Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,600cataloged exploits

39,734CVEs with public exploitation

24,695lab-tested

All Referência 25,742Exploit-DB 24,486GitHub PoC 16,618VulnCheck XDB 9,736Nuclei 4,493Metasploit 3,525✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

Magic News Pro 1.0.3 - 'script_path' Remote File Inclusion

CVE-2006-4823—webappsphp

PHP remote file inclusion vulnerability in scripts/news_page.php in Reamday Enterprises Magic News Pro 1.0.3 and earlier

23RISK

open ↗

Referência✓ VexDay Proof

SaturnCMS - Blind SQL Injection

CVE-2008-6263—webappsphp

SQL injection vulnerability in lib/user/t_user.php in SaturnCMS allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

MDweb 1.3 - 'chemin_appli' Remote File Inclusion

CVE-2006-5587—webappsphp

Multiple PHP remote file inclusion vulnerabilities in MDweb 1.3 and earlier (Mdweb132-postgres) allow remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

WEBBDOMAIN WebShop 1.02 - SQL Injection / Cross-Site Scripting

CVE-2008-6268—webappsphp

SQL injection vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote attackers to e

23RISK

open ↗

Referência✓ VexDay Proof

Techno Dreams Guestbook 1.0 - 'key' SQL Injection

CVE-2006-5640—webappsasp

SQL injection vulnerability in guestbookview.asp in Techno Dreams Guest Book 1.0 earlier allows remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

RevSense 1.0 - Authentication Bypass

CVE-2008-6310—webappsphp

SQL injection vulnerability in index.php in W3matter RevSense 1.0 allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

CFMBLOG - 'categorynbr' Blind SQL Injection

CVE-2008-6322—webappsasp

SQL injection vulnerability in index.cfm in CFMSource CFMBlog allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

Techno Dreams Announcement - 'key' SQL Injection

CVE-2006-5641—webappsasp

SQL injection vulnerability in MainAnnounce2.asp in Techno Dreams Announcement allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component SOBI2 RC 2.8.2 - SQL Injection

CVE-2009-0380—webappsphp

SQL injection vulnerability in the Sigsiu Online Business Index 2 (SOBI2, com_sobi2) RC 2.8.2 component for Joomla! and

23RISK

open ↗

Referência✓ VexDay Proof

Social Groupie - 'id' SQL Injection

CVE-2008-6358—webappsphp

SQL injection vulnerability in group_index.php in Social Groupie allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

Gallery MX 2.0.0 - Blind SQL Injection

CVE-2008-6379—webappsasp

SQL injection vulnerability in pics_pre.asp in Gallery MX 2.0.0 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

Zip Store Chat 4.0/5.0 - Authentication Bypass

CVE-2009-2142—webappsphp

Multiple SQL injection vulnerabilities in admin/index.asp in Zip Store Chat 4.0 and 5.0 allow remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

OpenRat 0.8-beta4 - 'tpl_dir' Remote File Inclusion

CVE-2008-6403—webappsphp

PHP remote file inclusion vulnerability in themes/default/include/html/insert.inc.php in OpenRat 0.8-beta4 and earlier a

23RISK

open ↗

Referência✓ VexDay Proof

PHP Classifieds 7.1 - 'detail.php' SQL Injection

CVE-2006-5828—webappsphp

SQL injection vulnerability in detail.php in DeltaScripts PHP Classifieds 7.1 and earlier allows remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_colorlab 1.0 - Remote File Inclusion

CVE-2007-5451—webappsphp

PHP remote file inclusion vulnerability in admin.color.php in the com_colorlab (aka com_color) 1.0 component for Joomla!

35RISK

open ↗

Referência✓ VexDay Proof

Cold BBS - Remote Database Disclosure

CVE-2008-5597—webappsasp

Cold BBS stores sensitive information under the web root with insufficient access control, which allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component prayercenter 1.4.9 - 'id' SQL Injection

CVE-2008-6429—webappsphp

SQL injection vulnerability in the PrayerCenter (com_prayercenter) component 1.4.9 and earlier for Joomla! allows remote

23RISK

open ↗

Referência✓ VexDay Proof

virtue news - SQL Injection / Cross-Site Scripting

CVE-2009-2020—webappsphp

Cross-site scripting (XSS) vulnerability in news_detail.php in Virtue News Manager allows remote attackers to inject arb

23RISK

open ↗

Referência✓ VexDay Proof

GuppY 4.5.16 - Remote Command Execution

CVE-2007-5845—webappsphp

Directory traversal vulnerability in error.php in GuppY 4.6.3, 4.5.16, and earlier allows remote attackers to include an

23RISK

open ↗

Referência✓ VexDay Proof

ASP AutoDealer - SQL Injection / File Disclosure

CVE-2008-5608—webappsasp

ASP AutoDealer stores sensitive information under the web root with insufficient access control, which allows remote att

23RISK

open ↗

Referência✓ VexDay Proof

EncapsCMS 0.3.6 - '/core/core.php' Remote File Inclusion

CVE-2006-5895—webappsphp

PHP remote file inclusion vulnerability in core/core.php in EncapsCMS 0.3.6 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component MyAlbum 1.0 - 'album' SQL Injection

CVE-2008-6489—webappsphp

SQL injection vulnerability in MyAlbum component (com_myalbum) 1.0 for Joomla! allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Office - MSODataSourceControl COM-object Buffer Overflow (PoC)

CVE-2007-3282—doswindows

Buffer overflow in the Microsoft Office MSODataSourceControl ActiveX object allows remote attackers to cause a denial of

35RISK

open ↗

Referência✓ VexDay Proof

XAMPP 1.6.8 - Cross-Site Request Forgery (Change Administrative Password)

CVE-2008-6499—remotewindows

security/xamppsecurity.php in XAMPP 1.6.8 performs an extract operation on the SERVER superglobal array, which allows re

23RISK

open ↗

Referência✓ VexDay Proof

CMS little 0.0.1 - 'term' SQL Injection

CVE-2008-5628—webappsphp

SQL injection vulnerability in index.php in CMS little 0.0.1 allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência✓ VexDay Proof

living Local 1.1 - Cross-Site Scripting / Arbitrary File Upload

CVE-2008-6529—webappsphp

Cross-site scripting (XSS) vulnerability in listtest.php in eZoneScripts Living Local 1.1 allows remote attackers to inj

23RISK

open ↗

Referência✓ VexDay Proof

Active Membership 2 - Authentication Bypass

CVE-2008-5635—webappsasp

SQL injection vulnerability in account.asp in Active Membership 2.0 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

Campsite 3.3.0 RC1 - Multiple Remote File Inclusions

CVE-2009-2181—webappsphp

Cross-site scripting (XSS) vulnerability in admin-files/templates/list_dir.php in Campsite 3.3.0 RC1 allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Dada Mail Manager 2.6 - Remote File Inclusion

CVE-2008-6221—webappsphp

PHP remote file inclusion vulnerability in config.dadamail.php in the Dada Mail Manager (com_dadamail) component 2.6 for

35RISK

open ↗

Referência✓ VexDay Proof

MyioSoft Ajax Portal 3.0 - Authentication Bypass

CVE-2008-5653—webappsphp

SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft AjaxPortal 3.0 allows remote attackers to

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.