Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,150cataloged exploits
39,601CVEs with public exploitation
24,695lab-tested
AllReferência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
KAPhotoservice - 'album.asp' SQL Injection
CVE-2008-1426—webappsasp
SQL injection vulnerability in album.asp in KAPhotoservice allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
Galatolo Web Manager 1.3a - Cross-Site Scripting / SQL Injection
CVE-2008-6248—webappsphp
Cross-site scripting (XSS) vulnerability in all.php in Galatolo WebManager 1.3a and earlier allows remote attackers to i
23RISK
open ↗
Referência✓ VexDay Proof
CUPS 1.3.7 - Cross-Site Request Forgery (Add RSS Subscription) Remote Crash
CVE-2008-5183—doslinux
cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon
23RISK
open ↗
Referência✓ VexDay Proof
PEEL CMS 3.x - Admin Hash Extraction / Arbitrary File Upload
CVE-2008-1495—webappsphp
Unrestricted file upload vulnerability in administrer/produits.php in PEEL, possibly 3.x and earlier, allows remote auth
23RISK
open ↗
Referência✓ VexDay Proof
PPMate PPMedia Class - ActiveX Control Buffer Overflow (PoC)
CVE-2008-3242—doswindows
Heap-based buffer overflow in the PPMedia Class ActiveX control in PPMPlayer.dll in PPMate 2.3.1.93 allows remote attack
28RISK
open ↗
Referência✓ VexDay Proof
MW6 Datamatrix - ActiveX 'Datamatrix.dll' Insecure Method
CVE-2008-4925—remotewindows
Multiple insecure method vulnerabilities in MW6 Technologies DataMatrix ActiveX control (DATAMATRIXLib.MW6DataMatrix, Da
23RISK
open ↗
Referência✓ VexDay Proof
RunCMS Module Photo 3.02 - 'cid' SQL Injection
CVE-2008-1551—webappsphp
SQL injection vulnerability in viewcat.php in the Photo 3.02 module for RunCMS allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Yuhhu 2008 SuperStar - 'board' SQL Injection
CVE-2008-5270—webappsphp
SQL injection vulnerability in view.topics.php in Yuhhu Superstar 2008 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
PHP TopTree BBS 2.0.1a - 'right_file' Remote File Inclusion
CVE-2007-2544—webappsphp
PHP remote file inclusion vulnerability in templates/default/tpl_message.php in PHP TopTree BBS 2.0.1a and earlier allow
23RISK
open ↗
Referência✓ VexDay Proof
HRS Multi - 'key' Blind SQL Injection
CVE-2008-3266—webappsasp
SQL injection vulnerability in picture_pic_bv.asp in SoftAcid Hotel Reservation System (HRS) Multi allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
Persism CMS 0.9.2 - system[path] Remote File Inclusion
CVE-2007-2545—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Persism CMS 0.9.2 and earlier allow remote attackers to execute ar
35RISK
open ↗
Referência✓ VexDay Proof
ChilkatHttp ActiveX 2.3 - Arbitrary Files Overwrite
CVE-2008-1647—remotewindows
The ChilkatHttp.ChilkatHttp.1 and ChilkatHttp.ChilkatHttpRequest.1 ActiveX controls in ChilkatHttp.dll 2.4.0.0, 2.3.0.0,
23RISK
open ↗
Referência✓ VexDay Proof
PHPmyGallery 1.0beta2 - Local/Remote File Inclusion
CVE-2008-6316—webappsphp
Directory traversal vulnerability in _conf/core/common-tpl-vars.php in PHPmyGallery 1.0 beta2 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
DL PayCart 1.34 - Admin Password Changing
CVE-2008-5565—webappsphp
Cross-site request forgery (CSRF) vulnerability in admin/settings.php in DL PayCart 1.34 and earlier allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Visual InterDev 6.0 SP6 - '.sln' Local Buffer Overflow (PoC)
CVE-2008-1709—doswindows
Buffer overflow in Microsoft Visual InterDev 6.0 (SP6) allows user-assisted attackers to execute arbitrary code via a St
