Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,600cataloged exploits
39,734CVEs with public exploitation
24,695lab-tested
AllReferência 25,742Exploit-DB 24,486GitHub PoC 16,618VulnCheck XDB 9,736Nuclei 4,493Metasploit 3,525✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Open Cubic Player 2.6.0pre6/0.1.10_rc5 - Multiple Local Buffer Overflows
CVE-2006-4046—localwindows
Multiple stack-based buffer overflows in Open Cubic Player 2.6.0pre6 and earlier for Windows, and 0.1.10_rc5 and earlier
28RISK
open ↗
Referência✓ VexDay Proof
SlimCMS 1.0.0 - 'edit.php' SQL Injection
CVE-2008-5491—webappsphp
SQL injection vulnerability in edit.php in SlimCMS 1.0.0 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Easy RM to MP3 Converter - Universal Stack Overflow
CVE-2009-1330—localwindows
Stack-based buffer overflow in Easy RM to MP3 Converter allows remote attackers to execute arbitrary code via a long fil
28RISK
open ↗
Referência✓ VexDay Proof
SAPID Blog Beta 2 - 'ROOT_PATH' Remote File Inclusion
CVE-2006-4063—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Csaba Godor SAPID Blog Beta 2 and earlier allow remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
YenerTurk Haber Script 1.0 - SQL Injection
CVE-2006-4064—webappsasp
SQL injection vulnerability in default.asp in YenerTurk Haber Script 1.0 and earlier allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Explorer - '.WMF' CreateBrushIndirect Denial of Service
CVE-2006-4071—doswindows
Sign extension vulnerability in the createBrushIndirect function in the GDI library (gdi32.dll) in Microsoft Windows XP,
28RISK
open ↗
Referência✓ VexDay Proof
PozScripts Business Directory Script - 'cid' SQL Injection
CVE-2008-5496—webappsphp
SQL injection vulnerability in showcategory.php in PozScripts Business Directory Script allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
Tribiq CMS 5.0.9a (Beta) - Insecure Cookie Handling
CVE-2008-6804—webappsphp
Tribiq CMS 5.0.9a beta allows remote attackers to bypass authentication and gain administrative access by setting the CO
23RISK
open ↗
Referência✓ VexDay Proof
phpPrintAnalyzer 1.2 - Remote File Inclusion
CVE-2006-4164—webappsphp
PHP remote file inclusion vulnerability in inc/header.inc.php in phpPrintAnalyzer 1.2 and earlier allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
MW6 PDF417 - ActiveX 'MW6PDF417.dll' Remote Insecure Method
CVE-2008-4926—remotewindows
Multiple insecure method vulnerabilities in MW6 Technologies PDF417 ActiveX control (MW6PDF417Lib.PDF417, MW6PDF417.dll)
23RISK
open ↗
Referência✓ VexDay Proof
Product Sale Framework 0.1b - SQL Injection
CVE-2008-5590—webappsphp
SQL injection vulnerability in customer.forumtopic.php in Kalptaru Infotech Product Sale Framework 0.1 beta allows remot
23RISK
open ↗
Referência✓ VexDay Proof
nightfall personal diary 1.0 - Cross-Site Scripting / File Disclosure
CVE-2008-5591—webappsphp
Cross-site scripting (XSS) vulnerability in login.asp in Nightfall Personal Diary 1.0 allows remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Link Directory - 'cat_id' SQL Injection
CVE-2008-6808—webappsphp
SQL injection vulnerability in links.php in Scripts for Sites (SFS) EZ Link Directory allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Merlix Teamworx Server - File Disclosure/Bypass
CVE-2008-5600—webappsphp
Merlix Teamworx Server stores sensitive information under the web root with insufficient access control, which allows re
23RISK
open ↗
Referência✓ VexDay Proof
Spidey Blog Script 1.5 - 'proje_goster.asp' SQL Injection (1)
CVE-2006-4202—webappsasp
SQL injection vulnerability in proje_goster.php in Spidey Blog Script 1.5 and earlier allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
My Simple Forum 3.0 - Local File Inclusion
CVE-2008-5604—webappsphp
Directory traversal vulnerability in index.php in My Simple Forum 3.0 and 4.1, when magic_quotes_gpc is disabled, allows
23RISK
open ↗
Referência✓ VexDay Proof
LightOpenCMS 0.1 - 'id' SQL Injection
CVE-2009-1766—webappsphp
SQL injection vulnerability in index.php in LightOpenCMS 0.1 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component AlphaUserPoints - SQL Injection
CVE-2009-3342—webappsphp
SQL injection vulnerability in frontend/assets/ajax/checkusername.php in the AlphaUserPoints (com_alphauserpoints) compo
23RISK
open ↗
Referência✓ VexDay Proof
FTP Now 2.6 Server - Response Remote Crash (PoC)
CVE-2008-5045—doswindows
Heap-based buffer overflow in Network-Client FTP Now 2.6, and possibly other versions, allows remote FTP servers to caus
23RISK
open ↗
Referência✓ VexDay Proof
Turnkey Arcade Script - SQL Injection (1)
CVE-2008-5629—webappsphp
SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
FeedMon 2.7.0.0 - outline Tag Buffer Overflow (PoC)
CVE-2009-0546—doswindows
Stack-based buffer overflow in NewsGator FeedDemon 2.7 and earlier allows user-assisted remote attackers to execute arbi
50RISK
open ↗
Referência✓ VexDay Proof
fungamez rc1 - Authentication Bypass / Local File Inclusion
CVE-2009-1487—webappsphp
SQL injection vulnerability in pages/login.php in FunGamez RC1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Haberx 1.02 < 1.1 - 'tr' SQL Injection
CVE-2006-4853—webappsasp
SQL injection vulnerability in kategorix.asp in Haberx 1.02 through 1.1 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Real Player - 'rmoc3260.dll' ActiveX Control Remote Code Execution
CVE-2008-1309—remotewindows
The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, Rea
50RISK
open ↗
Referência✓ VexDay Proof
Alstrasoft Web Host Directory - Authentication Bypass
CVE-2008-5650—webappsphp
SQL injection vulnerability in the login directory in AlstraSoft Web Host Directory allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
Vinagre < 2.24.2 - 'show_error()' Remote Format String (PoC)
CVE-2008-5660—doswindows
Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2
23RISK
open ↗
Referência✓ VexDay Proof
fungamez rc1 - Authentication Bypass / Local File Inclusion
CVE-2009-1488—webappsphp
Directory traversal vulnerability in admin/load.php in FunGamez RC1 allows remote attackers to include and execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
GNUTURK 2G - 't_id' SQL Injection
CVE-2006-4867—webappsphp
SQL injection vulnerability in mods.php in GNUTurk 2G and earlier allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
WebDesktop 0.1 - Remote File Inclusion
CVE-2007-5388—webappsphp
Multiple PHP remote file inclusion vulnerabilities in WebDesktop 0.1 allow remote attackers to execute arbitrary PHP cod
35RISK
open ↗
Referência✓ VexDay Proof
Pluck CMS 4.6.1 - 'module_pages_site.php' Local File Inclusion
CVE-2008-6842—webappsphp
Directory traversal vulnerability in data/modules/blog/module_pages_site.php in Pluck 4.6.1 allows remote attackers to i
23RISK
open ↗
← previouspage 32 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.