Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,035cataloged exploits
39,531CVEs with public exploitation
24,695lab-tested
AllReferência 25,557Exploit-DB 24,485GitHub PoC 16,313VulnCheck XDB 9,678Nuclei 4,478Metasploit 3,524✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
PassWiki 0.9.16 RC3 - 'site_id' Local File Inclusion
CVE-2008-6423—webappsphp
Directory traversal vulnerability in passwiki.php in PassWiki 0.9.16 RC3 and earlier allows remote attackers to read arb
23RISK
open ↗
Referência✓ VexDay Proof
HiveMaker Directory 1.0.2 - 'cid' SQL Injection
CVE-2008-6427—webappsphp
SQL injection vulnerability in index.php in Hivemaker Professional 1.0.2 and earlier, when magic_quotes_gpc is disabled,
23RISK
open ↗
Referência✓ VexDay Proof
e107 Plugin BLOG Engine 2.1.4 - SQL Injection
CVE-2008-6438—webappsphp
SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows re
23RISK
open ↗
Referência✓ VexDay Proof
6rbScript 3.3 - 'singerid' SQL Injection
CVE-2008-6454—webappsphp
SQL injection vulnerability in section.php in 6rbScript 3.3 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
Mole Group Taxi Calc Dist Script - Authentication Bypass
CVE-2008-6484—webappsphp
SQL injection vulnerability in login.php in Mole Group Taxi Map Script (aka Taxi Calc Dist Script) allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
DigiAffiliate 1.4 - Authentication Bypass
CVE-2008-6487—webappsasp
Multiple SQL injection vulnerabilities in login.asp in Digiappz DigiAffiliate 1.4 and earlier allow remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
WebLog - 'index.php' Remote File Disclosure
CVE-2007-1487—webappsphp
Directory traversal vulnerability in index.php in Sascha Schroeder (aka CyberTeddy or Cyber-inside) WebLog allows remote
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke Platinum 7.6.b.5 - 'dynamic_titles.php' SQL Injection
CVE-2008-1539—webappsphp
SQL injection vulnerability in includes/dynamic_titles.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
VMware Workstation 6.5.1 - 'hcmon.sys 6.0.0.45731' Local Denial of Service
CVE-2008-3761—doswindows
hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VM
23RISK
open ↗
Referência✓ VexDay Proof
Netartmedia Jobs Portal 1.3 - Multiple SQL Injections
CVE-2008-6030—webappsphp
Multiple SQL injection vulnerabilities in NetArtMedia Jobs Portal 1.3 allow remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
FLABER 1.1 RC1 - Remote Command Execution
CVE-2008-6490—webappsphp
function/update_xml.php in FLABER 1.1 and earlier allows remote attackers to overwrite arbitrary files by specifying the
23RISK
open ↗
Referência✓ VexDay Proof
Tizag Countdown Creator 3 - Insecure Upload
CVE-2008-6492—webappsphp
Unrestricted file upload vulnerability in process.php in Tizag Countdown Creator 3 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2008-6511—webappsjsp
Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arb
23RISK
open ↗
Referência✓ VexDay Proof
NULL FTP Server 1.1.0.7 - 'Site' Command Injection
CVE-2008-6534—remotewindows
Incomplete blacklist vulnerability in NULL FTP Server Free and Pro 1.1.0.7 allows remote authenticated users to execute
23RISK
open ↗
Referência✓ VexDay Proof
TopperMod 2.0 - SQL Injection
CVE-2008-1554—webappsphp
SQL injection vulnerability in account/index.php in TopperMod 2.0, when magic_quotes_gpc is disabled, allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
SunShop Shopping Cart 4.1.4 - 'id' SQL Injection
CVE-2008-3768—webappsphp
Multiple SQL injection vulnerabilities in class.ajax.php in Turnkey Web Tools SunShop Shopping Cart before 4.1.5 allow r
23RISK
open ↗
Referência✓ VexDay Proof
Destar 0.2.2-5 - Arbitrary Add New User
CVE-2008-6538—webappsphp
DeStar 0.2.2-5 allows remote attackers to add arbitrary users via a direct request to config/add/CfgOptUser.
23RISK
open ↗
Referência✓ VexDay Proof
LightNEasy sqlite / no database 1.2.2 - Multiple Vulnerabilities
CVE-2008-6593—webappsphp
SQL injection vulnerability in LightNEasy/lightneasy.php in LightNEasy SQLite 1.2.2 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
MatPo Link 1.2b - Blind SQL Injection / Cross-Site Scripting
CVE-2008-6607—webappsphp
Cross-site scripting (XSS) vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to inject arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
WEBBDOMAIN Polls 1.01 - Authentication Bypass
CVE-2008-6625—webappsphp
SQL injection vulnerability in getin.php in WEBBDOMAIN Polls (aka Poll) 1.0 and 1.01 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
MercuryBoard 1.1.5 - 'login.php' Blind SQL Injection
CVE-2008-6632—webappsphp
SQL injection vulnerability in func/login.php in MercuryBoard 1.1.5 and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component nfnaddressbook 0.4 - Remote File Inclusion
CVE-2007-1596—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the NFN Address Book (com_nfn_addressbook) 0.4 component for Mambo
23RISK
open ↗
Referência✓ VexDay Proof
VideoLAN VLC Media Player 0.8.6i - Mms Protocol Handling Heap Overflow (PoC)
CVE-2008-3794—dosmultiple
Integer signedness error in the mms_ReceiveCommand function in modules/access/mms/mmstu.c in VLC Media Player 0.8.6i all
28RISK
open ↗
Referência✓ VexDay Proof
Shader TV (Beta) - Multiple SQL Injections
CVE-2008-6641—webappsasp
Multiple SQL injection vulnerabilities in Shader TV (Beta) allow remote authenticated administrators to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
U&M Software JustBookIt 1.0 - Authentication Bypass
CVE-2008-6718—webappsphp
U&M Software JustBookIt 1.0 does not require administrative authentication for all scripts in the admin/ directory, whic
23RISK
open ↗
Referência✓ VexDay Proof
Flexphplink Pro - Arbitrary File Upload
CVE-2008-6731—webappsphp
Unrestricted file upload vulnerability in submitlink.php in FlexPHPLink Pro 0.0.7 allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
P2P Foxy - Out of Memory Denial of Service
CVE-2008-6742—doswindows
Foxy P2P software allows remote attackers to cause a denial of service (memory consumption) via a foxy URI with a downlo
23RISK
open ↗
Referência✓ VexDay Proof
RSMScript 1.21 - Cross-Site Scripting / Insecure Cookie Handling
CVE-2008-6743—webappsphp
RSMScript 1.21 allows remote attackers to bypass authentication and gain administrative privileges by setting the verifi
23RISK
open ↗
Referência✓ VexDay Proof
0irc-client 1345 build20060823 - Denial of Service
CVE-2007-1648—doswindows
0irc 1345 build 20060823 allows remote attackers to cause a denial of service (application crash) by operating an IRC se
23RISK
open ↗
Referência✓ VexDay Proof
FlexPHPDirectory 0.0.1 - Authentication Bypass
CVE-2008-6750—webappsphp
Unrestricted file upload vulnerability in add.php in FlexPHPDirectory 0.0.1 allows remote attackers to execute arbitrary
23RISK
open ↗
← previouspage 3 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.