Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,958cataloged exploits
36,206CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,460Referência 22,832GitHub PoC 14,991VulnCheck XDB 8,829Nuclei 4,357Metasploit 3,489✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Joomla! Component Recly!Competitions 1.0.0 - Multiple Remote File Inclusions
CVE-2008-5790—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the Recly!Competitions (com_competitions) component 1.0 for Joomla
35RISK
open ↗
Referência✓ VexDay Proof
Surgemail 39e-1 - (Authenticated) IMAP Remote Buffer Overflow (Denial of Service) (PoC)
CVE-2008-7182—doswindows
Buffer overflow in the IMAP service in NetWin Surgemail 3.9e, and possibly other versions before 3.9g2, allows remote au
28RISK
open ↗
Referência✓ VexDay Proof
BulletProof FTP Client - '.bps' Local Stack Overflow (PoC)
CVE-2008-5754—doswindows
Stack-based buffer overflow in BulletProof FTP Client allows user-assisted attackers to execute arbitrary code via a .bp
23RISK
open ↗
Referência✓ VexDay Proof
Alstrasoft Web Email Script Enterprise - 'id' SQL Injection
CVE-2008-5751—webappsphp
SQL injection vulnerability in index.php in AlstraSoft Web Email Script Enterprise (ESE) allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
ftp Admin 0.1.0 - Local File Inclusion / Cross-Site Scripting / Authentication Bypass
CVE-2007-6232—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in FTP Admin 0.1.0 allows remote attackers to inject arbitrary web
23RISK
open ↗
Referência✓ VexDay Proof
IntelliTamper 2.07/2.08 - '.map' Local Overwrite (SEH)
CVE-2008-5755—localwindows
Stack-based buffer overflow in IntelliTamper 2.07 and 2.08 allows remote attackers to execute arbitrary code via a MAP f
23RISK
open ↗
Referência✓ VexDay Proof
BulletProof FTP Client 2009 - '.bps' Local Buffer Overflow (SEH)
CVE-2008-5754—localwindows
Stack-based buffer overflow in BulletProof FTP Client allows user-assisted attackers to execute arbitrary code via a .bp
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Media Player - '.AIFF' Divide By Zero Exception Denial of Service (PoC)
CVE-2007-6236—doswindows
Microsoft Windows Media Player (WMP) allows remote attackers to cause a denial of service (application crash) via a cert
28RISK
open ↗
Referência✓ VexDay Proof
S-CMS 1.1 Stable - Insecure Cookie Handling / Mass Page Delete
CVE-2009-0863—webappsphp
SQL injection vulnerability in admin/delete_page.php in S-Cms 1.1 Stable allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
Flatnux - html/JavaScript Injection Cookie Grabber
CVE-2008-5761—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in FlatnuX CMS (aka Flatnuke3) 2008-12-11 allow remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Simple Text-File Login script (SiTeFiLo) 1.0.6 - File Disclosure / Remote File Inclusion
CVE-2008-5762—webappsphp
Simple Text-File Login Script (SiTeFiLo) 1.0.6 stores sensitive information under the web root with insufficient access
23RISK
open ↗
Referência✓ VexDay Proof
Simple Text-File Login script (SiTeFiLo) 1.0.6 - File Disclosure / Remote File Inclusion
CVE-2008-5763—webappsphp
PHP remote file inclusion vulnerability in slogin_lib.inc.php in Simple Text-File Login Script (SiTeFiLo) 1.0.6 allows r
35RISK
open ↗
Referência✓ VexDay Proof
WorkSimple 1.2.1 - Remote File Inclusion / Sensitive Data Disclosure
CVE-2008-5764—webappsphp
PHP remote file inclusion vulnerability in calendar.php in WorkSimple 1.2.1, when register_globals is enabled, allows re
35RISK
open ↗
Referência✓ VexDay Proof
Gnews Publisher .NET - SQL Injection
CVE-2008-5767—webappsasp
SQL injection vulnerability in authors.asp in gNews Publisher allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module Amevents - SQL Injection
CVE-2008-5768—webappsphp
SQL injection vulnerability in print.php in the AM Events (aka Amevents) module 0.22 for XOOPS allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
PHP weather 2.2.2 - Local File Inclusion / Cross-Site Scripting
CVE-2008-5770—webappsphp
Cross-site scripting (XSS) vulnerability in config/make_config.php in PHP Weather 2.2.2 allows remote attackers to injec
23RISK
open ↗
Referência✓ VexDay Proof
ASPSiteWare RealtyListing 1.0/2.0 - SQL Injection
CVE-2008-5772—webappsasp
Multiple SQL injection vulnerabilities in ASPSiteWare RealtyListings 1.0 and 2.0 allow remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
FLDS 1.2a - 'report.php' SQL Injection
CVE-2008-5778—webappsphp
SQL injection vulnerability in report.php in Free Links Directory Script (FLDS) 1.2a allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
V3 Chat Profiles/Dating Script 3.0.2 - Insecure Cookie Handling
CVE-2008-5784—webappsphp
V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to bypass authentication and gain administrative access b
23RISK
open ↗
Referência✓ VexDay Proof
MOG-WebShop - 'index.php?group' SQL Injection
CVE-2007-6466—webappsphp
Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Feederator 1.0.5 - Multiple Remote File Inclusions
CVE-2008-5789—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the Recly Interactive Feederator (com_feederator) component 1.0.5
35RISK
open ↗
Referência✓ VexDay Proof
E-topbiz Online Store 1 - 'cat_id' SQL Injection
CVE-2008-5802—webappsphp
SQL injection vulnerability in index.php in E-topbiz Online Store 1.0 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
gf-3xplorer 2.4 - Cross-Site Scripting / Local File Inclusion
CVE-2007-6476—webappsphp
GF-3XPLORER 2.4 allows remote attackers to obtain configuration information via a direct request to explorer/phpinfo.php
23RISK
open ↗
Referência✓ VexDay Proof
E-topbiz Online Store 1 - Authentication Bypass
CVE-2008-5803—webappsphp
SQL injection vulnerability in admin/login.php in E-topbiz Online Store 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
DELTAScripts PHP Classifieds 7.5 - SQL Injection
CVE-2008-5805—webappsphp
SQL injection vulnerability in detail.php in DeltaScripts PHP Classifieds 7.5 and earlier allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component PAX Gallery 0.1 - Blind SQL Injection
CVE-2008-5811—webappsphp
SQL injection vulnerability in the PaxGallery (com_paxgallery) component 0.1 for Joomla! allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
PHPAlumni - SQL Injection
CVE-2008-5815—webappsphp
SQL injection vulnerability in Acomment.php in phpAlumni allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6495—webappsasp
inc_newuser.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to change the permis
23RISK
open ↗
Referência✓ VexDay Proof
webClassifieds 2005 - Authentication Bypass
CVE-2008-5817—webappsphp
Multiple SQL injection vulnerabilities in index.php in Web Scribble Solutions webClassifieds 2005 allow remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
eDContainer 2.22 - Local File Inclusion
CVE-2008-5818—webappsphp
Directory traversal vulnerability in index.php in eDreamers eDContainer 2.22, when magic_quotes_gpc is disabled, allows
23RISK
open ↗
← previouspage 36 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.