' Remote File Inclusion
CVE-2008-2198—webappsphp
PHP remote file inclusion vulnerability in kmitaadmin/kmitat/htmlcode.php in Kmita Tellfriend 2.0 and earlier, when regi
23RISK
open ↗
Referência✓ VexDay Proof
PortalApp 4.0 - SQL Injection / Cross-Site Scripting / Authentication Bypass
CVE-2008-4613—webappsasp
SQL injection vulnerability in forums.asp in PortalApp 4.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
eSHOP100 - 'SUB' SQL Injection
CVE-2008-5190—webappsphp
SQL injection vulnerability in index.php in eSHOP100 allows remote attackers to execute arbitrary SQL commands via the S
23RISK
open ↗
Referência✓ VexDay Proof
OpenX 2.6 - 'bannerid' Blind SQL Injection
CVE-2008-6163—webappsphp
SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
DevelopItEasy Events Calendar 1.2 - Multiple SQL Injections
CVE-2008-6608—webappsphp
Multiple SQL injection vulnerabilities in DevelopItEasy Events Calendar 1.2 allow remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
GuestCal 2.1 - 'index.php?lang' Local File Inclusion
CVE-2009-1319—webappsphp
Directory traversal vulnerability in includes/ini.inc.php in GuestCal 2.1 allows remote attackers to include and execute
23RISK
open ↗
Referência✓ VexDay Proof
Chipmunk Blog - (Authentication Bypass) Add Admin
CVE-2009-0399—webappsphp
Chipmunk Blogger Script allows remote attackers to gain administrator privileges via a direct request to admin/reguser.p
23RISK
open ↗
Referência✓ VexDay Proof
Syntax Desktop 2.7 - 'synTarget' Local File Inclusion
CVE-2009-0448—webappsphp
Directory traversal vulnerability in admin/modules/aa/preview.php in Syntax Desktop 2.7 allows remote attackers to inclu
23RISK
open ↗
Referência✓ VexDay Proof
CNStats 2.9 - 'who_r.php?bj' Remote File Inclusion
CVE-2007-2086—webappsphp
Multiple PHP remote file inclusion vulnerabilities in CNStats 2.9 allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗
Referência✓ VexDay Proof
Flip 3.0 - Remote Admin Creation
CVE-2007-5062—webappsphp
account.php in Adam Scheinberg Flip 3.0 and earlier allows remote attackers to create administrative accounts via the un
23RISK
open ↗
Referência✓ VexDay Proof
Catviz 0.4.0 beta1 - Local File Inclusion / Cross-Site Scripting
CVE-2009-1748—webappsphp
Multiple directory traversal vulnerabilities in index.php in Catviz 0.4.0 Beta 1 allow remote attackers to read arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Verlihub Control Panel 1.7.x - Local File Inclusion
CVE-2007-5321—webappsphp
Directory traversal vulnerability in index.php in Verlihub Control Panel (VHCP) 1.7 and earlier allows remote attackers
23RISK
open ↗
← previouspage 155 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.