Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,388cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Syntax Desktop 2.7 - 'synTarget' Local File Inclusion
CVE-2009-0448—webappsphp
Directory traversal vulnerability in admin/modules/aa/preview.php in Syntax Desktop 2.7 allows remote attackers to inclu
23RISK
open ↗
Referência✓ VexDay Proof
CoolPlayer Portable 2.19.1 - '.m3u' Local Buffer Overflow (1)
CVE-2009-1437—localwindows
Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka CoolPlayer+ Portable) 2.19.6 and earlier allows rem
28RISK
open ↗
Referência✓ VexDay Proof
Catviz 0.4.0 beta1 - Local File Inclusion / Cross-Site Scripting
CVE-2009-1748—webappsphp
Multiple directory traversal vulnerabilities in index.php in Catviz 0.4.0 Beta 1 allow remote attackers to read arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Nuked-klaN 1.7.6 - Remote Code Execution
CVE-2007-2556—webappsphp
SQL injection vulnerability in Nuked-klaN 1.7.6 allows remote attackers to execute arbitrary SQL commands via the X-Forw
23RISK
open ↗
Referência✓ VexDay Proof
Flip 3.0 - Remote Admin Creation
CVE-2007-5062—webappsphp
account.php in Adam Scheinberg Flip 3.0 and earlier allows remote attackers to create administrative accounts via the un
23RISK
open ↗
Referência✓ VexDay Proof
Verlihub Control Panel 1.7.x - Local File Inclusion
CVE-2007-5321—webappsphp
Directory traversal vulnerability in index.php in Verlihub Control Panel (VHCP) 1.7 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Acc PHP eMail 1.1 - Insecure Cookie Handling
CVE-2008-6291—webappsphp
Acc PHP eMail 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the NEWSLET
23RISK
open ↗
Referência✓ VexDay Proof
yourplace 1.0.2 - Multiple Vulnerabilities / Remote Code Execution
CVE-2008-6772—webappsphp
login/register_form.php in YourPlace 1.0.2 and earlier does not check that a username already exists when a new account
23RISK
open ↗
Referência✓ VexDay Proof
MySpeach 3.0.7 - Local/Remote File Inclusion
CVE-2007-1895—webappsphp
PHP remote file inclusion vulnerability in chat.php in Sky GUNNING MySpeach 3.0.7 and earlier, when used with PHP 5, all
23RISK
open ↗
Referência✓ VexDay Proof
Archangel Weblog 0.90.02 - Local File Inclusion / Authentication Bypass
CVE-2007-2574—webappsphp
Directory traversal vulnerability in index.php in Archangel Weblog 0.90.02 allows remote attackers to read arbitrary fil
23RISK
open ↗
Referência✓ VexDay Proof
Blakord Portal Beta 1.3.A (All Modules) - SQL Injection
CVE-2007-6565—webappsphp
Multiple SQL injection vulnerabilities in Blakord Portal 1.3.A Beta and earlier allow remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Adobe Reader - 'util.printf()' JavaScript Function Stack Overflow (2)
CVE-2008-2992HIGHunder attackransomwarelocalwindows
Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary c
100RISK
open ↗
Referência✓ VexDay Proof
Libra PHP File Manager 1.18/2.0 - Local File Inclusion
CVE-2008-4319—webappsphp
fileadmin.php in Libra File Manager (aka Libra PHP File Manager) 1.18 and earlier allows remote attackers to bypass auth
23RISK
open ↗
Referência✓ VexDay Proof
WebPortal CMS 0.8b - Multiple Local/Remote File Inclusions
CVE-2009-1445—webappsphp
Multiple directory traversal vulnerabilities in WebPortal CMS 0.8-beta allow remote attackers to (1) read arbitrary file
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Update 2.7 - '/admin/uploads.php' Remote Code Execution
CVE-2006-6878—webappsphp
admin/uploads.php in PHP-Update 2.7 and earlier allows remote attackers to gain privileges by setting the rights[7] para
