Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,958cataloged exploits

36,206CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,460Referência 22,832GitHub PoC 14,991VulnCheck XDB 8,829Nuclei 4,357Metasploit 3,489✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

The Recipe Script 5 - Authentication Bypass / Database Backup

CVE-2009-1662—webappsphp

Multiple SQL injection vulnerabilities in admin/login.php in Wright Way Services Recipe Script 5 allow remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

XOOPS Module cjay content 3 - Remote File Inclusion

CVE-2007-3220—webappsphp

PHP remote file inclusion vulnerability in admin/editor2/spaw_control.class.php in the Cjay Content 3 module for XOOPS a

35RISK

open ↗

Referência✓ VexDay Proof

PHPNews 0.93 - 'format_menue' Remote File Inclusion

CVE-2007-4232—webappsphp

PHP remote file inclusion vulnerability in admin/inc/change_action.php in Andreas Robertz PHPNews 0.93 allows remote att

35RISK

open ↗

Referência✓ VexDay Proof

mIRC 6.34 - Remote Buffer Overflow (PoC)

CVE-2008-4449—doswindows

Stack-based buffer overflow in mIRC 6.34 allows remote attackers to execute arbitrary code via a long hostname in a PRIV

50RISK

open ↗

Referência✓ VexDay Proof

ESET SysInspector 1.1.1.0 - 'esiadrv.sys' (PoC)

CVE-2008-4451—doswindows

The SysInspector AntiStealth driver (esiasdrv.sys) 3.0.65535.0 in ESET System Analyzer Tool 1.1.1.0 allows local users t

23RISK

open ↗

Referência✓ VexDay Proof

The Net Guys ASPired2Protect - Database Disclosure

CVE-2008-6355—webappsasp

The Net Guys ASPired2Protect stores sensitive information under the web root with insufficient access control, which all

23RISK

open ↗

Referência✓ VexDay Proof

vxFtpSrv 2.0.3 - 'CWD' Remote Buffer Overflow (PoC)

CVE-2008-4452—doswindows

Buffer overflow in Cambridge Computer Corporation vxFtpSrv 2.0.3 allows remote attackers to cause a denial of service (c

23RISK

open ↗

Referência✓ VexDay Proof

MySQL Quick Admin 1.5.5 - 'cookie' Local File Inclusion

CVE-2008-4455—webappsphp

Directory traversal vulnerability in index.php in EKINdesigns MySQL Quick Admin 1.5.5 and earlier, when magic_quotes_gpc

23RISK

open ↗

Referência✓ VexDay Proof

CHILKAT ASP String - 'CkString.dll 1.1 SaveToFile()' Insecure Method

CVE-2007-4252—remotewindows

Absolute path traversal vulnerability in a certain ActiveX control in CkString.dll 1.1 and earlier in CHILKAT ASP String

23RISK

open ↗

Referência✓ VexDay Proof

my-colex 1.4.2 - Authentication Bypass / SQL Injection / Cross-Site Scripting

CVE-2009-1809—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in myColex 1.4.2 allow remote attackers to inject arbitrary web scri

23RISK

open ↗

Referência✓ VexDay Proof

Vastal I-Tech Dating Zone - 'fage' SQL Injection

CVE-2008-4461—webappsphp

SQL injection vulnerability in advanced_search_results.php in Vastal I-Tech Dating Zone, possibly 0.9.9, allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

Banner Exchange Java - Authentication Bypass

CVE-2008-6364—webappsasp

SQL injection vulnerability in logon_process.jsp in Ad Server Solutions Banner Exchange Solution Java allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

2DayBiz Custom T-shirt Design - SQL Injection / Cross-Site Scripting

CVE-2009-1820—webappsphp

Cross-site scripting (XSS) vulnerability in product.php in 2daybiz Custom T-shirt Design Script allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Vastal I-Tech Visa Zone - 'news_id' SQL Injection

CVE-2008-4462—webappsphp

SQL injection vulnerability in view_news.php in Vastal I-Tech Visa Zone allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Vastal I-Tech Jobs Zone - 'news_id' SQL Injection

