Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,388cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
PHP-Fusion Module topliste 1.0 - 'cid' SQL Injection
CVE-2007-1980—webappsphp
SQL injection vulnerability in index.php in the Topliste 1.0 module for PHP-Fusion allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
BibCiter 1.4 - Multiple SQL Injections
CVE-2009-0324—webappsphp
Multiple SQL injection vulnerabilities in BibCiter 1.4 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência✓ VexDay Proof
MKPortal 1.1.1 reviews / Gallery modules - SQL Injection
CVE-2007-3814—webappsphp
Multiple SQL injection vulnerabilities in MKPortal 1.1.1 allow remote attackers to execute arbitrary SQL commands via (1
23RISK
open ↗
Referência✓ VexDay Proof
PHP 5.2.3 Win32std - 'win_shell_execute' Safe Mode / disable_functions Bypass
CVE-2007-4010—localwindows
The win32std extension in PHP 5.2.3 does not follow safe_mode and disable_functions restrictions, which allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
PHP 5.2.3 - 'PHP_gd2.dll' imagepsloadfont Local Buffer Overflow (PoC)
CVE-2007-4033—doswindows
Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent at
28RISK
open ↗
Referência✓ VexDay Proof
Seditio CMS 121 - 'pfs.php' Arbitrary File Upload
CVE-2007-4057—webappsphp
Unrestricted file upload vulnerability in pfs.php in Neocrome Seditio 121 and earlier allows remote authenticated users
23RISK
open ↗
Referência✓ VexDay Proof
CoreHTTP 0.5.3alpha - HTTPd Remote Buffer Overflow
CVE-2007-4060—remotelinux
Multiple buffer overflows in the HttpSprockMake function in http.c in Frank Yaul corehttp 0.5.3alpha allow remote attack
23RISK
open ↗
Referência✓ VexDay Proof
Elecard AVC HD player - '.m3u' / '.xpl' Local Stack Overflow (PoC)
CVE-2009-0443—doswindows
Stack-based buffer overflow in Elecard AVC HD PLAYER 5.5.90116 allows remote attackers to execute arbitrary code via an
23RISK
open ↗
Referência✓ VexDay Proof
Clever Internet ActiveX Suite 6.2 - Arbitrary File Download/Overwrite
CVE-2007-4067—remotewindows
Absolute path traversal vulnerability in the clInetSuiteX6.clWebDav ActiveX control in CLINETSUITEX6.OCX in Clever Inter
23RISK
open ↗
Referência✓ VexDay Proof
PHPAuctionSystem - Cross-Site Scripting / SQL Injection
CVE-2009-0107—webappsphp
Cross-site scripting (XSS) vulnerability in profile.php in PHPAuctions (aka PHPAuctionSystem) allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Online Grades 3.2.4 - Authentication Bypass
CVE-2009-0452—webappsphp
Multiple SQL injection vulnerabilities in parents/login.php in Online Grades 3.2.4, when magic_quotes_gpc is disabled, a
23RISK
open ↗
Referência✓ VexDay Proof
sourdough 0.3.5 - Remote File Inclusion
CVE-2009-0456—webappsphp
PHP remote file inclusion vulnerability in examples/example_clientside_javascript.php in patForms, as used in Sourdough
23RISK
open ↗
Referência✓ VexDay Proof
Rankem - File Disclosure / Cross-Site Scripting / Cookie
CVE-2009-0248—webappsphp
Cross-site scripting (XSS) vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to inject arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
AdaptCMS Lite 1.4 - Cross-Site Scripting / Remote File Inclusion
CVE-2009-0527—webappsphp
PHP remote file inclusion vulnerability in plugins/rss_importer_functions.php in AdaptCMS Lite 1.4 allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
Live for Speed S1/S2/Demo - '.spr' Local Buffer Overflow
CVE-2007-4257—localwindows
Multiple buffer overflows in Live for Speed (LFS) S1 and S2 allow user-assisted remote attackers to execute arbitrary co
23RISK
open ↗
Referência✓ VexDay Proof
Flatnux 2009-01-27 - Remote File Inclusion
CVE-2009-0572—webappsphp
PHP remote file inclusion vulnerability in include/flatnux.php in FlatnuX CMS (aka Flatnuke3) 2009-01-27 and 2009-02-04,
23RISK
open ↗
Referência✓ VexDay Proof
Prozilla Pub Site Directory - 'Directory.php?cat' SQL Injection
CVE-2007-4258—webappsphp
SQL injection vulnerability in directory.php in Prozilla Pub Site Directory allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
DD-WRT HTTPd Daemon/Service - Remote Command Execution
CVE-2008-6974—remotehardware
Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp1 and earlier allow remote attack
23RISK
open ↗
Referência✓ VexDay Proof
Ncaster 1.7.2 - 'archive.php' Remote File Inclusion
CVE-2007-4320—webappsphp
PHP remote file inclusion vulnerability in admin/addons/archive/archive.php in Ncaster 1.7.2 allows remote attackers to
45RISK
open ↗
Referência✓ VexDay Proof
MDPro Module My_eGallery - 'pid' SQL Injection
CVE-2009-0728—webappsphp
SQL injection vulnerability in the My_eGallery module for MAXdev MDPro (MD-Pro) and Postnuke allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
S-CMS 1.1 Stable - Insecure Cookie Handling / Mass Page Delete
CVE-2009-0863—webappsphp
SQL injection vulnerability in admin/delete_page.php in S-Cms 1.1 Stable allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
Alstrasoft e-Friends 4.98 - 'seid' Multiple SQL Injections
CVE-2007-6106—webappsphp
SQL injection vulnerability in index.php in AlstraSoft E-Friends 4.98 and earlier allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Restaurante 1.0 - 'id' SQL Injection
CVE-2008-1465—webappsphp
SQL injection vulnerability in the Detodas Restaurante (com_restaurante) 1.0 component for Mambo and Joomla! allows remo
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component BibTeX 1.3 - Blind SQL Injection
CVE-2007-4502—webappsphp
SQL injection vulnerability in index.php in the BibTeX component (com_jombib) 1.3 and earlier for Joomla! allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Dew-NewPHPLinks 2.0 - Local File Inclusion / Cross-Site Scripting
CVE-2009-1623—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Links Management Application 1.0 - 'lcnt' SQL Injection
CVE-2007-1339—webappsphp
SQL injection vulnerability in index.php in Links Management Application 1.0 allows remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Weblogicnet - 'files_dir' Multiple Remote File Inclusions
CVE-2007-4715—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Weblogicnet allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗
Referência✓ VexDay Proof
Apple Mac OSX xnu 1228.x - 'hfs-fcntl' Kernel Privilege Escalation
CVE-2009-1235—localosx
XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space
23RISK
open ↗
Referência✓ VexDay Proof
GForge 4.5.19 - Multiple SQL Injections
CVE-2008-6187—webappsphp
SQL injection vulnerability in frs/shownotes.php in Gforge 4.5.19 and earlier allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
TurnkeyForms Web Hosting Directory - Multiple Vulnerabilities
CVE-2008-6941—webappsphp
SQL injection vulnerability in the login functionality in TurnkeyForms Web Hosting Directory allows remote attackers to
23RISK
open ↗
← previouspage 162 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.