Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,388cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
mini-pub 0.3 - File Disclosure / Code Execution
CVE-2008-5579—webappsphp
Absolute path traversal vulnerability in mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to read
23RISK
open ↗
Referência✓ VexDay Proof
txtshop 1.0b (Windows) - 'Language' Local File Inclusion
CVE-2008-6083—webappsphp
Directory traversal vulnerability in header.php in TXTshop beta 1.0 allows remote attackers to include and execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
Gretech GOM Encoder 1.0.0.11 - '.Subtitle' Buffer Overflow (PoC)
CVE-2009-1022—doswindows
Heap-based buffer overflow in the Preview/ Set Segment function in Gretech GOMlab GOM Encoder 1.0.0.11 and earlier allow
23RISK
open ↗
Referência✓ VexDay Proof
unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities
CVE-2009-1949—webappsphp
import_wbb1.php in Unclassified NewsBoard (UNB) 1.6.4 allows remote attackers to obtain sensitive information via a dire
23RISK
open ↗
Referência✓ VexDay Proof
WFTPD Pro Server 3.25 - Site ADMN Remote Denial of Service
CVE-2007-0311—doswindows
Texas Imperial Software WFTPD and WFTPD Pro Server 3.25 and earlier allow remote attackers to cause a denial of service
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke - 'iframe.php' Remote File Inclusion
CVE-2007-1626—webappsphp
PHP remote file inclusion vulnerability in iframe.php in the iFrame Module for PHP-NUKE allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
Noticeware Email Server 4.6.1.0 - Denial of Service
CVE-2008-1713—doswindows
MailServer.exe in NoticeWare Email Server 4.6.1.0 allows remote attackers to cause a denial of service (application cras
23RISK
open ↗
Referência✓ VexDay Proof
Scientific Image DataBase 0.41 - Blind SQL Injection
CVE-2008-2834—webappsphp
SQL injection vulnerability in projects.php in Scientific Image DataBase 0.41 allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
e107 < 0.7.13 - 'usersettings.php' Blind SQL Injection
CVE-2008-5320—webappsphp
SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute
23RISK
open ↗
Referência✓ VexDay Proof
Philex 0.2.3 - Remote File Inclusion / File Disclosure
CVE-2007-1698—webappsphp
download.php in Philex 0.2.3 and earlier allows remote attackers to read arbitrary files and source code, and obtain sen
23RISK
open ↗
Referência✓ VexDay Proof
Online Grades 3.2.4 - Authentication Bypass
CVE-2009-0453—webappsphp
Online Grades 3.2.4 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, whi
23RISK
open ↗
Referência✓ VexDay Proof
Orbit Downloader 2.8.7 - Arbitrary File Deletion
CVE-2009-1064—remotewindows
Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allow
23RISK
open ↗
Referência✓ VexDay Proof
Techno Dreams Articles & Papers 2.0 - SQL Injection
CVE-2006-4891—webappsasp
SQL injection vulnerability in ArticlesTableview.asp in Techno Dreams Articles & Papers Package 2.0 and earlier allows r
23RISK
open ↗
Referência✓ VexDay Proof
OwnRS blog beta3 - SQL Injection / Cross-Site Scripting
CVE-2008-2856—webappsphp
SQL injection vulnerability in clanek.php in OwnRS Beta 3 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
Apple iTunes 8.0.2.20/QuickTime 7.5.5 - '.mov' Multiple Off By Overflows (PoC)
CVE-2008-5406—doswindows
Stack-based buffer overflow in Apple QuickTime Player 7.5.5 and iTunes 8.0.2.20 allows remote attackers to cause a denia
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke Module AddressBook 1.2 - Local File Inclusion
CVE-2007-1720—webappsphp
Directory traversal vulnerability in addressbook.php in the Addressbook 1.2 module for PHP-Nuke allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Flatnuke 3 - Remote Command Execution / Privilege Escalation
CVE-2007-5774—webappsphp
index.php in the File Manager module in Flatnuke 3 allows remote attackers to obtain sensitive information via an invali
23RISK
open ↗
Referência✓ VexDay Proof
PHP Live Helper 2.0.1 - Multiple Vulnerabilities
CVE-2008-3763—webappsphp
Variable overwrite vulnerability in libsecure.php in Turnkey PHP Live Helper 2.0.1 and earlier, when register_globals is
23RISK
open ↗
Referência✓ VexDay Proof
nuseo PHP enterprise 1.6 - Remote File Inclusion
CVE-2007-5409—webappsphp
PHP remote file inclusion vulnerability in admin/nuseo_admin_d.php in NuSEO PHP Enterprise 1.6 (NuSEO.PHP), when registe
23RISK
open ↗
Referência✓ VexDay Proof
TlGuestBook 1.2 - Insecure Cookie Handling
CVE-2008-5065—webappsphp
TlGuestBook 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlGuestBo
23RISK
open ↗
Referência✓ VexDay Proof
Apache Geronimo 2.1.3 - Multiple Directory Traversal Vulnerabilities
CVE-2008-5518—remotemultiple
Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1
35RISK
open ↗
Referência✓ VexDay Proof
mini-pub 0.3 - Local Directory Traversal / File Disclosure
CVE-2008-5883—webappsphp
Absolute path traversal vulnerability in front-end/dir.php in mini-pub 0.3 and earlier allows remote attackers to list a
23RISK
open ↗
Referência✓ VexDay Proof
MyPicGallery 1.0 - Arbitrary Add Admin
CVE-2008-2347—webappsphp
MyPicGallery 1.0 allows remote attackers to bypass application authentication and gain administrative access by setting
23RISK
open ↗
Referência✓ VexDay Proof
odars CMS 1.0.2 - Remote File Inclusion
CVE-2008-2885—webappsphp
PHP remote file inclusion vulnerability in src/browser/resource/categories/resource_categories_view.php in Open Digital
23RISK
open ↗
Referência✓ VexDay Proof
Stash 1.0.3 - Insecure Cookie Handling
CVE-2008-4081—webappsphp
admin/login.php in Stash 1.0.3 allows remote attackers to bypass authentication and gain administrative access by settin
23RISK
open ↗
Referência✓ VexDay Proof
Atomic Photo Album 1.1.0pre4 - Insecure Cookie Handling
CVE-2008-4714—webappsphp
Atomic Photo Album 1.1.0 pre4 does not properly handle the apa_cookie_login and apa_cookie_password cookies, which proba
23RISK
open ↗
Referência✓ VexDay Proof
Professional Download Assistant 0.1 - Authentication Bypass
CVE-2008-5571—webappsasp
SQL injection vulnerability in admin/login.asp in Professional Download Assistant 0.1 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Vivvo Article Manager 3.2 - 'id' SQL Injection
CVE-2006-4715—webappsphp
SQL injection vulnerability in pdf_version.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earl
23RISK
open ↗
Referência✓ VexDay Proof
A+ PHP Scripts - Nms Insecure Cookie Handling
CVE-2008-6667—webappsphp
A+ PHP Scripts News Management System (NMS) allows remote attackers to bypass authentication and gain administrator priv
23RISK
open ↗
Referência✓ VexDay Proof
Softerra Time-Assistant 6.2 - 'inc_dir' Remote File Inclusion
CVE-2007-1787—webappsphp
Multiple PHP remote file inclusion vulnerabilities in lib/timesheet.class.php in Softerra Time-Assistant 6.2 and earlier
23RISK
open ↗
← previouspage 163 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.