CVE-2008-4463—webappsphp

SQL injection vulnerability in view_news.php in Vastal I-Tech Jobs Zone allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Feindt Computerservice News 2.0 - 'newsadmin.php?action' Remote File Inclusion

CVE-2007-2708—webappsphp

PHP remote file inclusion vulnerability in newsadmin.php in Feindt Computerservice News (News-Script) 2.0 allows remote

35RISK

open ↗

Referência✓ VexDay Proof

Vastal I-Tech Mag Zone - 'cat_id' SQL Injection

CVE-2008-4464—webappsphp

SQL injection vulnerability in view_mags.php in Vastal I-Tech Mag Zone allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Vastal I-Tech DVD Zone - 'cat_id' SQL Injection

CVE-2008-4465—webappsphp

SQL injection vulnerability in view_mags.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Vastal I-Tech Toner Cart - 'id' SQL Injection

CVE-2008-4467—webappsphp

SQL injection vulnerability in show_series_ink.php in Vastal I-Tech Toner Cart allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

LimeSurvey (phpsurveyor) 1.49rc2 - Remote File Inclusion

CVE-2007-3632—webappsphp

Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor) 1.49RC2 allow remote attackers to exe

35RISK

open ↗

Referência✓ VexDay Proof

Microsoft DXMedia SDK 6 - 'SourceUrl' ActiveX Remote Code Execution

CVE-2007-4336—remotewindows

Buffer overflow in the Live Picture Corporation DXSurface.LivePicture.FlashPix.1 (DirectTransform FlashPix) ActiveX cont

35RISK

open ↗

Referência✓ VexDay Proof

Numark Cue 5.0 rev 2 - '.m3u' File Local Stack Buffer Overflow

CVE-2008-4470—localwindows

Stack-based buffer overflow in Numark CUE 5.0 rev2 allows user-assisted attackers to cause a denial of service (applicat

23RISK

open ↗

Referência✓ VexDay Proof

Yerba SACphp 6.3 - Local File Inclusion

CVE-2008-4486—webappsphp

Directory traversal vulnerability in index.php in SAC.php (SACphp), as used in Yerba 6.3 and earlier, allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

Yourownbux 4.0 - 'cookie' SQL Injection

CVE-2008-4492—webappsphp

SQL injection vulnerability in referrals.php in YourOwnBux 4.0 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft PicturePusher - ActiveX Cross-Site Arbitrary File Upload

CVE-2008-4493—remotewindows

Microsoft PicturePusher ActiveX control (PipPPush.DLL 7.00.0709), as used in Microsoft Digital Image 2006 Starter Editio

28RISK

open ↗

Referência✓ VexDay Proof

Ol BookMarks Manager 0.7.5 - Local File Inclusion / Remote File Inclusion / SQL Injection

CVE-2008-6408—webappsphp

PHP remote file inclusion vulnerability in frame.php in ol'bookmarks manager 0.7.5 allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

TorrentTrader Classic 1.04 - Blind SQL Injection

CVE-2008-4494—webappsphp

SQL injection vulnerability in completed-advance.php in TorrentTrader Classic 1.08 and 1.04 and earlier allows remote at

23RISK

open ↗

Referência✓ VexDay Proof

Built2Go PHP Realestate 1.5 - 'event_detail.php' SQL Injection

CVE-2008-4497—webappsphp

SQL injection vulnerability in event_detail.php in Built2Go Real Estate Listings 1.5 allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

Konqueror 3.5.9 - 'font color' Remote Crash

CVE-2008-4514—doslinux

The HTML parser in KDE Konqueror 3.5.9 allows remote attackers to cause a denial of service (application crash) via a fo

23RISK

open ↗

Referência✓ VexDay Proof

SOTEeSKLEP 3.5RC9 - 'file' Remote File Disclosure

CVE-2007-4369—webappsphp

Directory traversal vulnerability in go/_files in SOTEeSKLEP before 4.0 allows remote attackers to read arbitrary files

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.