Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,894cataloged exploits
35,202CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 22,103GitHub PoC 14,055VulnCheck XDB 8,571Nuclei 4,250Metasploit 3,472✓ verified onlyrecentpopularrisk
21,899 exploits
Referência✓ VexDay Proof
GO4I.NET ASP Forum 1.0 - SQL Injection
CVE-2008-6527—webappsphp
SQL injection vulnerability in forum.asp in GO4I.NET ASP Forum 1.0 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
TmaxSoft JEUS - Alternate Data Streams File Disclosure
CVE-2008-6528—remotewindows
NTFS TmaxSoft JEUS 5 before Fix 26 allows remote attackers to read the source code for scripts by appending ::$DATA to t
23RISK
open ↗
Referência✓ VexDay Proof
PayPal eStore - Admin Password Change
CVE-2008-6535—webappsphp
admin/settings.php in PayPal eStores allows remote attackers to bypass intended access restrictions and change the admin
23RISK
open ↗
Referência✓ VexDay Proof
Shader TV (Beta) - Multiple SQL Injections
CVE-2008-6641—webappsasp
Multiple SQL injection vulnerabilities in Shader TV (Beta) allow remote authenticated administrators to execute arbitrar
23RISK
open ↗
Referência
CVE-2014-6242
CVE-2014-6242—
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow
23RISK
open ↗
Referência✓ VexDay Proof
FluentCMS - 'view.php' SQL Injection
CVE-2008-6642—webappsphp
SQL injection vulnerability in view.php in DotContent FluentCMS 4.x allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência✓ VexDay Proof
OneCMS 2.5 - Blind SQL Injection
CVE-2008-6652—webappsphp
SQL injection vulnerability in asd.php in OneCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the s
23RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência
CVE-2009-4560
CVE-2009-4560—
SQL injection vulnerability in profile.php in WebLeague 2.2.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Simple Machines Forum (SMF) 1.1.6 - Code Execution
CVE-2008-6657—webappsphp
Cross-site request forgery (CSRF) vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 be
23RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência✓ VexDay Proof
Apartment Search Script - Arbitrary File Upload / Cross-Site Scripting
CVE-2008-6683—webappsphp
Cross-site scripting (XSS) vulnerability in listtest.php in Apartment Search Script allows remote attackers to inject ar
23RISK
open ↗
Referência✓ VexDay Proof
Pre ADS Portal 2.0 - Authentication Bypass / Cross-Site Scripting
CVE-2008-6715—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Pre ADS Portal 2.0 and earlier allow remote attackers to inject a
23RISK
open ↗
Referência✓ VexDay Proof
Pre ADS Portal 2.0 - Authentication Bypass / Cross-Site Scripting
CVE-2008-6716—webappsphp
homeadmin/adminhome.php in Pre ADS Portal 2.0 and earlier does not require administrative authentication, which allows r
23RISK
open ↗
Referência
CVE-2009-4561
CVE-2009-4561—
Multiple SQL injection vulnerabilities in Admin/index.php in WebLeague 2.2.0, when magic_quotes_gpc is disabled, allow r
23RISK
open ↗
Referência✓ VexDay Proof
U&M Software Signup 1.1 - Authentication Bypass
CVE-2008-6717—webappsphp
U&M Software Signup 1.0 and 1.1 does not require administrative authentication for all scripts in the admin/ directory,
23RISK
open ↗
Referência✓ VexDay Proof
U&M Software Event Lister 1.0 - Authentication Bypass
CVE-2008-6719—webappsphp
U&M Software Event Lister (aka JustListIt) 1.0 does not require administrative authentication for all scripts in the adm
23RISK
open ↗
Referência✓ VexDay Proof
DELTAScripts PHP Links 1.3 - Authentication Bypass
CVE-2008-6720—webappsphp
SQL injection vulnerability in admin/adm_login.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
AJ Article 1.0 - Authentication Bypass
CVE-2008-6721—webappsphp
SQL injection vulnerability in index.php in AJ Square AJ Article allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
CMScout 2.06 - SQL Injection / Local File Inclusion
CVE-2008-6725—webappsphp
Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
CMScout 2.06 - SQL Injection / Local File Inclusion
CVE-2008-6726—webappsphp
Multiple directory traversal vulnerabilities in CMScout 2.06, when register_globals is enabled, allow remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
PHPmotion 2.1 - Cross-Site Request Forgery
CVE-2008-6729—webappsphp
Multiple cross-site request forgery (CSRF) vulnerabilities in password.php in PHPmotion 2.1 and earlier allow remote att
23RISK
open ↗
Referência✓ VexDay Proof
Flexphplink Pro - Arbitrary File Upload
CVE-2008-6731—webappsphp
Unrestricted file upload vulnerability in submitlink.php in FlexPHPLink Pro 0.0.7 allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Keller Web Admin CMS 0.94 Pro - Local File Inclusion (2)
CVE-2008-6734—webappsphp
Directory traversal vulnerability in Public/index.php in Keller Web Admin CMS 0.94 Pro allows remote attackers to includ
23RISK
open ↗
Referência✓ VexDay Proof
Simple Machines Forum (SMF) 1.1.4 - SQL Injection
CVE-2008-6741—webappsphp
SQL injection vulnerability in Load.php in Simple Machines Forum (SMF) 1.1.4 and earlier allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
RSMScript 1.21 - Cross-Site Scripting / Insecure Cookie Handling
CVE-2008-6743—webappsphp
RSMScript 1.21 allows remote attackers to bypass authentication and gain administrative privileges by setting the verifi
23RISK
open ↗
Referência✓ VexDay Proof
BlogPHP 2.0 - Privilege Escalation / SQL Injection
CVE-2008-6745—webappsphp
index.php in BlogPHP 2.0 allows remote attackers to gain administrator privileges via a crafted email parameter in a reg
23RISK
open ↗
Referência✓ VexDay Proof
ScriptsFeed (SF) Recipes Listing Portal - Arbitrary File Upload
CVE-2008-6943—webappsphp
Unrestricted file upload vulnerability in ScriptsFeed Recipes Listing Portal allows remote authenticated users to execut
23RISK
open ↗
Referência✓ VexDay Proof
ScriptsFeed (SF) Auto Classifieds Software - Arbitrary File Upload
CVE-2008-6944—webappsphp
Unrestricted file upload vulnerability in ScriptsFeed Auto Classifieds allows remote authenticated users to execute arbi
23RISK
open ↗
← previouspage 340 / 730next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.