Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,150cataloged exploits

39,601CVEs with public exploitation

24,695lab-tested

All Referência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

Joomla! Component VirtueMart Google Base 1.1 - Remote File Inclusion

CVE-2008-6483—webappsphp

PHP remote file inclusion vulnerability in admin.googlebase.php in the Ecom Solutions VirtueMart Google Base (aka com_go

28RISK

open ↗

Referência✓ VexDay Proof

RevokeBB 1.0 RC11 - 'Search' SQL Injection

CVE-2008-2778—webappsphp

SQL injection vulnerability in inc/class_search.php in the Search System in RevokeBB 1.0 RC11 allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

LoCal Calendar 1.1 - 'lcUser.php' Remote File Inclusion

CVE-2006-5426—webappsphp

PHP remote file inclusion vulnerability in lib/lcUser.php in LoCal Calendar System 1.1 remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

PHP TV Portal 2.0 - 'mid' SQL Injection

CVE-2008-6285—webappsphp

SQL injection vulnerability in index.php in PHP TV Portal 2.0 and earlier allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

Recipes Complete Website 1.1.14 - SQL Injection

CVE-2006-6220—webappsphp

Multiple SQL injection vulnerabilities in Recipes Website (Recipes Complete Website) 1.1.14 allow remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

MyMarket 1.72 - Blind SQL Injection

CVE-2008-2815—webappsphp

SQL injection vulnerability in shopping/index.php in MyMarket 1.72 allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

AJ Auction Web 2.0 - 'cate_id' SQL Injection

CVE-2008-2860—webappsphp

SQL injection vulnerability in category.php in AJSquare AJ Auction Pro web 2.0 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Tours Manager 1.0 - SQL Injection

CVE-2008-6289—webappsphp

SQL injection vulnerability in cityview.php in Tours Manager 1.0 allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

Kipper 2.01 - Cross-Site Scripting / Local File Inclusion / File Disclosure

CVE-2009-0767—webappsphp

Kipper 2.01 stores sensitive information under the web root with insufficient access control, which allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

Poppler 0.8.4 - libpoppler Uninitialized pointer Code Execution

CVE-2008-2950—locallinux

The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not

28RISK

open ↗

Referência✓ VexDay Proof

Forest Blog 1.3.2 - Remote Database Disclosure

CVE-2008-5780—webappsasp

Forest Blog 1.3.2 stores sensitive information under the web root with insufficient access control, which allows remote

23RISK

open ↗

Referência✓ VexDay Proof

ToursManager - 'tourview.php' Blind SQL Injection

CVE-2008-6303—webappsphp

SQL injection vulnerability in tourview.php in ToursManager allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

CMS Mini 0.2.2 - Multiple Local File Inclusions

CVE-2008-2961—webappsphp

Multiple directory traversal vulnerabilities in view/index.php in CMS Mini 0.2.2 allow remote attackers to read arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

jaxultrabb 2.0 - Local File Inclusion / Cross-Site Scripting

CVE-2008-2965—webappsphp

Cross-site scripting (XSS) vulnerability in viewforum.php in JaxUltraBB (JUBB) 2.0 and earlier allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

Butterfly ORGanizer 2.0.1 - 'id' SQL Injection

CVE-2008-6328—webappsphp

SQL injection vulnerability in view.php in Butterfly Organizer 2.0.0 and 2.0.1 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

PHP KnowledgeBase Script 2.4 - 'cat_id' SQL Injection

CVE-2008-2972—webappsphp

SQL injection vulnerability in index.php in KbLance allows remote attackers to execute arbitrary SQL commands via the ca

23RISK

open ↗

Referência✓ VexDay Proof

Gravity Board X 2.0 Beta - SQL Injection / Cross-Site Scripting

CVE-2008-2997—webappsphp

Cross-site scripting (XSS) vulnerability in index.php in Gravity Board X (GBX) 2.0 Beta allows remote attackers to injec

23RISK

open ↗

Referência✓ VexDay Proof

Multi SEO phpBB 1.1.0 - Remote File Inclusion

CVE-2008-6377—webappsphp

PHP remote file inclusion vulnerability in include/global.php in Multi SEO phpBB 1.1.0 allows remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

BlogHelper - Remote Configuration File Disclosure

CVE-2009-0826—webappsphp

BlogHelper stores common_db.inc under the web root with insufficient access control, which allows remote attackers to do

23RISK

open ↗

Referência✓ VexDay Proof

BXCP 0.2.9.9 - 'tid' SQL Injection

CVE-2006-0821—webappsphp

SQL injection vulnerability in index.php in BXCP 0.299 allows remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência✓ VexDay Proof

Userlocator 3.0 - Blind SQL Injection

CVE-2008-5863—webappsphp

SQL injection vulnerability in locator.php in the Userlocator module 3.0 for Woltlab Burning Board (wBB) allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

Rapid Classified 3.1 - Database Disclosure

CVE-2008-6388—webappsphp

Rapid Classified 3.1 and 3.15 stores sensitive information under the web root with insufficient access control, which al

23RISK

open ↗

Referência✓ VexDay Proof

GDL 4.x - 'node' SQL Injection

CVE-2009-0965—webappsphp

SQL injection vulnerability in functions/browse.php in Ganesha Digital Library (GDL) 4.0 and 4.2 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

ArticleBeach Script 2.0 - 'index.php' Remote File Inclusion

CVE-2006-5590—webappsphp

PHP remote file inclusion vulnerability in index.php in ArticleBeach Script 2.0 and earlier allows remote attackers to e

23RISK

open ↗

Referência✓ VexDay Proof

GestArt Beta 1 - 'aide.php?aide' Remote File Inclusion

CVE-2006-5612—webappsphp

PHP remote file inclusion vulnerability in aide.php3 (aka aide.php) in GestArt beta 1, when register_globals is enabled,

23RISK

open ↗

Referência✓ VexDay Proof

Download Accelerator Plus DAP 8.x - '.m3u' Local Buffer Overflow

CVE-2008-3182—localwindows

Stack-based buffer overflow in DAP.exe in Download Accelerator Plus (DAP) 7.0.1.3, 8.6.6.3, and other 8.x versions allow

23RISK

open ↗

Referência✓ VexDay Proof

PHPizabi 0.848b C1 HFP1 - Remote Code Execution

CVE-2008-3239—webappsphp

Unrestricted file upload vulnerability in the writeLogEntry function in system/v_cron_proc.php in PHPizabi 0.848b C1 HFP

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Windows - NAT Helper Components 'ipnathlp.dll' Remote Denial of Service

CVE-2006-5614—doswindows

Microsoft Windows NAT Helper Components (ipnathlp.dll) on Windows XP SP2, when Internet Connection Sharing is enabled, a

60RISK

open ↗

Referência✓ VexDay Proof

Aprox CMS Engine 5.1.0.4 - 'index.php' SQL Injection

CVE-2008-3291—webappsphp

SQL injection vulnerability in index.php in AproxEngine (aka Aprox CMS Engine) 5.1.0.4 allows remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

SoftComplex PHP Image Gallery 1.0 - Authentication Bypass

CVE-2008-6488—webappsphp

SQL injection vulnerability in index.php in SoftComplex PHP Image Gallery 1.0 allows remote attackers to execute arbitra

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.