Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,388cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
HomePH Design 2.10 RC2 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2008-2980—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in HomePH Design 2.10 RC2 allow remote attackers to inject arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
AV Arcade 2.1b - 'index.php?id' SQL Injection
CVE-2007-3563—webappsphp
SQL injection vulnerability in includes/view_page.php in AV Arcade 2.1b allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
MemHT Portal 3.9.0 - Remote Create Shell
CVE-2008-4457—webappsphp
SQL injection vulnerability in inc/inc_statistics.php in MemHT Portal 3.9.0 and earlier, when magic_quotes_gpc is disabl
23RISK
open ↗
Referência✓ VexDay Proof
Click&Rank - SQL Injection / Cross-Site Scripting
CVE-2008-5889—webappsasp
Cross-site scripting (XSS) vulnerability in user.asp in Click&Rank allows remote attackers to inject arbitrary web scrip
23RISK
open ↗
Referência✓ VexDay Proof
OpenSSL < 0.9.8i - DTLS ChangeCipherSpec Remote Denial of Service
CVE-2009-1386—dosmultiple
ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and
60RISK
open ↗
Referência✓ VexDay Proof
elvin bts 1.2.0 - Multiple Vulnerabilities
CVE-2009-2127—webappsphp
Cross-site scripting (XSS) vulnerability in show_activity.php in Elvin 1.2.0 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
CMS Made Simple 1.2 - Remote Code Execution
CVE-2007-5056—webappsphp
Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including
28RISK
open ↗
Referência✓ VexDay Proof
Journalness 4.1 - 'last_module' Remote Code Execution
CVE-2007-5056—webappsphp
Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including
28RISK
open ↗
Referência✓ VexDay Proof
webEdition CMS - 'we_objectID' Blind SQL Injection
CVE-2008-4154—webappsphp
SQL injection vulnerability in living-e webEdition CMS allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência✓ VexDay Proof
Girlserv ads 1.5 - 'details_news.php' SQL Injection
CVE-2007-3583—webappsphp
SQL injection vulnerability in details_news.php in Girlserv ads 1.5 and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
CoolPlayer Portable 2.19.1 - 'Skin' Local Buffer Overflow
CVE-2009-1449—localwindows
Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka CoolPlayer+ Portable) 2.19.1 allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
microTopic 1 - 'Rating' Blind SQL Injection
CVE-2009-1661—webappsphp
SQL injection vulnerability in admin/utopic.php in uTopic 1.0, when magic_quotes_gpc is disabled, allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
PHPMyRealty 1.0.x - 'search.php' SQL Injection
CVE-2007-6472—webappsphp
Multiple SQL injection vulnerabilities in phpMyRealty (PMR) 1.0.9 allow (1) remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component Quran 1.1 - 'surano' SQL Injection
CVE-2008-0832—webappsphp
SQL injection vulnerability in index.php in the Kemas Antonius com_quran 1.1 and earlier component for Mambo and Joomla!
23RISK
open ↗
Referência✓ VexDay Proof
Battle Blog 1.25 - 'comment.asp' SQL Injection
CVE-2008-2626—webappsphp
SQL injection vulnerability in comment.asp in Battle Blog 1.25 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
ITechBids 7.0 gold - Cross-Site Scripting / SQL Injection
CVE-2008-3238—webappsphp
Multiple SQL injection vulnerabilities in ITechBids 7.0 Gold allow remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
PHP Auto Dealer 2.7 - 'v_cat' SQL Injection
CVE-2008-4495—webappsphp
SQL injection vulnerability in view_cat.php in PHP Auto Dealer 2.7 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
PozScripts Classified Auctions - 'gotourl.php?id' SQL Injection
CVE-2008-4755—webappsphp
SQL injection vulnerability in gotourl.php in PozScripts Classified Auctions Script allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
ActiveVotes 2.2 - 'AccountID' Blind SQL Injection
CVE-2008-5365—webappsasp
SQL injection vulnerability in VoteHistory.asp in ActiveWebSoftwares ActiveVotes 2.2 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Poll Pro 2.0 - Authentication Bypass
CVE-2008-5573—webappsasp
SQL injection vulnerability in the login feature in Poll Pro 2.0 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
sma-db 0.3.12 - Remote File Inclusion / Cross-Site Scripting
CVE-2009-1451—webappsphp
Cross-site scripting (XSS) vulnerability in startpage.php in SMA-DB 0.3.12 allows remote attackers to inject arbitrary w
23RISK
open ↗
Referência✓ VexDay Proof
Tiny Blogr 1.0.0 rc4 - Authentication Bypass
CVE-2009-1453—webappsphp
SQL injection vulnerability in class.eport.php in Tiny Blogr 1.0.0 rc4, when magic_quotes_gpc is disabled, allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Pro Traffic One - 'poll_results.php' SQL Injection
CVE-2008-6214—webappsphp
SQL injection vulnerability in poll_results.php in Harlandscripts Pro Traffic One allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Koschtit Image Gallery 1.82 - Multiple Local File Inclusions
CVE-2009-1510—webappsphp
Multiple directory traversal vulnerabilities in KoschtIT Image Gallery 1.82 allow remote attackers to include and execut
23RISK
open ↗
Referência✓ VexDay Proof
mxBB Module mx_glance 2.3.3 - Remote File Inclusion
CVE-2007-5178—webappsphp
contrib/mx_glance_sdesc.php in the mx_glance 2.3.3 module for mxBB places a critical security check within a comment bec
23RISK
open ↗
Referência✓ VexDay Proof
SAPID Gallery 1.0 - 'ROOT_PATH' Remote File Inclusion
CVE-2006-4065—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Dmitry Sheiko SAPID Gallery 1.0 and earlier allow remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Solaris 8/9/10 - 'fifofs I_PEEK' Local Kernel Memory Leak
CVE-2007-5225—localsolaris
Integer signedness error in FIFO filesystems (named pipes) on Sun Solaris 8 through 10 allows local users to read the co
23RISK
open ↗
Referência✓ VexDay Proof
PHP Site Lock 2.0 - Insecure Cookie Handling
CVE-2009-1587—webappsphp
index.php in PHP Site Lock 2.0 allows remote attackers to bypass authentication and obtain administrative access by sett
23RISK
open ↗
Referência✓ VexDay Proof
Cisco VPN Client - IPSec Driver Local kernel system pool Corruption (PoC)
CVE-2008-0324—doswindows
Cisco Systems VPN Client IPSec Driver (CVPNDRVA.sys) 5.0.02.0090 allows local users to cause a denial of service (crash)
23RISK
open ↗
Referência✓ VexDay Proof
PHPVID 1.1 - Cross-Site Scripting / SQL Injection
CVE-2008-4157—webappsphp
SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 1.1 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
← previouspage 164 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.