Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,456cataloged exploits
40,248CVEs with public exploitation
24,696lab-tested
AllReferência 26,093Exploit-DB 24,488GitHub PoC 17,782VulnCheck XDB 10,014Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Drinks Complete Website 2.1.0 - 'drinkid' SQL Injection
CVE-2008-5169—webappsphp
SQL injection vulnerability in drinks/drink.php in Drinks Complete Website 2.1.0 allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Office - Communicator 'SIP' Remote Denial of Service
CVE-2008-5180MEDIUMdoswindows
Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of ser
45RISK
open ↗
Referência✓ VexDay Proof
InoutMailingListManager 3.1 - Remote Command Execution
CVE-2006-0658—webappsphp
Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows
23RISK
open ↗
Referência✓ VexDay Proof
ClamAV < 0.94.2 - JPEG Parsing Recursive Stack Overflow (PoC)
CVE-2008-5314—dosmultiple
Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial
23RISK
open ↗
Referência✓ VexDay Proof
WebStudio CMS - Blind SQL Injection
CVE-2008-5336—webappsphp
SQL injection vulnerability in index.php in WebStudio CMS allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
VeryPDF PDFView - OCX ActiveX OpenPDF Heap Overflow (PoC)
CVE-2008-5492—doswindows
Heap-based buffer overflow in the PDFVIEW.PdfviewCtrl.1 ActiveX control in pdfview.ocx 2.0.0.1 in VeryDOC PDF Viewer OCX
50RISK
open ↗
Referência✓ VexDay Proof
BandSite CMS 1.1.4 - Insecure Cookie Handling
CVE-2008-5497—webappsphp
BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the login_
23RISK
open ↗
Referência✓ VexDay Proof
nightfall personal diary 1.0 - Cross-Site Scripting / File Disclosure
CVE-2008-5592—webappsphp
Nightfall Personal Diary 1.0 stores sensitive information under the web root with insufficient access control, which all
23RISK
open ↗
Referência✓ VexDay Proof
Merlix Teamworx Server - File Disclosure/Bypass
CVE-2008-5599—webappsphp
SQL injection vulnerability in default.asp in Merlix Teamworx Server allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
VAMP Webmail 2.0beta1 - 'yesno.phtml' Remote File Inclusion
CVE-2006-5147—webappsphp
PHP remote file inclusion vulnerability in wamp_dir/setup/yesno.phtml in VAMP Webmail 2.0beta1 and earlier allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Chicomas 2.0.4 - Database Backup / File Disclosure / Cross-Site Scripting
CVE-2008-5853—webappsphp
Chilek Content Management System (aka ChiCoMaS) 2.0.4 and earlier stores sensitive information under the web root with i
23RISK
open ↗
Referência✓ VexDay Proof
FreeLyrics 1.0 - Remote File Disclosure
CVE-2008-5861—webappsphp
Directory traversal vulnerability in source.php in FreeLyrics 1.0 allows remote attackers to read arbitrary files via di
23RISK
open ↗
Referência✓ VexDay Proof
Forum82 < 2.5.2b - 'repertorylevel' Multiple File Inclusions
CVE-2006-5148—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Forum82 2.5.2b and earlier allow remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
PlaySms 0.9.3 - Multiple Local/Remote File Inclusions
CVE-2008-5881—webappsphp
Multiple directory traversal vulnerabilities in playSMS 0.9.3 allow remote attackers to include and execute arbitrary lo
23RISK
open ↗
Referência✓ VexDay Proof
ASPired2Quote - Remote Database Disclosure
CVE-2008-5885—webappsasp
The Net Guys ASPired2Quote stores sensitive information under the web root with insufficient access control, which allow
23RISK
open ↗
Referência✓ VexDay Proof
Discussion Web 4 - Remote Database Disclosure
CVE-2008-5886—webappsasp
TAKempis Discussion Web 4.0 stores sensitive information under the web root with insufficient access control, which allo
23RISK
open ↗
Referência✓ VexDay Proof
FAQ Manager 1.2 - 'categorie.php' SQL Injection
CVE-2008-5287—webappsphp
SQL injection vulnerability in catagorie.php in Werner Hilversum FAQ Manager 1.2 allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
mini-pub 0.3 - Local Directory Traversal / File Disclosure
CVE-2008-5936—webappsphp
front-end/edit.php in mini-pub 0.3 and earlier allows remote attackers to read files and obtain PHP source code via a fi
23RISK
open ↗
Referência✓ VexDay Proof
template creature - SQL Injection / File Disclosure
CVE-2008-5951—webappsphp
ASP Template Creature stores sensitive information under the web root with insufficient access control, which allows rem
23RISK
open ↗
Referência✓ VexDay Proof
BBaCE 3.5 - '/includes/functions.php' Remote File Inclusion
CVE-2006-5187—webappsphp
PHP remote file inclusion vulnerability in includes/functions.php in Bulletin Board Ace (BBaCE) 3.5 and earlier allows r
23RISK
open ↗
Referência✓ VexDay Proof
LiveCMS 3.4 - 'categoria.php?cid' SQL Injection
CVE-2007-3291—webappsphp
Cross-site scripting (XSS) vulnerability in LiveCMS 3.4 and earlier allows remote attackers to inject arbitrary web scri
23RISK
open ↗
Referência✓ VexDay Proof
LiveCMS 3.4 - 'categoria.php?cid' SQL Injection
CVE-2007-3292—webappsphp
Unrestricted file upload vulnerability in LiveCMS 3.4 and earlier allows remote attackers to upload and execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
MiniBill 1.2.5 - 'run_billing.php' Remote File Inclusion
CVE-2007-3306—webappsphp
PHP remote file inclusion vulnerability in crontab/run_billing.php in MiniBill 1.2.5 allows remote attackers to execute
35RISK
open ↗
Referência✓ VexDay Proof
FastStone Image Viewer 3.6 - '.BMP' Image Crash
CVE-2008-5870—doswindows
FastStone Image Viewer 3.6 allows user-assisted attackers to cause a denial of service (application crash) via a malform
23RISK
open ↗
Referência✓ VexDay Proof
phpBB Security Suite Mod 1.0.0 - 'logger_engine.php' Remote File Inclusion
CVE-2006-5224—webappsphp
PHP remote file inclusion vulnerability in includes/logger_engine.php in Dimitri Seitz Security Suite IP Logger 1.0.0 in
23RISK
open ↗
Referência✓ VexDay Proof
Limbo CMS - Private Messaging Component SQL Injection
CVE-2008-6078—webappsphp
SQL injection vulnerability in open.php in the Private Messaging (com_privmsg) component for Limbo CMS allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
Minichat 6.0 - 'ftag.php' Remote File Inclusion
CVE-2006-5283—webappsphp
PHP remote file inclusion vulnerability in ftag.php in Minichat 6.0 allows remote attackers to execute arbitrary PHP cod
23RISK
open ↗
Referência✓ VexDay Proof
CSPartner 1.0 - Delete All Users / SQL Injection
CVE-2008-6165—webappsphp
SQL injection vulnerability in gestion.php in CSPartner 0.1, when magic_quotes_gpc is disabled, allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
JASmine 0.0.2 - 'index.php' Remote File Inclusion
CVE-2006-5318—webappsphp
PHP remote file inclusion vulnerability in index.php in Nayco JASmine (aka Jasmine-Web) allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
Multiple Membership Script 2.5 - 'id' SQL Injection
CVE-2008-6362—webappsphp
SQL injection vulnerability in sitepage.php in Multiple Membership Script 2.5 allows remote attackers to execute arbitra
23RISK
open ↗
← previouspage 175 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.