Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,388cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
study planner (studiewijzer) 0.15 - Remote File Inclusion
CVE-2007-1628—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Study planner (Studiewijzer) 0.15 and earlier, when register_globa
23RISK
open ↗
Referência✓ VexDay Proof
registroTL - 'main.php' Remote File Inclusion
CVE-2006-5316—webappsphp
registroTL stores sensitive information under the web root with insufficient access control, which allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
DodosMail 2.0.1 - 'dodosmail.php' Remote File Inclusion
CVE-2006-5841—webappsphp
Multiple PHP remote file inclusion vulnerabilities in dodosmail.php in DodosMail 2.0.1 and earlier, and possibly 2.1, al
23RISK
open ↗
Referência✓ VexDay Proof
Lms 1.8.9 - Vala Remote File Inclusion
CVE-2007-1643—webappsphp
Multiple PHP remote file inclusion vulnerabilities in LAN Management System (LMS) 1.8.9 Vala and earlier allow remote at
28RISK
open ↗
Referência✓ VexDay Proof
Blog PixelMotion - 'sauvBase.php' Arbitrary Database Backup
CVE-2008-1868—webappsphp
admin/sauvBase.php in Blog Pixel Motion (aka Blog PixelMotion) does not require authentication, which allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
realm CMS 2.3 - Multiple Vulnerabilities
CVE-2008-2681—webappsphp
Realm CMS 2.3 and earlier allows remote attackers to obtain sensitive information via a direct request to _db/compact.as
23RISK
open ↗
Referência✓ VexDay Proof
Thickbox Gallery 2.0 - 'Admins.php' Admin Data Disclosure
CVE-2008-3859—webappsphp
Davlin Thickbox Gallery 2 allows remote attackers to obtain the administrative username and MD5 password hash via a dire
23RISK
open ↗
Referência✓ VexDay Proof
Bandwebsite 1.5 - SQL Injection / Cross-Site Scripting
CVE-2008-5337—webappsphp
SQL injection vulnerability in lyrics.php in Bandwebsite (aka Bandsite portal system) 1.5 allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
BS.Player 2.34 Build 980 - '.bsl' Local Buffer Overflow (SEH)
CVE-2009-1068—localwindows
Stack-based buffer overflow in BS.Player (bsplayer) 2.32 Build 975 Free and 2.34 Build 980 PRO and earlier allows remote
28RISK
open ↗
Referência✓ VexDay Proof
SimpleBlog 2.0 - 'comments.asp' SQL Injection (1)
CVE-2006-4300—webappsasp
SQL injection vulnerability in comments.asp in SimpleBlog 2.0 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
Barman 0.0.1r3 - 'Interface.php' Remote File Inclusion
CVE-2006-6611—webappsphp
PHP remote file inclusion vulnerability in interface.php in Barman 0.0.1r3 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
DM FileManager 3.9.2 - Insecure Cookie Handling
CVE-2009-2025—webappsphp
admin/login.php in DM FileManager 3.9.2 allows remote attackers to bypass authentication and gain administrative access
23RISK
open ↗
Referência✓ VexDay Proof
Techno Dreams Articles & Papers 2.0 - SQL Injection
CVE-2006-4891—webappsasp
SQL injection vulnerability in ArticlesTableview.asp in Techno Dreams Articles & Papers Package 2.0 and earlier allows r
23RISK
open ↗
Referência✓ VexDay Proof
OwnRS blog beta3 - SQL Injection / Cross-Site Scripting
CVE-2008-2856—webappsphp
SQL injection vulnerability in clanek.php in OwnRS Beta 3 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
Apple iTunes 8.0.2.20/QuickTime 7.5.5 - '.mov' Multiple Off By Overflows (PoC)
CVE-2008-5406—doswindows
Stack-based buffer overflow in Apple QuickTime Player 7.5.5 and iTunes 8.0.2.20 allows remote attackers to cause a denia
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke Module AddressBook 1.2 - Local File Inclusion
CVE-2007-1720—webappsphp
Directory traversal vulnerability in addressbook.php in the Addressbook 1.2 module for PHP-Nuke allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Flatnuke 3 - Remote Command Execution / Privilege Escalation
CVE-2007-5774—webappsphp
index.php in the File Manager module in Flatnuke 3 allows remote attackers to obtain sensitive information via an invali
23RISK
open ↗
Referência✓ VexDay Proof
PHP Live Helper 2.0.1 - Multiple Vulnerabilities
CVE-2008-3763—webappsphp
Variable overwrite vulnerability in libsecure.php in Turnkey PHP Live Helper 2.0.1 and earlier, when register_globals is
23RISK
open ↗
Referência✓ VexDay Proof
nuseo PHP enterprise 1.6 - Remote File Inclusion
CVE-2007-5409—webappsphp
PHP remote file inclusion vulnerability in admin/nuseo_admin_d.php in NuSEO PHP Enterprise 1.6 (NuSEO.PHP), when registe
23RISK
open ↗
Referência✓ VexDay Proof
TlGuestBook 1.2 - Insecure Cookie Handling
CVE-2008-5065—webappsphp
TlGuestBook 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlGuestBo
23RISK
open ↗
Referência✓ VexDay Proof
Apache Geronimo 2.1.3 - Multiple Directory Traversal Vulnerabilities
CVE-2008-5518—remotemultiple
Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1
35RISK
open ↗
Referência✓ VexDay Proof
mini-pub 0.3 - Local Directory Traversal / File Disclosure
CVE-2008-5883—webappsphp
Absolute path traversal vulnerability in front-end/dir.php in mini-pub 0.3 and earlier allows remote attackers to list a
23RISK
open ↗
Referência✓ VexDay Proof
shibby shop 2.2 - Multiple Vulnerabilities
CVE-2008-2872—webappsphp
SQL injection vulnerability in default.asp in sHibby sHop 2.2 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
Bonza Cart 1.10 - Admin Password Changing
CVE-2008-5567—webappsphp
Cross-site request forgery (CSRF) vulnerability in admin/ad_settings.php in Bonza Cart 1.10 and earlier allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
phpYabs 0.1.2 - 'Azione' Remote File Inclusion
CVE-2009-0639—webappsphp
PHP remote file inclusion vulnerability in moduli/libri/index.php in phpyabs 0.1.2 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
Gigaset SE461 WiMAX Router - Remote Denial of Service
CVE-2009-1152—doshardware
Siemens Gigaset SE461 WiMAX router 1.5-BL024.9.6401, and possibly other versions, allows remote attackers to cause a den
23RISK
open ↗
Referência✓ VexDay Proof
PhpCommander 3.0 - 'upload' Remote Code Execution
CVE-2006-4636—webappsphp
Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute a
23RISK
open ↗
Referência✓ VexDay Proof
WebBuilder 2.0 - 'StageLoader.php' Remote File Inclusion
CVE-2007-0703—webappsphp
PHP remote file inclusion vulnerability in library/StageLoader.php in WebBuilder 2.0 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Webavis 0.1.1 - 'class.php?root' Remote File Inclusion
CVE-2007-2943—webappsphp
PHP remote file inclusion vulnerability in class/class.php in Webavis 0.1.1 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
PBEmail 7 - ActiveX Edition Insecure Method
CVE-2007-5446—remotewindows
Absolute path traversal vulnerability in a certain ActiveX control in PBEmail7Ax.dll in PBEmail 7 ActiveX Edition allows
23RISK
open ↗
← previouspage 159 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.