Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,390cataloged exploits

40,212CVEs with public exploitation

24,696lab-tested

All Referência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,992Nuclei 4,547Metasploit 3,531✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

Tiger Dms - Authentication Bypass

CVE-2009-1503—webappsphp

Multiple SQL injection vulnerabilities in login.php in Tiger Document Management System (DMS) allow remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

MaxCMS 2.0 - 'm_username' Arbitrary Create Admin

CVE-2009-1818—webappsphp

SQL injection vulnerability in admin/admin_manager.asp in MaxCMS 2.0 allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

Toko Instan 7.6 - Multiple SQL Injections

CVE-2007-6004—webappsphp

Multiple SQL injection vulnerabilities in index.php in Toko Instan 7.6 allow remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Symantec BackupExec Calendar Control - 'PVCalendar.ocx' Remote Buffer Overflow

CVE-2007-6016—remotewindows

Multiple stack-based buffer overflows in the PVATLCalendar.PVCalendar.1 ActiveX control in pvcalendar.ocx in the schedul

50RISK

open ↗

Referência✓ VexDay Proof

myEvent 1.6 - 'eventdate' SQL Injection

CVE-2008-4650—webappsphp

SQL injection vulnerability in viewevent.php in myEvent 1.6 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component mambads 1.0 RC1 Beta - SQL Injection

CVE-2008-5226—webappsphp

SQL injection vulnerability in the MambAds (com_mambads) component 1.0 RC1 Beta and 1.0 RC1 for Mambo allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Carousel Flash Image Gallery - Remote File Inclusion

CVE-2007-6027—webappsphp

PHP remote file inclusion vulnerability in admin.jjgallery.php in the Carousel Flash Image Gallery (com_jjgallery) compo

23RISK

open ↗

Referência✓ VexDay Proof

SHOP-INET 4 - 'grid' SQL Injection

CVE-2009-0292—webappsphp

SQL injection vulnerability in show_cat2.php in SHOP-INET 4 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component juser 1.0.14 - Remote File Inclusion

CVE-2007-6038—webappsphp

PHP remote file inclusion vulnerability in xajax_functions.php in the JUser (com_juser) 1.0.14 component for Joomla! all

28RISK

open ↗

Referência✓ VexDay Proof

DevMass Shopping Cart 1.0 - Remote File Inclusion

CVE-2007-6133—webappsphp

PHP remote file inclusion vulnerability in admin/kfm/initialise.php in DevMass Shopping Cart 1.0 and earlier allows remo

23RISK

open ↗

Referência✓ VexDay Proof

PHPKIT 1.6.4pl1 - 'article.php' SQL Injection

CVE-2007-6134—webappsphp

SQL injection vulnerability in pkinc/public/article.php in PHPKIT 1.6.4pl1 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

deeemm CMS (dmcms) 0.7.4 - Multiple Vulnerabilities

CVE-2008-3720—webappsphp

SQL injection vulnerability in index.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

MyCard 1.0.2 - 'id' SQL Injection

CVE-2008-4738—webappsphp

SQL injection vulnerability in gallery.php in MyCard 1.0.2 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

ASPSiteWare Home Builder 1.0/2.0 - SQL Injection

CVE-2008-5774—webappsasp

Multiple SQL injection vulnerabilities in ASPSiteWare HomeBuilder 1.0 and 2.0 allow remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

AJSquare Free Polling Script - 'DB' Multiple Vulnerabilities

CVE-2008-7044—webappsphp

SQL injection vulnerability in admin/include/newpoll.php in AJ Square Free Polling Script (AJPoll) Database version allo

23RISK

open ↗

Referência✓ VexDay Proof

Apple Safari / QuickTime 7.3 - RTSP Content-Type Remote Buffer Overflow

CVE-2007-6166—remoteosx

Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac

50RISK

open ↗

Referência✓ VexDay Proof

E-topbiz Number Links 1 - 'id' SQL Injection

CVE-2008-5804—webappsphp

SQL injection vulnerability in admin/admin_catalog.php in e-topbiz Number Links 1 Php Script allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

SFS EZ Auction - Blind SQL Injection

CVE-2008-6778—webappsphp

SQL injection vulnerability in viewfaqs.php in Scripts for Sites (SFS) EZ Auction allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component live chat - SQL Injection / Open Proxy

CVE-2008-6883—webappsphp

SQL injection vulnerability in the Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

project alumni 1.0.9 - 'index.php?act' Local File Inclusion

CVE-2007-6184—webappsphp

Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute ar

23RISK

open ↗

Referência✓ VexDay Proof

phpBB Garage 1.2.0 Beta3 - SQL Injection

CVE-2007-6223—webappsphp

SQL injection vulnerability in garage.php in phpBB Garage 1.2.0 Beta3 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Riddles Complete Website 1.2.1 - 'riddleid' SQL Injection

CVE-2008-5166—webappsphp

SQL injection vulnerability in riddle.php in Riddles Website 1.2.1 allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

PG Job Site - Blind SQL Injection

CVE-2008-6117—webappsphp

SQL injection vulnerability in homepage.php in PG Job Site Pro allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

phpBB 3 - Mod Tag Board 4 Blind SQL Injection

CVE-2008-6314—webappsphp

SQL injection vulnerability in tag_board.php in the Tag Board module 4.0 and earlier for phpBB allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

WEBBDOMAIN Post Card 1.02 - Authentication Bypass

CVE-2008-6623—webappsphp

SQL injection vulnerability in getin.php in WEBBDOMAIN Post Card (aka Web Postcards) 1.02 and earlier allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

SH-News 3.0 - 'comments.php' SQL Injection

CVE-2007-6391—webappsphp

SQL injection vulnerability in patch/comments.php in SH-News 3.0 allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

YACS CMS 6.6.1 - context[path_to_root] Remote File Inclusion

CVE-2006-4532—webappsphp

PHP remote file inclusion vulnerability in articles/article.php in Yet Another Community System (YACS) CMS 6.6.1 and ear

23RISK

open ↗

Referência✓ VexDay Proof

NewsLetter 3.5 - 'NL_PATH' Remote File Inclusion

CVE-2006-3986—webappsphp

PHP remote file inclusion vulnerability in index.php in Knusperleicht Newsletter 3.5 and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

PG Matchmaking Script - Multiple SQL Injections

CVE-2008-4665—webappsphp

SQL injection vulnerability in PG Matchmaking allows remote attackers to execute arbitrary SQL commands via the id param

23RISK

open ↗

Referência✓ VexDay Proof

k_shoutbox 4.4 - Remote File Inclusion

CVE-2006-3989—webappsphp

PHP remote file inclusion vulnerability in index.php in Knusperleicht Shoutbox 4.4 and earlier allows remote attackers t

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.