Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,150cataloged exploits
39,601CVEs with public exploitation
24,695lab-tested
AllReferência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Amaya 11.1 - W3C Editor/Browser (defer) Stack Overflow (PoC)
CVE-2009-1209—doswindows
Stack-based buffer overflow in W3C Amaya Web Browser 11.1 allows remote attackers to execute arbitrary code via a script
28RISK
open ↗
Referência✓ VexDay Proof
Aztek Forum 4.00 - Cross-Site Scripting / SQL Injection
CVE-2006-1110—webappsphp
Cross-site scripting (XSS) vulnerability in Aztek Forum 4.0 allows remote attackers to inject arbitrary web script or HT
23RISK
open ↗
Referência✓ VexDay Proof
Aztek Forum 4.00 - Cross-Site Scripting / SQL Injection
CVE-2006-1111—webappsphp
Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a "*/*" in the msg parameter to index.php, w
23RISK
open ↗
Referência✓ VexDay Proof
ask_rave 0.9 PR - 'end.php?footfile' Remote File Inclusion
CVE-2006-5621—webappsphp
PHP remote file inclusion vulnerability in end.php in ask_rave 0.9 PR, and other versions before 0.9b, allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
Philex 0.2.3 - Remote File Inclusion / File Disclosure
CVE-2007-1697—webappsphp
PHP remote file inclusion vulnerability in header.inc.php in Philex 0.2.3 and earlier allows remote attackers to execute
45RISK
open ↗
Referência✓ VexDay Proof
Mantis Bug Tracker 1.1.1 - Code Execution / Cross-Site Scripting / Cross-Site Request Forgery
CVE-2008-3331—webappsphp
Cross-site scripting (XSS) vulnerability in return_dynamic_filters.php in Mantis before 1.1.2 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
OWL Intranet Engine 0.82 - 'xrms_file_root' Code Execution
CVE-2006-1149—webappsphp
PHP remote file inclusion vulnerability in lib/OWL_API.php in OWL Intranet Engine 0.82, when register_globals is enabled
23RISK
open ↗
Referência✓ VexDay Proof
Gallery 2.0.3 - 'stepOrder[]' Remote Command Execution
CVE-2006-1219—webappsphp
Directory traversal vulnerability in Gallery 2.0.3 and earlier, and 2.1 before RC-2a, allows remote attackers to include
23RISK
open ↗
Referência✓ VexDay Proof
Pro Chat Rooms 3.0.2 - Cross-Site Scripting / Cross-Site Request Forgery
CVE-2008-6502—webappsphp
Directory traversal vulnerability in Pro Chat Rooms 3.0.2 allows remote authenticated users to select an arbitrary local
23RISK
open ↗
Referência✓ VexDay Proof
isiAJAX 1 - 'praises.php?id' SQL Injection
CVE-2009-0881—webappsphp
SQL injection vulnerability in ejemplo/paises.php in isiAJAX 1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Mozilla Firefox 3.0.x - XML Parser Memory Corruption / Denial of Service (PoC)
CVE-2009-1232—doswindows
Mozilla Firefox 3.0.8 and earlier 3.0.x versions allows remote attackers to cause a denial of service (memory corruption
23RISK
open ↗
Referência✓ VexDay Proof
phpLinkat 0.1 - Insecure Cookie Handling / SQL Injection
CVE-2008-3407—webappsphp
phpLinkat 0.1 allows remote attackers to bypass authentication and access unspecified pages under admin/ by sending a lo
23RISK
open ↗
Referência✓ VexDay Proof
gCards 1.45 - Multiple Vulnerabilities
CVE-2006-1346—webappsphp
Directory traversal vulnerability in inc/setLang.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
phpLinkat 0.1 - Insecure Cookie Handling / SQL Injection
CVE-2008-3406—webappsphp
SQL injection vulnerability in showcat.php in phpLinkat 0.1 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
living Local 1.1 - Cross-Site Scripting / Arbitrary File Upload
