Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

80,095cataloged exploits
36,945CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,476Referência 23,442GitHub PoC 15,312VulnCheck XDB 8,970Nuclei 4,393Metasploit 3,502✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
Online Guestbook Pro 5.1 - 'ogp_show.php' Cross-Site Scripting
CVE-2009-2441—webappsphp09 Jul 2009
Cross-site scripting (XSS) vulnerability in ogp_show.php in Online Guestbook Pro 5.1 allows remote attackers to inject a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows Live Messenger Plus! Fileserver 1.0 - Directory Traversal
CVE-2009-2544—remotewindows09 Jul 2009
Directory traversal vulnerability in the Marcelo Costa FileServer component 1.0 for Microsoft Windows Live Messenger and
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FreeBSD 7.0/7.1 - 'vfs.usermount' Local Privilege Escalation
CVE-2008-3531—localfreebsd09 Jul 2009
Stack-based buffer overflow in sys/kern/vfs_mount.c in the kernel in FreeBSD 7.0 and 7.1, when vfs.usermount is enabled,
23RISK
open ↗
Exploit-DB✓ VexDay Proof
otsAV DJ 1.85.064 - '.ofl' Local Heap Overflow (PoC)
CVE-2009-3812—doswindows09 Jul 2009
Heap-based buffer overflow in OtsAV DJ trial version 1.85.64.0, Radio trial version 1.85.64.0, TV trial version 1.85.64.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Soulseek 157 NS < 13e/156.x - Remote Peer Search Code Execution (PoC)
CVE-2009-1830—doswindows09 Jul 2009
Stack-based buffer overflow in Soulseek 156 and 157 NS allows remote attackers to execute arbitrary code via a long sear
23RISK
open ↗
Exploit-DB✓ VexDay Proof
ClearContent - '/image.php?url' Local/Remote File Inclusion
CVE-2009-3535—webappsphp09 Jul 2009
Directory traversal vulnerability in image.php in Clear Content 1.1 allows remote attackers to read arbitrary files via
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.24_16-23/2.6.27_7-10/2.6.28.3 (Ubuntu 8.04/8.10 / Fedora Core 10 x86-64) - 'set_selection()' UTF-8 Off-by-One Privilege Escalation
CVE-2009-1046—locallinux_x86-6409 Jul 2009
The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4, 2.6.25, and possibly earlier versions, when th
23RISK
open ↗
Exploit-DB✓ VexDay Proof
TalkBack 2.3.14 - Multiple Vulnerabilities
CVE-2009-4874—webappsphp09 Jul 2009
TalkBack 2.3.14 does not properly restrict access to the edit comment feature (comments.php), which allows remote attack
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Universe CMS 1.0.6 - 'vnews.php?id' SQL Injection
CVE-2009-3531—webappsphp09 Jul 2009
SQL injection vulnerability in vnews.php in Universe CMS 1.0.6 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Mlffat 2.2 - Blind SQL Injection
CVE-2009-2585—webappsphp09 Jul 2009
SQL injection vulnerability in index.php in Mlffat 2.2 allows remote attackers to execute arbitrary SQL commands via a m
23RISK
open ↗
Exploit-DB✓ VexDay Proof
TalkBack 2.3.14 - Multiple Vulnerabilities
CVE-2009-4854—webappsphp09 Jul 2009
addons/import.php in TalkBack 2.3.14 allows remote attackers to execute arbitrary commands via the result parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Linea21 1.2.1 - 'search' Cross-Site Scripting
CVE-2009-2442—webappsphp08 Jul 2009
Cross-site scripting (XSS) vulnerability in public/index.php in Linea21 1.2.1 allows remote attackers to inject arbitrar
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Rentventory - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
CVE-2009-2437—webappsphp07 Jul 2009
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Rentventory 1.0.1 allow remote attackers to inject a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Tausch Ticket Script 3 - 'suchauftraege_user.php?userid' SQL Injection
CVE-2009-2428—webappsphp07 Jul 2009
Multiple SQL injection vulnerabilities in Tausch Ticket Script 3 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Swinger Club Portal - 'start.php?go' Remote File Inclusion
CVE-2009-4752—webappsphp07 Jul 2009
PHP remote file inclusion vulnerability in anzeiger/start.php in Swinger Club Portal allows remote attackers to execute
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Swinger Club Portal - 'start.php?id' SQL Injection
CVE-2009-4751—webappsphp07 Jul 2009
SQL injection vulnerability in anzeiger/start.php in Swinger Club Portal allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Tausch Ticket Script 3 - 'vote.php?descr' SQL Injection
CVE-2009-2428—webappsphp07 Jul 2009
Multiple SQL injection vulnerabilities in Tausch Ticket Script 3 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
HP Multiple LaserJet Printer - Cross-Site Scripting
CVE-2009-2684—remotehardware04 Jul 2009
Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJe
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Rentventory - Multiple SQL Injections
CVE-2009-2339—webappsphp02 Jul 2009
SQL injection vulnerability in index.php in Rentventory allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Opial 1.0 - Authentication Bypass
CVE-2009-2340—webappsphp02 Jul 2009
SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Opial 1.0 - 'albumID' SQL Injection
CVE-2009-2341—webappsphp02 Jul 2009
SQL injection vulnerability in albumdetail.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Opial 1.0 - Authentication Bypass
CVE-2009-2388—webappsphp02 Jul 2009
SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Sourcefire 3D Sensor & Defense Center 4.8.x - Privilege Escalation
CVE-2009-2344—webappscgi02 Jul 2009
The web-based management interfaces in Sourcefire Defense Center (DC) and 3D Sensor before 4.8.2 allow remote authentica
23RISK
open ↗
Exploit-DB✓ VexDay Proof
CMS chainuk 1.2 - Multiple Vulnerabilities
CVE-2009-2331—webappsphp01 Jul 2009
Multiple static code injection vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to inject arbitrary
23RISK
open ↗
Exploit-DB✓ VexDay Proof
ARD-9808 DVR Card Security Camera - GET Remote Denial of Service
CVE-2009-2305—doshardware01 Jul 2009
The ARD-9808 DVR card security camera allows remote attackers to cause a denial of service via a long URI composed of //
23RISK
open ↗
Exploit-DB✓ VexDay Proof
CMS chainuk 1.2 - Multiple Vulnerabilities
CVE-2009-2333—webappsphp01 Jul 2009
Multiple directory traversal vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to include and execut
23RISK
open ↗
Exploit-DB✓ VexDay Proof
kervinet forum 1.1 - Multiple Vulnerabilities
CVE-2009-2326—webappsphp01 Jul 2009
Multiple SQL injection vulnerabilities in KerviNet Forum 1.1 and earlier allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Exploit-DB✓ VexDay Proof
kervinet forum 1.1 - Multiple Vulnerabilities
CVE-2009-2327—webappsphp01 Jul 2009
Cross-site scripting (XSS) vulnerability in add_voting.php in KerviNet Forum 1.1 and earlier allows remote authenticated
23RISK
open ↗
Exploit-DB✓ VexDay Proof
ARD-9808 DVR Card Security Camera - Arbitrary Configuration Disclosure
CVE-2009-2306—remotehardware01 Jul 2009
The ARD-9808 DVR card security camera stores sensitive information under the web root with insufficient access control,
23RISK
open ↗
Exploit-DB✓ VexDay Proof
CMS chainuk 1.2 - Multiple Vulnerabilities
CVE-2009-2332—webappsphp01 Jul 2009
CMS Chainuk 1.2 and earlier allows remote attackers to obtain sensitive information via (1) a crafted id parameter to in
23RISK
open ↗
← previouspage 261 / 636next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.