Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,150cataloged exploits
39,601CVEs with public exploitation
24,695lab-tested
AllReferência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Cisco WebEx Meeting Manager UCF - 'atucfobj.dll' ActiveX Remote Buffer Overflow
CVE-2008-3558—remotewindows
Stack-based buffer overflow in the WebexUCFObject ActiveX control in atucfobj.dll in Cisco WebEx Meeting Manager before
50RISK
open ↗
Referência✓ VexDay Proof
AJ Auction Pro Platinum - 'seller_id' SQL Injection
CVE-2008-6003—webappsphp
SQL injection vulnerability in sellers_othersitem.php in AJ Auction Pro Platinum 2 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
phpAuction - 'profile.php' SQL Injection (1)
CVE-2008-6663—webappsphp
SQL injection vulnerability in profile.php in PHPAuctions.info PHPAuctions (aka PHPAuctionSystem) allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
merlix educate servert - Authentication Bypass / File Disclosure
CVE-2008-6871—webappsasp
Merlix Educate Server stores db.mdb under the web root with insufficient access control, which allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
Drake CMS < 0.2.3 ALPHA rev.916 - Remote File Inclusion
CVE-2006-5767—webappsphp
PHP remote file inclusion vulnerability in includes/xhtml.php in Drake CMS 0.2.2 alpha rev.846 and earlier allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Oracle APEX 3.2 - Unprivileged DB users can see APEX Password hashes
CVE-2009-0981—localmultiple
Unspecified vulnerability in the Application Express component in Oracle Database 11.1.0.7 allows remote authenticated u
23RISK
open ↗
Referência✓ VexDay Proof
DeluxeBB 1.3 - 'qorder' SQL Injection
CVE-2009-1033—webappsphp
SQL injection vulnerability in misc.php in DeluxeBB 1.3 and earlier allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
I-Rater Basic - SQL Injection
CVE-2008-6017—webappsphp
SQL injection vulnerability in messages.php in I-Rater Basic allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Powl 0.94 - 'htmledit.php' Remote File Inclusion
CVE-2007-3371—webappsphp
PHP remote file inclusion vulnerability in plugins/widgets/htmledit/htmledit.php in Powl 0.94 allows remote attackers to
45RISK
open ↗
Referência✓ VexDay Proof
phpBG 0.9.1 - 'rootdir' Remote File Inclusion
CVE-2007-4636—webappsphp
Multiple PHP remote file inclusion vulnerabilities in phpBG 0.9.1 allow remote attackers to execute arbitrary PHP code v
45RISK
open ↗
Referência✓ VexDay Proof
ABG Blocking Script 1.0a - 'abg_path' Remote File Inclusion
CVE-2008-3570—webappsphp
PHP remote file inclusion vulnerability in index.php in Africa Be Gone (ABG) 1.0a allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
PHPAdBoard - PHP uploads Arbitrary File Upload
CVE-2008-6921—webappsphp
Unrestricted file upload vulnerability in index.php in phpAdBoard 1.8 allows remote attackers to execute arbitrary code
23RISK
open ↗
Referência✓ VexDay Proof
GreenCart PHP Shopping Cart - 'id' SQL Injection
CVE-2008-3585—webappsphp
Multiple SQL injection vulnerabilities in PozScripts GreenCart PHP Shopping Cart allow remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
Netartmedia Real Estate Portal 1.2 - SQL Injection
CVE-2008-6042—webappsphp
SQL injection vulnerability in the re_search module in NetArtMedia Real Estate Portal 2.0 allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Symphony 1.7.01 (non-patched) - Remote Code Execution
CVE-2008-3592—webappsphp
Unrestricted file upload vulnerability in the File Manager in the admin panel in Twentyone Degrees Symphony 1.7.01 and e
23RISK
open ↗
Referência✓ VexDay Proof
Pre ADS Portal 2.0 - Authentication Bypass / Cross-Site Scripting
CVE-2008-6716—webappsphp
homeadmin/adminhome.php in Pre ADS Portal 2.0 and earlier does not require administrative authentication, which allows r
23RISK
open ↗
Referência✓ VexDay Proof
Exodus 0.10 - URI Handler Arbitrary Parameter Injection (2)
CVE-2008-6936—remotewindows
Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, over
23RISK
open ↗
Referência✓ VexDay Proof
Quicksilver Forums 1.4.1 - SQL Injection
CVE-2008-3601—webappsphp
SQL injection vulnerability in index.php in Quicksilver Forums 1.4.1 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
MyShoutPro 1.2 - Final Insecure Cookie Handling
CVE-2008-6738—webappsphp
MyShoutPro 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin_acce
23RISK
open ↗
Referência✓ VexDay Proof
Fast Click 1.1.3/2.3.8 - 'show.php' Remote File Inclusion
CVE-2006-2175—webappsphp
PHP remote file inclusion vulnerability in FtrainSoft Fast Click 2.3.8 and earlier allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
ReVou Twitter Clone - Arbitrary File Upload
CVE-2008-6751—webappsphp
Unrestricted file upload vulnerability in index.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging allows
23RISK
open ↗
Referência✓ VexDay Proof
aspwebalbum 3.2 - Arbitrary File Upload / SQL Injection / Cross-Site Scripting
CVE-2008-6977—webappsphp
Cross-site scripting (XSS) vulnerability in album.asp in Full Revolution aspWebAlbum 3.2 allows remote attackers to inje
23RISK
open ↗
Referência✓ VexDay Proof
Download Accelerator Plus DAP 8.6 - 'AniGIF.ocx' Buffer Overflow (PoC)
CVE-2008-3702—doswindows
Multiple stack-based buffer overflows in the Animation GIF ActiveX control in JComSoft AniGIF.ocx 1.12 and 2.47, as used
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Visual Studio - 'Msmask32.ocx' ActiveX Remote Buffer Overflow (PoC)
CVE-2008-3704—doswindows
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions befo
50RISK
open ↗
Referência✓ VexDay Proof
e107 Plugin ZoGo-Shop 1.15.4 - 'product' SQL Injection
CVE-2008-6114—webappsphp
SQL injection vulnerability in product_details.php in the Mytipper Zogo-shop 1.15.4 plugin for e107 allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
EnjoySAP ActiveX kweditcontrol.kwedit.1 - Remote Stack Overflow (PoC)
CVE-2007-3605—doswindows
Stack-based buffer overflow in the kweditcontrol.kwedit.1 ActiveX control in FrontEnd\SapGui\kwedit.dll in the EnjoySAP
50RISK
open ↗
Referência✓ VexDay Proof
Novell eDirectory < 8.7.3 SP 10 / 8.8.2 - HTTP headers Denial of Service
CVE-2008-0927—doswindows
dhost.exe in Novell eDirectory 8.7.3 before sp10 and 8.8.2 allows remote attackers to cause a denial of service (CPU con
45RISK
open ↗
Referência✓ VexDay Proof
phpArcadeScript 4 - 'cat' SQL Injection
CVE-2008-3711—webappsphp
SQL injection vulnerability in index.php in PHPArcadeScript (PHP Arcade Script) 4.0 allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
Affiliate Directory - 'id' SQL Injection
CVE-2008-3719—webappsphp
SQL injection vulnerability in directory.php in SFS Affiliate Directory allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Full PHP Emlak Script - 'arsaprint.php' SQL Injection
CVE-2008-6133—webappsphp
SQL injection vulnerability in arsaprint.php in Full PHP Emlak Script allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
← previouspage 23 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.