CVE-2008-6530—webappsphp
Unrestricted file upload vulnerability in editimage.php in eZoneScripts Living Local 1.1 allows remote authenticated adm
23RISK
open ↗
Referência✓ VexDay Proof
ASP.NET w3wp - COM Components Remote Crash
CVE-2006-1364—doswindows
Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM com
35RISK
open ↗
Referência✓ VexDay Proof
E Annu 1.0 - Authentication Bypass / SQL Injection
CVE-2006-5666—webappsphp
SQL injection vulnerability in includes/menu.inc.php in E-Annu 1.0 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
VMware 5.5.1 - 'ActiveX' Local Buffer Overflow
CVE-2006-6410—localwindows
Buffer overflow in an ActiveX control in VMWare 5.5.1 allows local users to execute arbitrary code via a long VmdbDb par
23RISK
open ↗
Referência✓ VexDay Proof
Youtuber Clone - SQL Injection
CVE-2008-3419—webappsphp
SQL injection vulnerability in ugroups.php in Youtuber Clone allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Gravity GTD 0.4.5 - Local File Inclusion / Remote Code Execution
CVE-2008-5962—webappsphp
Directory traversal vulnerability in library/setup/rpc.php in Gravity Getting Things Done (GTD) 0.4.5 and earlier allows
23RISK
open ↗
Referência✓ VexDay Proof
EternalMart Guestbook 1.10 - '/admin/auth.php' Remote File Inclusion
CVE-2003-1314—webappsphp
PHP remote file inclusion vulnerability in admin/auth.php in EternalMart Guestbook (EMGB) 1.1 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
GEPI 1.4.0 - '/gestion/savebackup.php' Remote File Inclusion
CVE-2006-5669—webappsphp
PHP remote file inclusion vulnerability in gestion/savebackup.php in Gepi 1.4.0 and earlier, and possibly other versions
23RISK
open ↗
Referência✓ VexDay Proof
phpTrafficA 1.4.2 - 'pageid' SQL Injection
CVE-2007-3427—webappsphp
SQL injection vulnerability in index.php in phpTrafficA 1.4.2 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
PHP Hosting Directory 2.0 - Insecure Cookie Handling
CVE-2008-3454—webappsphp
JnSHosts PHP Hosting Directory 2.0 allows remote attackers to bypass authentication and gain administrative access by se
23RISK
open ↗
Referência✓ VexDay Proof
Python 2.4.2 - 'realpath()' Local Stack Overflow
CVE-2006-1542—locallinux
Stack-based buffer overflow in Python 2.4.2 and earlier, running on Linux 2.6.12.5 under gcc 4.0.3 with libc 2.3.5, allo
23RISK
open ↗
Referência✓ VexDay Proof
Coppermine Photo Gallery 1.4.18 - Local File Inclusion / Remote Code Execution
CVE-2008-3481—webappsphp
themes/sample/theme.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier allows remote attackers to obtain sensitive
23RISK
open ↗
Referência✓ VexDay Proof
Discuz! 6.0.1 - 'searchid' SQL Injection
CVE-2008-3554—webappsphp
SQL injection vulnerability in index.php in Discuz! 6.0.1 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Webhosting - 'catid' Blind SQL Injection
CVE-2008-6653—webappsphp
SQL injection vulnerability in webhosting.php in the Webhosting Component (com_webhosting) module before 1.1 RC7 for Joo
23RISK
open ↗
Referência✓ VexDay Proof
Simplog 0.9.2 - 's' Remote Command Execution
CVE-2006-1777—webappsphp
Directory traversal vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Internet PhotoShow 1.3 - 'page' Remote File Inclusion
CVE-2006-1919—webappsphp
PHP remote file inclusion vulnerability in index.php in Internet Photoshow 1.3 allows remote attackers to execute arbitr
23RISK
open ↗
← previouspage 22 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.