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component module autostand 1.0 - Remote File Inclusion
CVE-2007-2319—webappsphp
PHP remote file inclusion vulnerability in the AutoStand 1.1 and earlier module for Joomla! allows remote attackers to e
23RISK
open ↗
Referência✓ VexDay Proof
phpMyPortal 3.0.0 RC3 - GLOBALS[CHEMINMODULES] Remote File Inclusion
CVE-2007-2594—webappsphp
PHP remote file inclusion vulnerability in inc/articles.inc.php in phpMyPortal 3.0.0 RC3 allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
TurnkeyForms Local Classifieds - Cross-Site Scripting / SQL Injection
CVE-2008-6351—webappsphp
Cross-site scripting (XSS) vulnerability in listtest.php in TurnkeyForms Local Classifieds allows remote attackers to in
23RISK
open ↗
Referência✓ VexDay Proof
SMA-DB 0.3.13 - Multiple Remote File Inclusions
CVE-2009-1452—webappsphp
Multiple PHP remote file inclusion vulnerabilities in theme/format.php in SMA-DB 0.3.13 allow remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
Harpia CMS 1.0.5 - Remote File Inclusion
CVE-2006-7024—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Harpia CMS 1.0.5 and earlier allow remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Thyme Calendar 1.3 - SQL Injection
CVE-2007-2621—webappsphp
SQL injection vulnerability in event_view.php in Thyme Calendar 1.3 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke platinum 7.6.b.5 - Remote File Inclusion
CVE-2007-5676—webappsphp
PHP remote file inclusion vulnerability in modules/Forums/favorites.php in PHP-Nuke Platinum 7.6.b.5 allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
Pritlog 0.4 - 'Filename' Remote File Disclosure
CVE-2008-6012—webappsphp
Directory traversal vulnerability in index.php in Pritlog 0.4 and earlier, when magic_quotes_gpc is disabled, allows rem
23RISK
open ↗
Referência✓ VexDay Proof
Studio Lounge Address Book 2.5 - 'profile' Arbitrary File Upload
CVE-2009-1483—webappsphp
Unrestricted file upload vulnerability in upload-file.php in Adam Patterson Studio Lounge Address Book 2.5, as reachable
23RISK
open ↗
Referência✓ VexDay Proof
R2K Gallery 1.7 - 'galeria.php?lang2' Local File Inclusion
CVE-2007-2642—webappsphp
Directory traversal vulnerability in galeria.php in R2K Gallery 1.7 allows remote attackers to read arbitrary files via
23RISK
open ↗
Referência✓ VexDay Proof
Prozilla Reviews Script 1.0 - Arbitrary Delete User
CVE-2008-1783—webappsphp
Prozilla Reviews 1.0 allows remote attackers to delete arbitrary users via a modified UserID parameter in a direct reque
23RISK
open ↗
Referência✓ VexDay Proof
Meto Forum 1.1 - Multiple SQL Injections
CVE-2008-2448—webappsasp
Multiple SQL injection vulnerabilities in Meto Forum 1.1 allow remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
Sisplet CMS 2008-01-24 - 'id' SQL Injection
CVE-2008-3026—webappsphp
SQL injection vulnerability in index.php in OneClick CMS (aka Sisplet CMS) 2008-01-24 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Ol BookMarks Manager 0.7.5 - Local File Inclusion / Remote File Inclusion / SQL Injection
CVE-2008-6408—webappsphp
PHP remote file inclusion vulnerability in frame.php in ol'bookmarks manager 0.7.5 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
ScriptMagix Jokes 2.0 - 'index.php?catid' SQL Injection
CVE-2007-1615—webappsphp
SQL injection vulnerability in index.php in ScriptMagix Jokes 2.0 and earlier allows remote attackers to execute arbitra
23RISK
open ↗
← previouspage 158 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.