Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,595cataloged exploits
39,731CVEs with public exploitation
24,695lab-tested
AllReferência 25,742Exploit-DB 24,485GitHub PoC 16,614VulnCheck XDB 9,736Nuclei 4,493Metasploit 3,525✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Opera 9.60 - Persistent Cross-Site Scripting
CVE-2008-4725—remotewindows
Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to inject arbitrary web scri
23RISK
open ↗
Referência✓ VexDay Proof
iDB 0.2.5pa SVN 243 - 'skin' Local File Inclusion
CVE-2009-1498—webappsphp
Directory traversal vulnerability in inc/profilemain.php in Game Maker 2k Internet Discussion Boards (iDB) 0.2.5 Pre-Alp
23RISK
open ↗
Referência✓ VexDay Proof
Woltlab Burning Board 2.3.5 - 'links.php' SQL Injection
CVE-2006-2569—webappsphp
SQL injection vulnerability in links.php in 4R Linklist 1.0 RC2 and earlier, a module for Woltlab Burning Board, allows
23RISK
open ↗
Referência✓ VexDay Proof
KVIrc 3.4.0 - Virgo Remote Format String (PoC)
CVE-2008-4748—doswindows
Format string vulnerability in the URI handler in KVirc 3.4.0, when set as the default application for processing IRC UR
23RISK
open ↗
Referência✓ VexDay Proof
Informium 0.12.0 - 'common-menu.php' Remote File Inclusion
CVE-2006-2818—webappsphp
PHP remote file inclusion vulnerability in common-menu.php in Cameron McKay Informium 0.12.0 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
PHPbbBook 1.3 - 'bbcode.php?l' Local File Inclusion
CVE-2009-0442—webappsphp
Directory traversal vulnerability in bbcode.php in PHPbbBook 1.3 and 1.3h allows remote attackers to include and execute
23RISK
open ↗
Referência✓ VexDay Proof
ClickCart 6.0 - Authentication Bypass
CVE-2009-0462—webappsphp
Multiple SQL injection vulnerabilities in customer_login_check.asp in ClickTech ClickCart 6.0 allow remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Kjtechforce mailman b1 - 'dest' Blind SQL Injection
CVE-2009-2164—webappsphp
Multiple SQL injection vulnerabilities in Kjtechforce mailman beta1, when magic_quotes_gpc is disabled, allow remote att
23RISK
open ↗
Referência✓ VexDay Proof
Igloo 0.1.9 - 'Wiki.php' Remote File Inclusion
CVE-2006-2819—webappsphp
PHP remote file inclusion vulnerability in Wiki.php in Barnraiser Igloo 0.1.9 and earlier allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component SimpleBoard 1.1.0 - Remote File Inclusion
CVE-2006-3528—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Simpleboard Mambo module 1.1.0 and earlier allow remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Aj RSS Reader - 'url' SQL Injection
CVE-2008-4753—webappsphp
SQL injection vulnerability in EditUrl.php in AJ Square RSS Reader allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
phpdaily - SQL Injection / Cross-Site Scripting / Local File Download
CVE-2008-4758—webappsphp
Directory traversal vulnerability in download_file.php in PHP-Daily allows remote attackers to read arbitrary local file
23RISK
open ↗
Referência✓ VexDay Proof
Nokia N95-8 browser - 'setAttributeNode' Method Crash
CVE-2009-0649—doshardware
The web browser in Symbian OS on the Nokia N95 cell phone allows remote attackers to cause a denial of service (crash) v
23RISK
open ↗
Referência✓ VexDay Proof
SDP Downloader 2.3.0 - '.asx' Local Heap Overflow (PoC)
CVE-2009-1627—doswindows
Stack-based buffer overflow in Streaming Download Project (SDP) Downloader 2.3.0 allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
SDP Downloader 2.3.0 - '.asx' Local Buffer Overflow (SEH) (1)
CVE-2009-1627—localwindows
Stack-based buffer overflow in Streaming Download Project (SDP) Downloader 2.3.0 allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
empris r20020923 - 'phormationdir' Remote File Inclusion
CVE-2006-2962—webappsphp
PHP remote file inclusion vulnerability in sql_fcnsOLD.php in Emergenices Personnel Information System (Empris) 20020923
23RISK
open ↗
Referência✓ VexDay Proof
Focus/SIS 1.0/2.2 - Remote File Inclusion
CVE-2007-4807—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Focus/SIS 2.2 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗
Referência✓ VexDay Proof
Philips VOIP841 Firmware 1.0.4.800 - Multiple Vulnerabilities
CVE-2008-4875—remotehardware
Directory traversal vulnerability in the web server in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and
23RISK
open ↗
Referência✓ VexDay Proof
Maran PHP Shop - 'prodshow.php' SQL Injection
CVE-2008-4880—webappsphp
SQL injection vulnerability in prodshow.php in Maran PHP Shop allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Xitami Web Server 2.5c2 - LRWP Processing Format String (PoC)
CVE-2008-6519—doswindows
Format string vulnerability in Xitami Web Server 2.2a through 2.5c2, and possibly other versions, allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
Mini-stream Ripper 3.0.1.1 - '.asx' 'HREF' Local Buffer Overflow
CVE-2009-1641—localwindows
Multiple stack-based buffer overflows in Mini-stream Ripper 3.0.1.1 allow remote attackers to execute arbitrary code via
50RISK
open ↗
Referência✓ VexDay Proof
YourFreeWorld Reminder Service - SQL Injection
CVE-2008-4881—webappsphp
SQL injection vulnerability in tr.php in YourFreeWorld Reminder Service Script allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
GO4I.NET ASP Forum 1.0 - SQL Injection
CVE-2008-6527—webappsphp
SQL injection vulnerability in forum.asp in GO4I.NET ASP Forum 1.0 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
Netgear SSL312 Router - Denial of Service
CVE-2009-0680—doshardware
cgi-bin/welcome/VPN_only in the web interface in Netgear SSL312 allows remote attackers to cause a denial of service (de
23RISK
open ↗
Referência✓ VexDay Proof
Enthrallweb ePhotos 1.0 - 'subLevel2.asp' SQL Injection
CVE-2006-3027—webappsasp
Multiple SQL injection vulnerabilities in Enthrallwebe ePhotos 2.2 and earlier allow remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
Trend Micro Internet Security Pro 2009 - Priviliege Escalation
CVE-2009-0686—localwindows
The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro 2008 and 2009, and Securit
23RISK
open ↗
Referência✓ VexDay Proof
Ajax File Browser 3b - 'settings.inc.php?approot' Remote File Inclusion
CVE-2007-4921—webappsphp
PHP remote file inclusion vulnerability in _includes/settings.inc.php in Ajax File Browser 3 Beta allows remote attacker
35RISK
open ↗
Referência✓ VexDay Proof
Peachtree Accounting 2004 - 'PAWWeb11.ocx' ActiveX Insecure Method
CVE-2008-4699—remotewindows
Insecure method vulnerability in the ActiveX control (PAWWeb11.ocx) in Peachtree Accounting 2004 allows remote attackers
28RISK
open ↗
Referência✓ VexDay Proof
Vbgooglemap Hotspot Edition 1.0.3 - SQL Injection
CVE-2008-4706—webappsphp
SQL injection vulnerability in VBGooglemap Hotspot Edition 1.0.3, a vBulletin module, allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
YourFreeWorld Classifieds Hosting - SQL Injection
CVE-2008-4884—webappsphp
SQL injection vulnerability in tr.php in YourFreeWorld Classifieds Hosting Script allows remote attackers to execute arb
23RISK
open ↗
← previouspage 29 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.