Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,150cataloged exploits
39,601CVEs with public exploitation
24,695lab-tested
AllReferência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
VideoDB 2.2.1 - 'pdf.php' Remote File Inclusion
CVE-2006-5155—webappsphp
PHP remote file inclusion vulnerability in core/pdf.php in VideoDB 2.2.1 and earlier allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
724CMS 4.01 Enterprise - 'index.php' SQL Injection
CVE-2008-1858—webappsphp
SQL injection vulnerability in index.php in 724Networks 724CMS 4.01 and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
iScripts Socialware - 'id' SQL Injection
CVE-2008-1859—webappsphp
SQL injection vulnerability in events.php in iScripts SocialWare allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
TxtBlog 1.0 Alpha - Local File Inclusion
CVE-2008-5639—webappsphp
Directory traversal vulnerability in index.php in TxtBlog 1.0 Alpha allows remote attackers to read arbitrary files via
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component ongumatimesheet20 4b - Remote File Inclusion
CVE-2008-6347—webappsphp
PHP remote file inclusion vulnerability in lib/onguma.class.php in the Onguma Time Sheet (com_ongumatimesheet20) 2.0 4b
35RISK
open ↗
Referência✓ VexDay Proof
DevelopItEasy Photo Gallery 1.2 - SQL Injection
CVE-2008-6348—webappsphp
Multiple SQL injection vulnerabilities in DevelopItEasy Photo Gallery 1.2 allow remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
VideoLAN VLC Media Player 0.8.6e - Subtitle Parsing Local Buffer Overflow
CVE-2008-1881—localwindows
Stack-based buffer overflow in the ParseSSA function (modules/demux/subtitle.c) in VLC 0.8.6e allows remote attackers to
28RISK
open ↗
Referência✓ VexDay Proof
CDNetworks Nefficient Download - 'NeffyLauncher.dll' Code Execution
CVE-2008-1885—remotewindows
Directory traversal vulnerability in the NeffyLauncher 1.0.5 ActiveX control (NeffyLauncher.dll) in CDNetworks Nefficien
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft SQL Server - 'sp_replwritetovarbin()' Heap Overflow
CVE-2008-5416—localwindows
Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop
60RISK
open ↗
Referência✓ VexDay Proof
Xpoze 4.10 - 'menu' Blind SQL Injection
CVE-2008-6352—webappsphp
SQL injection vulnerability in home.html in Xpoze Pro 4.10 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
SAP MaxDB 7.6.03.07 - Remote Command Execution
CVE-2008-0244—remotemultiple
SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell me
60RISK
open ↗
Referência✓ VexDay Proof
Carbon Communities 2.4 - Multiple Vulnerabilities
CVE-2008-1896—webappsasp
Multiple cross-site scripting (XSS) vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to inje
23RISK
open ↗
Referência✓ VexDay Proof
Kwalbum 2.0.2 - Arbitrary File Upload
CVE-2008-5677—webappsphp
Unrestricted file upload vulnerability in Kwalbum 2.0.4, 2.0.2, and earlier, when PICS_PATH is located in the web root,
23RISK
open ↗
Referência✓ VexDay Proof
DesignWorks Professional 4.3.1 - '.CCT' File Local Stack Buffer Overflow (PoC)
CVE-2008-6363—doswindows
Stack-based buffer overflow in DesignWorks Professional 4.3.1 and 5.0.7 allows remote attackers to execute arbitrary cod
23RISK
open ↗
Referência✓ VexDay Proof
Linksys WRT54G Firmware 1.00.9 - Security Bypass (2)
CVE-2006-5202—remotehardware
Linksys WRT54g firmware 1.00.9 does not require credentials when making configuration changes, which allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
TR News 2.1 - 'nb' SQL Injection
CVE-2008-1958—webappsphp
Unrestricted file upload vulnerability in the ajout_cat mode in admin/main.php in Tr Script News 2.1 allows remote authe
23RISK
open ↗
Referência✓ VexDay Proof
MojoAuto - Blind SQL Injection
CVE-2008-3383—webappscgi
SQL injection vulnerability in mojoAuto.cgi in MojoAuto allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
CMS NetCat 3.12 - 'password_recovery.php' Blind SQL Injection
CVE-2008-5727—webappsphp
SQL injection vulnerability in modules/auth/password_recovery.php in AIST NetCat 3.12 and earlier, when magic_quotes_gpc
23RISK
open ↗
Referência✓ VexDay Proof
Ocean12 Contact Manager Pro - SQL Injection / Cross-Site Scripting / File Disclosure
CVE-2008-6369—webappsphp
SQL injection vulnerability in default.asp in Ocean12 Contact Manager Pro 1.02 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Media Player - '.wav' Remote Crash (PoC)
CVE-2008-5745—doswindows
Integer overflow in quartz.dll in the DirectShow framework in Microsoft Windows Media Player (WMP) 9, 10, and 11, includ
28RISK
open ↗
Referência✓ VexDay Proof
Ocean12 FAQ Manager Pro - 'ID' Blind SQL Injection
CVE-2008-6372—webappsphp
SQL injection vulnerability in default.asp in Ocean12 FAQ Manager Pro 1.0 allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
Squid < 3.1 5 - HTTP Version Number Parsing Denial of Service
CVE-2009-0478—dosmultiple
Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service v
45RISK
open ↗
Referência✓ VexDay Proof
Flatnux - html/JavaScript Injection Cookie Grabber
CVE-2008-5761—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in FlatnuX CMS (aka Flatnuke3) 2008-12-11 allow remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Alstrasoft Template Seller Pro 3.25 - Remote Code Execution
CVE-2007-2777—webappsphp
Unrestricted file upload vulnerability in admin/addsptemplate.php in AlstraSoft Template Seller Pro 3.25 and earlier all
23RISK
open ↗
Referência✓ VexDay Proof
PostNuke Module PostSchedule 1.0 - 'eid' SQL Injection
CVE-2008-2012—webappsphp
SQL injection vulnerability in index.php in the PostSchedule 1.0 module for PostNuke allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
MojoPersonals - Blind SQL Injection
CVE-2008-3403—webappscgi
SQL injection vulnerability in mojoClassified.cgi in MojoPersonals allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
AdaptCMS Lite 1.4 - Cross-Site Scripting / Remote File Inclusion
CVE-2009-0526—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in index.php in AdaptCMS Lite 1.4 allow remote attackers to inject a
23RISK
open ↗
Referência✓ VexDay Proof
IPNPro3 < 1.44 - Admin Password Changing
CVE-2008-5568—webappsphp
Cross-site request forgery (CSRF) vulnerability in admin/settings.php in IPN Pro 3 1.44 and earlier allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
Pre Shopping Mall 1.1 - 'search.php' SQL Injection
CVE-2008-2114—webappsphp
SQL injection vulnerability in emall/search.php in Pre Shopping Mall 1.1 allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
Active Web Helpdesk 2 - 'categoryId' Blind SQL Injection
CVE-2008-6380—webappsphp
SQL injection vulnerability in default.aspx in Active Web Helpdesk 2.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
← previouspage 19 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.