Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
24,696 exploits
Exploit-DB✓ VexDay Proof
VideoLAN VLC Media Player 0.9.4 - '.ty' Local Buffer Overflow (SEH)
CVE-2008-4654—localwindows23 Oct 2008
Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player
50RISK
open ↗
Exploit-DB✓ VexDay Proof
MindDezign Photo Gallery 2.2 - SQL Injection
CVE-2008-6789—webappsphp23 Oct 2008
SQL injection vulnerability in MindDezign Photo Gallery 2.2 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Exploit-DB✓ VexDay Proof
MindDezign Photo Gallery 2.2 - Arbitrary Add Admin
CVE-2008-6788—webappsphp23 Oct 2008
SQL injection vulnerability in MindDezign Photo Gallery 2.2, when magic_quotes_gpc is disabled, allows remote attackers
23RISK
open ↗
Exploit-DB✓ VexDay Proof
VideoLAN VLC Media Player 0.9.4 - '.ty' Local Buffer Overflow (SEH)
CVE-2008-4686—localwindows23 Oct 2008
Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHPhotoGallery 0.92 - 'index.php' SQL Injection
CVE-2008-6802—webappsphp21 Oct 2008
Multiple SQL injection vulnerabilities in index.php in phPhotoGallery 0.92 allow remote attackers to execute arbitrary S
23RISK
open ↗
Exploit-DB✓ VexDay Proof
VideoLAN VLC Media Player 0.9.4 - '.TY' Local Stack Buffer Overflow
CVE-2008-4654—localwindows21 Oct 2008
Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Bahar Download Script 2.0 - 'aspkat.asp' SQL Injection
CVE-2008-6075—webappsasp21 Oct 2008
SQL injection vulnerability in aspkat.asp in Bahar Download Script 2.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Dizi Portali - 'diziler.asp' SQL Injection
CVE-2008-6803—webappsasp21 Oct 2008
SQL injection vulnerability in diziler.asp in Yigit Aybuga Dizi Portali allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Exploit-DB✓ VexDay Proof
VideoLAN VLC Media Player 0.9.4 - '.TY' Local Stack Buffer Overflow
CVE-2008-4686—localwindows21 Oct 2008
Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Jetbox CMS 2.1 - '/admin/cms/images.php?orderby' SQL Injection
CVE-2008-4651—webappsphp20 Oct 2008
Multiple SQL injection vulnerabilities in Jetbox CMS 2.1 allow remote authenticated users to execute arbitrary SQL comma
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP-Nuke Sarkilar Module - 'id' SQL Injection
CVE-2008-6779—webappsphp20 Oct 2008
SQL injection vulnerability in the Sarkilar module for PHP-Nuke allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Jetbox CMS 2.1 - '/admin/cms/nav.php?nav_id' SQL Injection
CVE-2008-4651—webappsphp20 Oct 2008
Multiple SQL injection vulnerabilities in Jetbox CMS 2.1 allow remote authenticated users to execute arbitrary SQL comma
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Vivvo CMS 3.4 - Multiple Vulnerabilities
CVE-2006-4714—webappsphp19 Oct 2008
PHP remote file inclusion vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 an
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Vivvo CMS 3.4 - Multiple Vulnerabilities
CVE-2006-4715—webappsphp19 Oct 2008
SQL injection vulnerability in pdf_version.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earl
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Vivvo CMS 3.4 - Multiple Vulnerabilities
CVE-2007-3939—webappsphp19 Oct 2008
SQL injection vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) CMS 3.4 and earlie
23RISK
open ↗
Exploit-DB✓ VexDay Proof
BitTorrent 6.0.3 - '.torrent' Local Stack Buffer Overflow
CVE-2008-4434—localwindows19 Oct 2008
Stack-based buffer overflow in (1) uTorrent 1.7.7 build 8179 and earlier and (2) BitTorrent 6.0.3 build 8642 and earlier
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Nuke ET 3.4 - 'FCKeditor' Arbitrary File Upload
