Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,305cataloged exploits
36,465CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,466Referência 23,051GitHub PoC 15,051VulnCheck XDB 8,883Nuclei 4,361Metasploit 3,493✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
BBaCE 3.5 - '/includes/functions.php' Remote File Inclusion
CVE-2006-5187—webappsphp
PHP remote file inclusion vulnerability in includes/functions.php in Bulletin Board Ace (BBaCE) 3.5 and earlier allows r
23RISK
open ↗
Referência✓ VexDay Proof
Klinza Professional CMS 5.0.1 - 'show_hlp.php' File Inclusion
CVE-2006-5189—webappsphp
PHP remote file inclusion vulnerability in funzioni/lib/show_hlp.php in klinza professional cms 5.0.1 and earlier allows
23RISK
open ↗
Referência✓ VexDay Proof
4Images 1.7.1 - Local File Inclusion / Remote Code Execution
CVE-2006-0899—webappsphp
Directory traversal vulnerability in index.php in 4Images 1.7.1 and earlier allows remote attackers to read and include
23RISK
open ↗
Referência✓ VexDay Proof
FastStone Image Viewer 3.6 - '.BMP' Image Crash
CVE-2008-5870—doswindows
FastStone Image Viewer 3.6 allows user-assisted attackers to cause a denial of service (application crash) via a malform
23RISK
open ↗
Referência✓ VexDay Proof
phpBB Security Suite Mod 1.0.0 - 'logger_engine.php' Remote File Inclusion
CVE-2006-5224—webappsphp
PHP remote file inclusion vulnerability in includes/logger_engine.php in Dimitri Seitz Security Suite IP Logger 1.0.0 in
23RISK
open ↗
Referência✓ VexDay Proof
Freenews 1.1 - 'moteur.php' Remote File Inclusion
CVE-2006-5226—webappsphp
PHP remote file inclusion vulnerability in moteur/moteur.php in Prologin.fr Freenews 1.1 and earlier allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
OpenDock Easy Gallery 1.4 - 'doc_directory' File Inclusion
CVE-2006-5241—webappsphp
Multiple PHP remote file inclusion vulnerabilities in OpenDock Easy Gallery 1.4 and earlier, when register_globals is en
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component com_registration_detailed 4.1 - Remote File Inclusion
CVE-2006-5254—webappsphp
PHP remote file inclusion vulnerability in registration_detailed.inc.php in Mark Van Bellen Detailed User Registration (
23RISK
open ↗
Referência✓ VexDay Proof
aspwebalbum 3.2 - Multiple Vulnerabilities
CVE-2004-1553—webappsasp
SQL injection vulnerability in aspWebAlbum allows remote attackers to execute arbitrary SQL statements via (1) the usern
23RISK
open ↗
Referência✓ VexDay Proof
aspwebalbum 3.2 - Arbitrary File Upload / SQL Injection / Cross-Site Scripting
CVE-2004-1553—webappsphp
SQL injection vulnerability in aspWebAlbum allows remote attackers to execute arbitrary SQL statements via (1) the usern
23RISK
open ↗
Referência✓ VexDay Proof
Limbo CMS - Private Messaging Component SQL Injection
CVE-2008-6078—webappsphp
SQL injection vulnerability in open.php in the Private Messaging (com_privmsg) component for Limbo CMS allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
Minichat 6.0 - 'ftag.php' Remote File Inclusion
CVE-2006-5283—webappsphp
PHP remote file inclusion vulnerability in ftag.php in Minichat 6.0 allows remote attackers to execute arbitrary PHP cod
23RISK
open ↗
Referência✓ VexDay Proof
Cdsagenda 4.2.9 - 'SendAlertEmail.php' File Inclusion
CVE-2006-5384—webappsphp
PHP remote file inclusion vulnerability in modification/SendAlertEmail.php in CDS Software Consortium CDS Agenda 4.2.9 a
23RISK
open ↗
Referência✓ VexDay Proof
phpBB SpamOborona Mod 1.0b - Remote File Inclusion
CVE-2006-5385—webappsphp
