Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,150cataloged exploits

39,601CVEs with public exploitation

24,695lab-tested

All Referência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

OpenDock Easy Gallery 1.4 - 'doc_directory' File Inclusion

CVE-2006-5241—webappsphp

Multiple PHP remote file inclusion vulnerabilities in OpenDock Easy Gallery 1.4 and earlier, when register_globals is en

23RISK

open ↗

Referência✓ VexDay Proof

Galleristic 1.0 - 'cat' SQL Injection

CVE-2008-2129—webappsphp

SQL injection vulnerability in index.php in Galleristic 1.0, when magic_quotes_gpc is disabled, allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

PostcardMentor - 'cat_fldAuto' SQL Injection

CVE-2008-2132—webappsasp

SQL injection vulnerability in step1.asp in Systementor PostcardMentor allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

LetterIt 2 - 'Language' Local File Inclusion

CVE-2008-3446—webappsphp

Directory traversal vulnerability in inc/wysiwyg.php in LetterIt 2 allows remote attackers to include and execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

WebMaster Marketplace - SQL Injection

CVE-2008-5574—webappsphp

SQL injection vulnerability in member.php in Webmaster Marketplace allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

Mediatheka 4.2 - 'lang' Local File Inclusion

CVE-2008-5894—webappsphp

Directory traversal vulnerability in index.php in Mediatheka 4.2 allows remote attackers to include and execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

HotScripts Clone - 'cid' SQL Injection

CVE-2008-6405—webappsphp

SQL injection vulnerability in showcategory.php in Hotscripts Clone allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component mydyngallery 1.4.2 - SQL Injection

CVE-2008-5957—webappsphp

SQL injection vulnerability in the Mydyngallery (com_mydyngallery) component 1.4.2 for Joomla! allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

EMO Realty Manager - 'ida' SQL Injection

CVE-2008-2265—webappsphp

SQL injection vulnerability in news.php in EMO Realty Manager allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

AJ Auction Pro Platinum Skin - 'item_id' SQL Injection

CVE-2008-6414—webappsphp

SQL injection vulnerability in detail.php in AJ Auction Pro Platinum Skin 2 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

HP Software Update - 'Hpufunction.dll 4.0.0.1' Insecure Method

CVE-2008-2390—remotewindows

Hpufunction.dll 4.0.0.1 in HP Software Update exposes the unsafe (1) ExecuteAsync and (2) Execute methods, which allows

23RISK

open ↗

Referência✓ VexDay Proof

WSN Links 2.22/2.23 - 'vote.php' SQL Injection

CVE-2008-6031—webappsphp

SQL injection vulnerability in vote.php in WSN Links 2.22 and 2.23 allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

QMail Mailing List Manager 1.2 - Database Disclosure

CVE-2008-5606—webappsasp

Gazatem QMail Mailing List Manager 1.2 stores sensitive information under the web root with insufficient access control,

23RISK

open ↗

Referência✓ VexDay Proof

Mercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (3)

CVE-2004-2513—remotewindows

Buffer overflow in the IMAP service of Mercury (Pegasus) Mail 4.01 allows remote attackers to execute arbitrary code via

23RISK

open ↗

Referência✓ VexDay Proof

Redaction System 1.0 - 'lang_prefix' Remote File Inclusion

CVE-2006-5302—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Redaction System 1.0000 allow remote attackers to execute arbitrar

28RISK

open ↗

Referência✓ VexDay Proof

Xomol CMS 1.2 - Authentication Bypass / Local File Inclusion

CVE-2008-2484—webappsphp

SQL injection vulnerability in index.php in Xomol CMS 1.20071213, when magic_quotes_gpc is disabled, allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

Camera Life 2.6.2b4 - SQL Injection / Cross-Site Scripting

CVE-2008-6086—webappsphp

SQL injection vulnerability in album.php in Camera Life 2.6.2b4 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

e107 Plugin Image Gallery 0.9.6.2 - SQL Injection

CVE-2008-6466—webappsphp

SQL injection vulnerability in image_gallery.php in the Akira Powered Image Gallery (image_gallery) plugin 0.9.6.2 for e

23RISK

open ↗

Referência✓ VexDay Proof

AdminBot 9.0.5 - 'live_status.lib.php' Remote File Inclusion

CVE-2007-2986—webappsphp

PHP remote file inclusion vulnerability in lib/live_status.lib.php in AdminBot MX 9.0.5 allows remote attackers to execu

35RISK

open ↗

Referência✓ VexDay Proof

Battle.net Clan Script 1.5.x - SQL Injection

CVE-2008-2522—webappsphp

SQL injection vulnerability in members.php in Battle.net Clan Script for PHP 1.5.3 and earlier, when magic_quotes_gpc is

23RISK

open ↗

Referência✓ VexDay Proof

Scripts24 iTGP 1.0.4 - 'id' SQL Injection

CVE-2008-3491—webappsphp

SQL injection vulnerability in go.php in Scripts24 iPost 1.0.1 and iTGP 1.0.4 allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

LiteNews 0.1 - 'id' SQL Injection

CVE-2008-3507—webappsphp

SQL injection vulnerability in index.php in LiteNews 0.1 (aka 01), and possibly 1.2 and earlier, allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Adult Banner Exchange Website - 'targetid' SQL Injection

CVE-2008-6101—webappsphp

SQL injection vulnerability in click.php in Adult Banner Exchange Website allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

Goople CMS 1.7 - Insecure Cookie Handling

CVE-2008-6118—webappsphp

win/content/upload.php in Goople CMS 1.7 allows remote attackers to bypass authentication and gain administrative access

23RISK

open ↗

Referência✓ VexDay Proof

Drake CMS 0.4.11 - Blind SQL Injection

CVE-2008-6475—webappsphp

SQL injection vulnerability in the guestbook component (components/guestbook/guestbook.php) in Drake CMS 0.4.11 and earl

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Live Ticker 1.0 - Blind SQL Injection

CVE-2008-6148—webappsphp

SQL injection vulnerability in the Live Ticker (com_liveticker) module 1.0 for Joomla! allows remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

Specimen Image Database - 'client.php' Remote File Inclusion

CVE-2006-5419—webappsphp

PHP remote file inclusion vulnerability in client.php in University of Glasgow Specimen Image Database (SID), when regis

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Rapid Recipe 1.6.6/1.6.7 - SQL Injection

CVE-2008-2697—webappsphp

SQL injection vulnerability in the Rapid Recipe (com_rapidrecipe) component 1.6.6 and 1.6.7 for Joomla! allows remote at

23RISK

open ↗

Referência✓ VexDay Proof

Galatolo Web Manager 1.0 - Cross-Site Scripting / Local File Inclusion

CVE-2008-2699—webappsphp

Multiple directory traversal vulnerabilities in Galatolo WebManager (GWM) 1.0 allow remote attackers to include and exec

23RISK

open ↗

Referência✓ VexDay Proof

Gforge 4.6 rc1 - 'skill_edit' SQL Injection

CVE-2008-6188—webappsphp

SQL injection vulnerability in people/editprofile.php in Gforge 4.6 rc1 and earlier allows remote attackers to execute a

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.