28RISK
open ↗
Referência✓ VexDay Proof
feedDemon 2.7 - OPML Outline Tag Buffer Overflow
CVE-2009-0546—localwindows
Stack-based buffer overflow in NewsGator FeedDemon 2.7 and earlier allows user-assisted remote attackers to execute arbi
50RISK
open ↗
Referência✓ VexDay Proof
Free Photo Gallery Site Script - 'path' File Disclosure
CVE-2008-1730—webappsphp
Directory traversal vulnerability in download.html in ARWScripts Gallery Script Lite (aka gallery-script-lite or Free Ph
23RISK
open ↗
Referência✓ VexDay Proof
PHPmyGallery 1.5beta - '/common-tpl-vars.php' Local/Remote File Inclusion
CVE-2008-6317—webappsphp
Directory traversal vulnerability in _conf/_php-core/common-tpl-vars.php in PHPmyGallery 1.5 beta allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
phpList 2.10.8 - Local File Inclusion
CVE-2009-0422—webappsphp
Dynamic variable evaluation vulnerability in lists/admin.php in phpList 2.10.8 and earlier, when register_globals is dis
23RISK
open ↗
Referência✓ VexDay Proof
FAQ Manager 1.2 - 'header.php' Remote File Inclusion
CVE-2008-5288—webappsphp
PHP remote file inclusion vulnerability in include/header.php in Werner Hilversum FAQ Manager 1.2, when register_globals
23RISK
open ↗
Referência✓ VexDay Proof
PowerPortal 1.3a - 'index.php' Remote File Inclusion
CVE-2006-5126—webappsphp
PHP remote file inclusion vulnerability in index.php in John Himmelman (aka DaRk2k1) PowerPortal 1.3a allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
A-Blog 2.0 - Multiple Remote File Inclusions
CVE-2006-5135—webappsphp
Multiple PHP remote file inclusion vulnerabilities in A-Blog 2 allow remote attackers to execute arbitrary PHP code via
23RISK
open ↗
Referência✓ VexDay Proof
PhpBlock a8.4 - 'PATH_TO_CODE' Remote File Inclusion
CVE-2008-1776—webappsphp
PHP remote file inclusion vulnerability in modules/basicfog/basicfogfactory.class.php in PhpBlock A8.4 allows remote att
28RISK
open ↗
Referência✓ VexDay Proof
Entertainment Directory 1.1 - SQL Injection
CVE-2008-1788—webappsphp
SQL injection vulnerability in directory.php in Prozilla Entertainers 1.1 and earlier allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Pre Job Board - Authentication Bypass
CVE-2008-6329—webappsphp
SQL injection vulnerability in Employee/login.asp in Pre ASP Job Board allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
DMXReady Secure Document Library 1.1 - SQL Injection
CVE-2009-0428—webappsphp
SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Secure Document Library 1.1 and ear
23RISK
open ↗
Referência✓ VexDay Proof
Sabros.us 1.75 - 'thumbnails.php' Remote File Disclosure
CVE-2008-1799—webappsphp
Directory traversal vulnerability in thumbnails.php in sabros.us 1.75 allows remote attackers to read arbitrary files vi
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module GesGaleri - SQL Injection
CVE-2008-5321—webappsphp
SQL injection vulnerability in index.php in GesGaleri, a module for XOOPS, allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Extract Website - 'Filename' File Disclosure
CVE-2008-6334—webappsphp
Directory traversal vulnerability in download.php in eMetrix Extract Website allows remote attackers to read arbitrary f
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS myAds Module - 'lid' SQL Injection
CVE-2006-3341—webappsphp
SQL injection vulnerability in annonces-p-f.php in MyAds module 2.04jp for Xoops allows remote attackers to execute arbi
23RISK
open ↗
← previouspage 18 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.