PHP remote file inclusion vulnerability in admin/admin_spam.php in the SpamOborona 1.0b and earlier phpBB module allows
23RISK
open ↗
Referência✓ VexDay Proof
Ultrastats 0.2.144/0.3.11 - 'serverid' SQL Injection
CVE-2008-6260—webappsphp
SQL injection vulnerability in index.php in Ultrastats 0.2.144 and 0.3.11 allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
Apoll 0.7b - Authentication Bypass
CVE-2008-6270—webappsphp
SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
YaBBSM 3.0.0 - 'Offline.php' Remote File Inclusion
CVE-2006-5413—webappsphp
Multiple PHP remote file inclusion vulnerabilities in SuperMod 3.0.0 for YABB (YaBBSM) allow remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Apoll 0.7b - Authentication Bypass
CVE-2008-6272—webappsphp
SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
Multiple Membership Script 2.5 - 'id' SQL Injection
CVE-2008-6362—webappsphp
SQL injection vulnerability in sitepage.php in Multiple Membership Script 2.5 allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
PHP AMX 0.90 - '/plugins/main.php' Remote File Inclusion
CVE-2006-5427—webappsphp
PHP remote file inclusion vulnerability in plugins/main.php in Php AMX 0.9.0, when register_globals is enabled or magic_
23RISK
open ↗
Referência✓ VexDay Proof
e107 - 'include()' Remote File Upload
CVE-2004-2262—webappsphp
ImageManager in e107 before 0.617 does not properly check the types of uploaded files, which allows remote attackers to
28RISK
open ↗
Referência✓ VexDay Proof
Brim 1.2.1 - 'renderer' Multiple Remote File Inclusions
CVE-2006-5429—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Barry Nauta BRIM 1.2.1 and earlier allow remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
PHPPowerCards 2.10 - 'txt.inc.php' Remote Code Execution
CVE-2006-5432—webappsphp
Multiple direct static code injection vulnerabilities in db/txt.inc.php in phpPowerCards 2.10, when register_globals is
23RISK
open ↗
Referência✓ VexDay Proof
ActualAnalyzer - 'ant' Cookie Command Execution (Metasploit)
CVE-2014-5470CRITICALremoteunix
Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for pa
68RISK
open ↗
Referência✓ VexDay Proof
PHPMyRing 4.2.1 - 'cherche.php' SQL Injection
CVE-2006-5638—webappsphp
Multiple SQL injection vulnerabilities in cherche.php in PHPMyRing 4.2.1 and earlier allow remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
Techno Dreams Guestbook 1.0 - 'key' SQL Injection
CVE-2006-5640—webappsasp
SQL injection vulnerability in guestbookview.asp in Techno Dreams Guest Book 1.0 earlier allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
Techno Dreams Announcement - 'key' SQL Injection
CVE-2006-5641—webappsasp
SQL injection vulnerability in MainAnnounce2.asp in Techno Dreams Announcement allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
DataTrac Activity Console - Denial of Service
CVE-2005-1667—doswindows
DataTrac Activity Console 1.1 allows remote attackers to cause a denial of service via a long HTTP GET request.
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Visual Basic Enterprise 6 SP6 - '.dsr' File Handling Buffer Overflow
CVE-2008-0392—localwindows
Multiple buffer overflows in Microsoft Visual Basic Enterprise Edition 6.0 SP6 allow user-assisted remote attackers to e
35RISK
open ↗
Referência✓ VexDay Proof
Gradman 0.1.3 - 'info.php' Local File Inclusion
CVE-2008-0393—webappsphp
Directory traversal vulnerability in info.php in GradMan 0.1.3 and earlier allows remote attackers to include and execut
23RISK
open ↗
← previouspage 169 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.