Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,150cataloged exploits
39,601CVEs with public exploitation
24,695lab-tested
AllReferência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Sitellite CMS 4.2.12 - '559668.php' Remote File Inclusion
CVE-2007-3228—webappsphp
PHP remote file inclusion vulnerability in saf/lib/PEAR/PhpDocumentor/Documentation/tests/bug-559668.php in Sitellite CM
35RISK
open ↗
Referência✓ VexDay Proof
EasyClassifields 3.0 - 'go' SQL Injection
CVE-2008-4084—webappsphp
SQL injection vulnerability in staticpages/easyclassifields/index.php in MyioSoft EasyClassifields 3.0 allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
ASPSiteWare Automotive Dealer 1.0/2.0 - SQL Injection
CVE-2008-6874—webappsphp
Multiple SQL injection vulnerabilities in ASP SiteWare autoDealer 1 and 2 allow remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
ASP Smiley 1.0 - 'default.asp' Authentication Bypass / SQL Injection
CVE-2006-5952—webappsasp
SQL injection vulnerability in admin/default.asp in ASP Smiley 1.0 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
Enterprise Payroll Systems 1.1 - 'footer' Remote File Inclusion
CVE-2006-2982—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Enterprise Timesheet and Payroll Systems (EPS) 1.1 and earlier all
23RISK
open ↗
Referência✓ VexDay Proof
myPHPNuke < 1.8.8_8rc2 - 'artid' SQL Injection
CVE-2008-4092—webappsphp
SQL injection vulnerability in printfeature.php in myPHPNuke (MPN) before 1.8.8_8rc2 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Yourownbux 3.1/3.2 Beta - SQL Injection
CVE-2008-4093—webappsphp
SQL injection vulnerability in memberstats.php in YourOwnBux 3.1 and 3.2 beta, when magic_quotes_gpc is disabled, allows
23RISK
open ↗
Referência✓ VexDay Proof
Zeeways ZeeJobsite 2.0 - Arbitrary File Upload
CVE-2008-6913—webappsphp
Unrestricted file upload vulnerability in editresume_next.php in Zeeways ZEEJOBSITE 2.0 allows remote authenticated user
23RISK
open ↗
Referência✓ VexDay Proof
X10media Mp3 Search Engine 1.5.5 - Remote File Inclusion
CVE-2008-4141—webappsphp
Multiple PHP remote file inclusion vulnerabilities in x10Media x10 Automatic MP3 Script 1.5.5 allow remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
GNUBoard 4.31.03 (08.12.29) - Local File Inclusion
CVE-2009-0290—webappsphp
Directory traversal vulnerability in common.php in SIR GNUBoard 4.31.03 allows remote attackers to include and execute a
23RISK
open ↗
Referência✓ VexDay Proof
addalink 4 - 'category_id' SQL Injection
CVE-2008-4145—webappsphp
SQL injection vulnerability in user_read_links.php in Addalink 1.0 beta 4 and earlier, when magic_quotes_gpc is disabled
23RISK
open ↗
Referência✓ VexDay Proof
smcFanControl 2.1.2 (OSX) - Multiple Buffer Overflow Vulnerabilities (PoC)
CVE-2008-6252—dososx
Stack-based buffer overflow in the smc program in smcFanControl 2.1.2 allows local users to execute arbitrary code and g
23RISK
open ↗
Referência✓ VexDay Proof
SpeedStream 5200 - Authentication Bypass Configuration Download
CVE-2008-6916—remotehardware
Siemens SpeedStream 5200 with NetPort Software 1.1 allows remote attackers to bypass authentication via an invalid Host
23RISK
open ↗
Referência✓ VexDay Proof
CYASK 3.x - 'neturl' Local File Disclosure
CVE-2008-4151—webappsphp
Directory traversal vulnerability in collect.php in CYASK 3.x allows remote attackers to read arbitrary files via a .. (
23RISK
open ↗
Referência✓ VexDay Proof
Collabtive 0.4.8 - Cross-Site Scripting / Authentication Bypass / Arbitrary File Upload
CVE-2008-6948—webappsphp
Unrestricted file upload vulnerability in Collabtive 0.4.8 allows remote authenticated users to execute arbitrary code b
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_waticketsystem - Blind SQL Injection
CVE-2009-0333—webappsphp
SQL injection vulnerability in the WebAmoeba (WA) Ticket System (com_waticketsystem) component for Joomla! allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Acc Real Estate 4.0 - Insecure Cookie Handling
CVE-2008-6293—webappsphp
admin/Index.php in Acc Real Estate 4.0 allows remote attackers to bypass authentication and gain administrative access b
23RISK
open ↗
Referência✓ VexDay Proof
DD-WRT HTTPd Daemon/Service - Remote Command Execution
CVE-2008-6975—remotehardware
Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp2 allow remote attackers to hijac
23RISK
open ↗
Referência✓ VexDay Proof
Pre Real Estate Listings - 'search.php' SQL Injection
CVE-2008-4177—webappsphp
SQL injection vulnerability in search.php in Pre Real Estate Listings allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
FipsCMS 4.5 - 'index.asp' SQL Injection
CVE-2006-6115—webappsasp
SQL injection vulnerability in index.asp in fipsCMS 4.5 and earlier allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
PHPOCS 0.1-beta3 - 'act' Local File Inclusion
CVE-2008-4331—webappsphp
Directory traversal vulnerability in library/pagefunctions.inc.php in phpOCS 0.1 beta3 and earlier allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
fipsForum 2.6 - 'default2.asp' SQL Injection
CVE-2006-6116—webappsasp
SQL injection vulnerability in default2.asp in fipsForum 2.6 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
TFTP Server for Windows 1.4 - ST Remote BSS Overflow
CVE-2008-2161—remotewindows
Buffer overflow in TFTP Server SP 1.4 and 1.5 on Windows, and possibly other versions, allows remote attackers to execut
50RISK
open ↗
Referência✓ VexDay Proof
WEBalbum 2.4b - 'id' Blind SQL Injection
CVE-2009-0446—webappsphp
SQL injection vulnerability in photo.php in WEBalbum 2.4b allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
Micro CMS 0.3.5 - 'microcms_path' Remote File Inclusion
CVE-2006-3144—webappsphp
PHP remote file inclusion vulnerability in micro_cms_files/microcms-include.php in Implied By Design (IBD) Micro CMS 3.5
23RISK
open ↗
Referência✓ VexDay Proof
SkaLinks 1.5 - Authentication Bypass
CVE-2009-0451—webappsphp
SQL injection vulnerability in Skalfa SkaLinks 1.5 allows remote attackers to execute arbitrary SQL commands via the Adm
23RISK
open ↗
Referência✓ VexDay Proof
WebCMS Portal Edition - 'id' Blind SQL Injection
CVE-2008-4185—webappsphp
SQL injection vulnerability in index.php in webCMS Portal Edition allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
Talkback 2.3.6 - Multiple Local File Inclusion / PHPInfo Disclosure Vulnerabilities
CVE-2008-4346—webappsphp
Directory traversal vulnerability in TalkBack 2.3.6 and 2.3.6.4 allows remote attackers to include and execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Attachmax Dolphin 2.1.0 - Multiple Vulnerabilities
CVE-2008-4207—webappsphp
Attachmax Dolphin 2.1.0 and earlier does not properly protect info.php in the main folder, which allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
WholeHogSoftware Password Protect - Insecure Cookie Handling
CVE-2009-0461—webappsphp
Whole Hog Password Protect: Enhanced 1.x allows remote attackers to bypass authentication and obtain administrative acce
23RISK
open ↗
← previouspage 25 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.