Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,390cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,992Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Mic_blog 0.0.3 - SQL Injection / Privilege Escalation
CVE-2008-6805—webappsphp
Multiple SQL injection vulnerabilities in Mic_Blog 0.0.3, when magic_quotes_gpc is disabled, allow remote attackers to e
23RISK
open ↗
Referência✓ VexDay Proof
BP Blog 7.0 - 'layout' SQL Injection
CVE-2007-1445—webappsasp
SQL injection vulnerability in the heme preview feature for default.asp in BP Blog 7.0 through 7.0.2 allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
Link Trader - 'lnkid' SQL Injection
CVE-2008-6102—webappsphp
SQL injection vulnerability in ratelink.php in Link Trader Script allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities
CVE-2009-1948—webappsphp
Multiple directory traversal vulnerabilities in forum.php in Unclassified NewsBoard (UNB) 1.6.4, when register_globals i
23RISK
open ↗
Referência✓ VexDay Proof
phpBP RC3 (2.204) - SQL Injection / Remote Code Execution
CVE-2007-0370—webappsphp
Unrestricted file upload vulnerability in index.php in phpBP RC3 (2.204) and earlier allows remote administrators to inj
23RISK
open ↗
Referência✓ VexDay Proof
Oracle 10g/11g - 'SYS.LT.FINDRICSET' SQL Injection (1)
CVE-2007-5511—localmultiple
SQL injection vulnerability in Workspace Manager for Oracle Database before OWM 10.2.0.4.1, OWM 10.1.0.8.0, and OWM 9.2.
50RISK
open ↗
Referência✓ VexDay Proof
Oracle 10g/11g - 'SYS.LT.FINDRICSET' SQL Injection (2)
CVE-2007-5511—localmultiple
SQL injection vulnerability in Workspace Manager for Oracle Database before OWM 10.2.0.4.1, OWM 10.1.0.8.0, and OWM 9.2.
50RISK
open ↗
Referência✓ VexDay Proof
ECShop 2.5.0 - 'order_sn' SQL Injection
CVE-2009-1622—webappsphp
SQL injection vulnerability in user.php in EcShop 2.5.0 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
PeopleAggregator 1.2pre6-release-53 - Multiple Remote File Inclusions
CVE-2007-5631—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PeopleAggregator 1.2pre6, when register_globals is enabled, allow
35RISK
open ↗
Referência✓ VexDay Proof
PHP Project Management 0.8.10 - Multiple Local/Remote File Inclusions
CVE-2007-5641—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers t
35RISK
open ↗
Referência✓ VexDay Proof
EfesTECH Haber 5.0 - 'id' SQL Injection
CVE-2007-2662—webappsphp
SQL injection vulnerability in EfesTECH Haber 5.0 allows remote attackers to execute arbitrary SQL commands via the id p
23RISK
open ↗
Referência✓ VexDay Proof
Vanilla 1.1.3 - Blind SQL Injection
CVE-2007-5643—webappsphp
Multiple SQL injection vulnerabilities in Lussumo Vanilla 1.1.3 and earlier allow remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Vanilla 1.1.3 - Blind SQL Injection
CVE-2007-5644—webappsphp
Lussumo Vanilla 1.1.3 and earlier does not require admin privileges for (1) ajax/sortcategories.php and (2) ajax/sortrol
23RISK
open ↗
Referência✓ VexDay Proof
elvin bts 1.2.0 - Multiple Vulnerabilities
CVE-2009-2129—webappsphp
Cross-site request forgery (CSRF) vulnerability in login.php in Elvin 1.2.0 allows remote attackers to hijack the authen
23RISK
open ↗
Referência✓ VexDay Proof
Einstein 1.01 - Local Password Disclosure
CVE-2005-0619—localwindows
Einstein 1.0.1 stores sensitive information such as usernames and passwords in plaintext in the registry, which allows l
23RISK
open ↗
Referência✓ VexDay Proof
xweblog 2.1 - 'kategori.asp' SQL Injection
CVE-2006-5023—webappsasp
SQL injection vulnerability in kategori.asp in xweblog 2.1 and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
E-Smart Cart 1.0 - 'Product_ID' SQL Injection
CVE-2007-0092—webappsasp
SQL injection vulnerability in productdetail.asp in E-SMARTCART 1.0 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
eDocStore - 'doc.php?doc_id' SQL Injection
CVE-2007-3452—webappsphp
SQL injection vulnerability in essentials/minutes/doc.php in eDocStore allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component jooget 2.6.8 - SQL Injection
CVE-2008-0829—webappsphp
SQL injection vulnerability in jooget.php in the Joomlapixel Jooget! (com_jooget) 2.6.8 component for Joomla! and Mambo
23RISK
open ↗
Referência✓ VexDay Proof
EQdkp 1.3.2f - 'user_id' Authentication Bypass
CVE-2008-2222—webappsphp
SQL injection vulnerability in login.php in EQdkp 1.3.2f allows remote attackers to bypass EQdkp user authentication via
23RISK
open ↗
Referência✓ VexDay Proof
Link Bid Script 1.5 - Multiple SQL Injections
CVE-2008-4175—webappsphp
Multiple SQL injection vulnerabilities in Link Bid Script 1.5 allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component MamboWiki 0.9.6 - Remote File Inclusion
CVE-2006-4282—webappsphp
PHP remote file inclusion vulnerability in MamboLogin.php in the MamboWiki component (com_mambowiki) 0.9.6 and earlier f
23RISK
open ↗
Referência✓ VexDay Proof
FlashGet 1.9.0.1012 - 'FTP PWD Response' SEH Stack Overflow
CVE-2008-4321—remotewindows
Buffer overflow in FlashGet (formerly JetCar) FTP 1.9 allows remote FTP servers to execute arbitrary code via a long res
23RISK
open ↗
Referência✓ VexDay Proof
InstaGuide Weather Script 1.0 - 'index.php' Local File Inclusion
CVE-2007-5674—webappsphp
Directory traversal vulnerability in index.php in InstaGuide Weather (aka Weather for PHP) 1.0, when magic_quotes_gpc is
23RISK
open ↗
Referência✓ VexDay Proof
TorrentTrader Classic 1.09 - Multiple Vulnerabilities
CVE-2009-2156—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to in
23RISK
open ↗
Referência✓ VexDay Proof
Basic PHP Events Lister 1.0 - SQL Injection
CVE-2008-6464—webappsphp
SQL injection vulnerability in event.php in Mevin Productions Basic PHP Events Lister 1.0 allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
EgyPlus 7ml 1.0.1 - Authentication Bypass
CVE-2009-2168CRITICALwebappsphp
cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit whe
53RISK
open ↗
Referência✓ VexDay Proof
Mambo Component 'com_a6mambocredits' 1.0.0 - Remote File Inclusion
CVE-2006-4288—webappsphp
PHP remote file inclusion vulnerability in admin.a6mambocredits.php in the a6mambocredits component (com_a6mambocredits)
23RISK
open ↗
Referência✓ VexDay Proof
Discuz! 5.0.0 GBK - SQL Injection / Admin Credentials Disclosure
CVE-2006-5561—webappsphp
SQL injection vulnerability in admincp.php in Discuz! GBK 5.0.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
DigiRez 3.4 - 'book_id' SQL Injection
CVE-2007-0128—webappsasp
SQL injection vulnerability in info_book.asp in Digirez 3.4 and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗
← previouspage 167 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.