Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,390cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,992Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
KGB 1.87 - Local File Inclusion / Remote Code Execution
CVE-2006-5115—webappsphp
Directory traversal vulnerability in kgcall.php in KGB 1.87 allows remote attackers to include and execute arbitrary loc
23RISK
open ↗
Referência✓ VexDay Proof
WebCards 1.3 - SQL Injection
CVE-2008-4877—webappsphp
SQL injection vulnerability in admin.php in WebCards 1.3, when magic_quotes_gpc is disabled, allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
NetRisk 2.0 - Cross-Site Scripting / SQL Injection
CVE-2008-4887—webappsphp
SQL injection vulnerability in index.php in NetRisk 2.0 and earlier allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
DZCP (deV!L_z Clanportal) 1.4.9.6 - Blind SQL Injection
CVE-2008-4889—webappsphp
SQL injection vulnerability in index.php in deV!L'z Clanportal (DZCP) 1.4.9.6 and earlier allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
1st News - SQL Injection
CVE-2008-4890—webappsphp
SQL injection vulnerability in products.php in 1st News 4 Professional (PR 1) allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
Drinks Complete Website 2.1.0 - 'drinkid' SQL Injection
CVE-2008-5169—webappsphp
SQL injection vulnerability in drinks/drink.php in Drinks Complete Website 2.1.0 allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Office - Communicator 'SIP' Remote Denial of Service
CVE-2008-5180MEDIUMdoswindows
Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of ser
45RISK
open ↗
Referência✓ VexDay Proof
InoutMailingListManager 3.1 - Remote Command Execution
CVE-2006-0658—webappsphp
Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows
23RISK
open ↗
Referência✓ VexDay Proof
ClamAV < 0.94.2 - JPEG Parsing Recursive Stack Overflow (PoC)
CVE-2008-5314—dosmultiple
Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial
23RISK
open ↗
Referência✓ VexDay Proof
WebStudio CMS - Blind SQL Injection
CVE-2008-5336—webappsphp
SQL injection vulnerability in index.php in WebStudio CMS allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
VeryPDF PDFView - OCX ActiveX OpenPDF Heap Overflow (PoC)
CVE-2008-5492—doswindows
Heap-based buffer overflow in the PDFVIEW.PdfviewCtrl.1 ActiveX control in pdfview.ocx 2.0.0.1 in VeryDOC PDF Viewer OCX
50RISK
open ↗
Referência✓ VexDay Proof
BandSite CMS 1.1.4 - Insecure Cookie Handling
CVE-2008-5497—webappsphp
BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the login_
23RISK
open ↗
Referência✓ VexDay Proof
sCssBoard (Multiple Versions) - 'pwnpack' Remote s
CVE-2008-5578—webappsphp
Multiple SQL injection vulnerabilities in index.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allow remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
nightfall personal diary 1.0 - Cross-Site Scripting / File Disclosure
CVE-2008-5592—webappsphp
Nightfall Personal Diary 1.0 stores sensitive information under the web root with insufficient access control, which all
23RISK
open ↗
Referência✓ VexDay Proof
Merlix Teamworx Server - File Disclosure/Bypass
CVE-2008-5599—webappsphp
SQL injection vulnerability in default.asp in Merlix Teamworx Server allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
VAMP Webmail 2.0beta1 - 'yesno.phtml' Remote File Inclusion
CVE-2006-5147—webappsphp
PHP remote file inclusion vulnerability in wamp_dir/setup/yesno.phtml in VAMP Webmail 2.0beta1 and earlier allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Chicomas 2.0.4 - Database Backup / File Disclosure / Cross-Site Scripting
CVE-2008-5853—webappsphp
Chilek Content Management System (aka ChiCoMaS) 2.0.4 and earlier stores sensitive information under the web root with i
23RISK
open ↗
Referência✓ VexDay Proof
FreeLyrics 1.0 - Remote File Disclosure
CVE-2008-5861—webappsphp
Directory traversal vulnerability in source.php in FreeLyrics 1.0 allows remote attackers to read arbitrary files via di
23RISK
open ↗
Referência✓ VexDay Proof
Forum82 < 2.5.2b - 'repertorylevel' Multiple File Inclusions
CVE-2006-5148—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Forum82 2.5.2b and earlier allow remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
IntelliTamper 2.07/2.08 - 'ProxyLogin' Local Stack Overflow
CVE-2008-5868—localwindows
Stack-based buffer overflow in IntelliTamper 2.07 and 2.08 allows user-assisted attackers to execute arbitrary code via
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component 5starhotels - SQL Injection
CVE-2008-5874—webappsphp
Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System (aka HBS) for Joomla! allow remote attack
23RISK
open ↗
Referência✓ VexDay Proof
CFAGCMS 1 - Remote File Inclusion
CVE-2008-5922—webappsphp
Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Cant Find A Gaming CMS (CFAGCMS) 1 all
23RISK
open ↗
Referência✓ VexDay Proof
the net guys aspired2blog - SQL Injection / File Disclosure
CVE-2008-5930—webappsasp
SQL injection vulnerability in admin/blog_comments.asp in The Net Guys ASPired2Blog allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
FAQ Manager 1.2 - 'categorie.php' SQL Injection
CVE-2008-5287—webappsphp
SQL injection vulnerability in catagorie.php in Werner Hilversum FAQ Manager 1.2 allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
mini-pub 0.3 - Local Directory Traversal / File Disclosure
CVE-2008-5936—webappsphp
front-end/edit.php in mini-pub 0.3 and earlier allows remote attackers to read files and obtain PHP source code via a fi
23RISK
open ↗
Referência✓ VexDay Proof
template creature - SQL Injection / File Disclosure
CVE-2008-5951—webappsphp
ASP Template Creature stores sensitive information under the web root with insufficient access control, which allows rem
23RISK
open ↗
Referência✓ VexDay Proof
Active Web Mail 4 - Authentication Bypass
CVE-2008-5973—webappsasp
SQL injection vulnerability in login.aspx in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
phpMyWebmin 1.0 - 'target' Remote File Inclusion
CVE-2006-5181—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Joshua Muheim phpMyWebmin 1.0 allow remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
Travelsized CMS 0.4 - 'FrontPage.php' Remote File Inclusion
CVE-2006-5182—webappsphp
PHP remote file inclusion vulnerability in frontpage.php in Dan Jensen Travelsized CMS 0.4 and earlier allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
Ol BookMarks Manager 0.7.4 - SQL Injection
CVE-2007-2817—webappsphp
SQL injection vulnerability in read/index.php in ol'bookmarks 0.7.4 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
← previouspage 170 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.