CVE-2005-0613—webappsphp18 Oct 2008
Unknown vulnerability in FCKeditor 2.0 RC2, when used with PHP-Nuke, allows remote attackers to upload arbitrary files.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Nuke ET 3.4 - 'FCKeditor' Arbitrary File Upload
CVE-2008-6178—webappsphp18 Oct 2008
Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FlashChat - 'connection.php' Role Filter Security Bypass
CVE-2008-6799—webappsphp17 Oct 2008
connection.php in FlashChat 5.0.8 allows remote attackers to bypass the role filter mechanism and gain administrative pr
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Habari 0.5.1 - 'habari_username' Cross-Site Scripting
CVE-2008-4601—webappsphp16 Oct 2008
Cross-site scripting (XSS) vulnerability in the login feature in Habari CMS 0.5.1 allows remote attackers to inject arbi
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Outlook Web Access for Exchange Server 2003 - 'redir.asp' Open Redirection
CVE-2008-1547—remotewindows15 Oct 2008
Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2
50RISK
open ↗
Exploit-DB✓ VexDay Proof
VideoLAN VLC Media Player 0.9.2 Media Player - XSPF Memory Corruption
CVE-2008-4558—doswindows14 Oct 2008
Array index error in VLC media player 0.9.2 allows remote attackers to overwrite arbitrary memory and execute arbitrary
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Elxis CMS 2008.1 - '/modules/mod_language.php' Multiple Cross-Site Scripting Vulnerabilities
CVE-2008-4648—webappsphp14 Oct 2008
Cross-site scripting (XSS) vulnerability in index.php in Elxis CMS 2008.1 revision 2204 allows remote attackers to injec
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Elxis CMS 2008.1 - PHPSESSID Variable Session Fixation
CVE-2008-4649—webappsphp14 Oct 2008
Session fixation vulnerability in Elxis CMS 2008.1 revision 2204 allows remote attackers to hijack web sessions by setti
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Nuked-klaN 1.7.7 / SP4.4 - Multiple Vulnerabilities
CVE-2007-2556—webappsphp14 Oct 2008
SQL injection vulnerability in Nuked-klaN 1.7.6 allows remote attackers to execute arbitrary SQL commands via the X-Forw
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Solaris sadmind adm_build_path - Remote Buffer Overflow (Metasploit)
CVE-2008-4556—remotesolaris14 Oct 2008
Stack-based buffer overflow in the adm_build_path function in sadmind in Sun Solstice AdminSuite on Solaris 8 and 9 allo
50RISK
open ↗
Exploit-DB✓ VexDay Proof
ASP Indir Iltaweb Alisveris Sistemi - 'xurunler.asp' SQL Injection
CVE-2008-5707—webappsasp13 Oct 2008
SQL injection vulnerability in urunler.asp in Iltaweb Alisveris Sistemi allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Oracle Database Server 11.1 - 'CREATE ANY Directory' Privilege Escalation
CVE-2008-6065—remotemultiple13 Oct 2008
Oracle Database Server 10.1, 10.2, and 11g grants directory WRITE permissions for arbitrary pathnames that are aliased i
23RISK
open ↗
Exploit-DB✓ VexDay Proof
LokiCMS 0.3.4 - 'writeconfig()' Remote Command Execution
CVE-2008-6643—webappsphp13 Oct 2008
LokiCMS 0.3.4 and possibly earlier versions does not properly restrict access to administrative functions, which allows
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Proxim Tsunami MP.11 2411 Wireless Access Point - 'system.sysName.0' SNMP HTML Injection
CVE-2008-5869—remotehardware09 Oct 2008
Cross-site scripting (XSS) vulnerability in the Proxim Wireless Tsunami MP.11 2411 with firmware 3.0.3 allows remote aut
23RISK
open ↗
← previouspage 288 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.