Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

80,324cataloged exploits
37,130CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,476Referência 23,614GitHub PoC 15,330VulnCheck XDB 9,001Nuclei 4,401Metasploit 3,502✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
Eclipse 3.3.2 IDE - 'Help Server help/advanced/searchView.jsp?SearchWord' Cross-Site Scripting
CVE-2008-7271—remotemultiple24 Apr 2008
Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclips
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP-Nuke DownloadsPlus Module - Arbitrary File Upload
CVE-2008-4767—webappsphp24 Apr 2008
Unrestricted file upload vulnerability in the DownloadsPlus module in PHP-Nuke allows remote attackers to execute arbitr
23RISK
open ↗
Exploit-DB✓ VexDay Proof
IBM Lotus Expeditor 6.1 - URI Handler Command Execution
CVE-2008-1965—remoteunix24 Apr 2008
Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Digital Hive 2.0 - 'base.php' Cross-Site Scripting
CVE-2008-1985—webappsphp24 Apr 2008
Cross-site scripting (XSS) vulnerability in base.php in DigitalHive 2.0 RC2 allows remote attackers to inject arbitrary
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Computer Associates ARCserve Backup Discovery Service Remote - Denial of Service
CVE-2008-1979—doswindows24 Apr 2008
The Discovery Service (casdscvc) in CA ARCserve Backup 12.0.5454.0 and earlier allows remote attackers to cause a denial
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Pixel Motion Blog - 'list_article.php' Cross-Site Scripting
CVE-2008-1986—webappsphp24 Apr 2008
Cross-site scripting (XSS) vulnerability in liste_article.php in Blog Pixel Motion (aka PixelMotion) allows remote attac
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Horde Webmail 1.0.6 - 'addevent.php' Cross-Site Scripting
CVE-2008-1974—webappsphp23 Apr 2008
Cross-site scripting (XSS) vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and
23RISK
open ↗
Exploit-DB✓ VexDay Proof
F5 Networks FirePass 4100 SSL VPN - 'installControl.php3' Cross-Site Scripting
CVE-2008-2030—remotehardware23 Apr 2008
Cross-site scripting (XSS) vulnerability in installControl.php3 in F5 FirePass 4100 SSL VPN 5.4.2-5.5.2 and 6.0-6.2 allo
23RISK
open ↗
Exploit-DB✓ VexDay Proof
S9Y Serendipity 1.3 - Referer HTTP Header Cross-Site Scripting
CVE-2008-1385—webappsphp22 Apr 2008
Cross-site scripting (XSS) vulnerability in the Top Referrers (aka referrer) plugin in Serendipity (S9Y) before 1.3.1 al
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PortailPHP 2.0 - 'mod_search' Remote File Inclusion
CVE-2007-0820—webappsphp21 Apr 2008
Multiple PHP remote file inclusion vulnerabilities in Cedric CLAIRE PortailPhp 2 allow remote attackers to execute arbit
23RISK
open ↗
Exploit-DB✓ VexDay Proof
XOOPS 2.0.14 Article Module - 'article.php' SQL Injection
CVE-2008-2094—webappsphp21 Apr 2008
SQL injection vulnerability in article.php in the Article module for XOOPS allows remote attackers to execute arbitrary
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Advanced Electron Forum 1.0.6 - 'beg' Cross-Site Scripting
CVE-2008-1983—webappsphp21 Apr 2008
Cross-site scripting (XSS) vulnerability in Advanced Electron Forum (AEF) 1.0.6 allows remote attackers to inject arbitr
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple iCal 3.0.1 - 'COUNT' Integer Overflow
CVE-2008-2006—remoteosx21 Apr 2008
Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to cause a denial of serv
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple iCal 3.0.1 - 'ATTACH' Denial of Service
CVE-2008-1035—dososx21 Apr 2008
Use-after-free vulnerability in Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote atta
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple iCal 3.0.1 - 'TRIGGER' Denial of Service
CVE-2008-2006—dososx21 Apr 2008
Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to cause a denial of serv
23RISK
open ↗
Exploit-DB✓ VexDay Proof
μTorrent (uTorrent) WebUI 0.310 Beta 2 - Cross-Site Request Forgery
CVE-2008-6586—webappsphp18 Apr 2008
Cross-site request forgery (CSRF) vulnerability in gui/index.php in µTorrent (uTorrent) WebUI 0.315 allows remote attack
23RISK
open ↗
Exploit-DB✓ VexDay Proof
TorrentFlux 2.3 - 'admin.php' Cross-Site Request Forgery (Add Admin)
CVE-2008-6585—webappsphp18 Apr 2008
Cross-site request forgery (CSRF) vulnerability in html/admin.php in TorrentFlux 2.3 allows remote attackers to hijack t
23RISK
open ↗
Exploit-DB✓ VexDay Proof
TLM CMS 3.1 - Multiple SQL Injections
CVE-2008-4768—webappsphp18 Apr 2008
SQL injection vulnerability in TLM CMS 3.1 allows remote attackers to execute arbitrary SQL commands via the nom paramet
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Wikepage Opus 13 2007.2 - 'wiki' Cross-Site Scripting
CVE-2008-1956—webappsphp18 Apr 2008
Cross-site scripting (XSS) vulnerability in index.php in Wikepage Opus 13 2007.2 allows remote attackers to inject arbit
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Core 2.3.3 - 'cat' Directory Traversal
CVE-2008-4769—webappsphp18 Apr 2008
Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and
23RISK
open ↗
Exploit-DB✓ VexDay Proof
EsContacts 1.0 - 'login.php?msg' Cross-Site Scripting
CVE-2008-2037—webappsphp17 Apr 2008
Multiple cross-site scripting (XSS) vulnerabilities in EditeurScripts EsContacts 1.0 allow remote authenticated users to
23RISK
open ↗
Exploit-DB✓ VexDay Proof
EsContacts 1.0 - 'groupes.php?msg' Cross-Site Scripting
CVE-2008-2037—webappsphp17 Apr 2008
Multiple cross-site scripting (XSS) vulnerabilities in EditeurScripts EsContacts 1.0 allow remote authenticated users to
23RISK
open ↗
Exploit-DB✓ VexDay Proof
EsContacts 1.0 - 'search.php?msg' Cross-Site Scripting
CVE-2008-2037—webappsphp17 Apr 2008
Multiple cross-site scripting (XSS) vulnerabilities in EditeurScripts EsContacts 1.0 allow remote authenticated users to
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows - 'SeImpersonatePrivilege' Local Privilege Escalation
CVE-2008-1436—localwindows17 Apr 2008
Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) Ne
35RISK
open ↗
Exploit-DB✓ VexDay Proof
MyBoard 1.0.12 - 'rep.php' Cross-Site Scripting
CVE-2008-1955—webappsphp17 Apr 2008
Cross-site scripting (XSS) vulnerability in rep.php in Martin BOUCHER MyBoard 1.0.12 allows remote attackers to inject a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP-Stats 0.1.9.1 - 'admin.php' Multiple Cross-Site Scripting Vulnerabilities
CVE-2008-6212—webappsphp17 Apr 2008
Cross-site scripting (XSS) vulnerability in admin.php in Php-Stats 0.1.9.1 allows remote attackers to inject arbitrary w
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Cobalt 2.0 - 'adminler.asp' SQL Injection
CVE-2008-6203—webappsasp17 Apr 2008
SQL injection vulnerability in adminler.asp in CoBaLT 2.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Exploit-DB✓ VexDay Proof
EsContacts 1.0 - 'importer.php?msg' Cross-Site Scripting
CVE-2008-2037—webappsphp17 Apr 2008
Multiple cross-site scripting (XSS) vulnerabilities in EditeurScripts EsContacts 1.0 allow remote authenticated users to
23RISK
open ↗
Exploit-DB✓ VexDay Proof
EsContacts 1.0 - 'add_groupe.php?msg' Cross-Site Scripting
CVE-2008-2037—webappsphp17 Apr 2008
Multiple cross-site scripting (XSS) vulnerabilities in EditeurScripts EsContacts 1.0 allow remote authenticated users to
23RISK
open ↗
Exploit-DB✓ VexDay Proof
EsContacts 1.0 - 'contacts.php?msg' Cross-Site Scripting
CVE-2008-2037—webappsphp17 Apr 2008
Multiple cross-site scripting (XSS) vulnerabilities in EditeurScripts EsContacts 1.0 allow remote authenticated users to
23RISK
open ↗
← previouspage 309 / 636next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.