Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
24,696 exploits
Exploit-DB✓ VexDay Proof
XT:Commerce 3.04 - 'index.php' Local File Inclusion
CVE-2007-1126—webappsphp23 Feb 2007
Directory traversal vulnerability in index.php in xtcommerce allows remote attackers to read arbitrary files via a .. (d
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Oracle 10g Database - 'SUBSCRIPTION_NAME' SQL Injection (1)
CVE-2005-4832—remotemultiple23 Feb 2007
SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Pyrophobia 2.1.3.1 - Traversal Arbitrary File Access
CVE-2007-1152—webappsphp22 Feb 2007
Multiple directory traversal vulnerabilities in Pyrophobia 2.1.3.1 allow remote attackers to read arbitrary files via a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
LoveCMS 1.4 - 'id' Cross-Site Scripting
CVE-2007-1151—webappsphp22 Feb 2007
Cross-site scripting (XSS) vulnerability in LoveCMS 1.4 allows remote attackers to inject arbitrary web script or HTML v
23RISK
open ↗
Exploit-DB✓ VexDay Proof
LoveCMS 1.4 - 'step' Remote File Inclusion
CVE-2007-1148—webappsphp22 Feb 2007
PHP remote file inclusion vulnerability in install/index.php in LoveCMS 1.4 allows remote attackers to execute arbitrary
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Pyrophobia 2.1.3.1 - Cross-Site Scripting
CVE-2007-1159—webappsphp22 Feb 2007
Cross-site scripting (XSS) vulnerability in modules/out.php in Pyrophobia 2.1.3.1 allows remote attackers to inject arbi
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Oracle 10g - KUPW$WORKER.MAIN Grant/Revoke dba Permission
CVE-2006-3698—remotemultiple22 Feb 2007
Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 have unknown impact and attack vectors, aka Oracle Vuln
23RISK
open ↗
Exploit-DB✓ VexDay Proof
LoveCMS 1.4 - 'load' Traversal Arbitrary File Access
CVE-2007-1149—webappsphp22 Feb 2007
Multiple directory traversal vulnerabilities in LoveCMS 1.4 allow remote attackers to read arbitrary files via a .. (dot
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Plantilla - 'list_main_pages.php?nfolder' Traversal Arbitrary File Access
CVE-2007-1138—webappsphp22 Feb 2007
Absolute path traversal vulnerability in list_main_pages.php in Cromosoft Simple Plantilla PHP (SPP) allows remote attac
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows XP/2003 - ReadDirectoryChangesW Information Disclosure
CVE-2007-0843—localwindows22 Feb 2007
The ReadDirectoryChangesW API function on Microsoft Windows 2000, XP, Server 2003, and Vista does not check permissions
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Pheap 1.x/2.0 - 'edit.php' Directory Traversal
CVE-2007-1140—webappsphp22 Feb 2007
Directory traversal vulnerability in edit.php in pheap allows remote attackers to read and modify arbitrary files via a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
LoveCMS 1.4 - 'step' Traversal Arbitrary File Access
CVE-2007-1149—webappsphp22 Feb 2007
Multiple directory traversal vulnerabilities in LoveCMS 1.4 allow remote attackers to read arbitrary files via a .. (dot
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Oracle 10g - KUPV$FT.ATTACH_JOB Grant/Revoke dba Permission
CVE-2006-0586—remotemultiple22 Feb 2007
Multiple SQL injection vulnerabilities in Oracle 10g Release 1 before CPU Jan 2006 allow remote attackers to execute arb
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Google Desktop - Cross-Site Scripting
CVE-2007-1085—webappscgi21 Feb 2007
Cross-site scripting (XSS) vulnerability in Google Desktop allows remote attackers to bypass protection schemes and inje
28RISK
open ↗
Exploit-DB✓ VexDay Proof
CedStat 1.31 - 'index.php' Cross-Site Scripting
CVE-2007-1020—webappsphp21 Feb 2007
Cross-site scripting (XSS) vulnerability in index.php in CedStat 1.31 allows remote attackers to inject arbitrary web sc
23RISK
open ↗
Exploit-DB✓ VexDay Proof
phpTrafficA 1.4.1 - 'plotStat.php?File' Traversal Local File Inclusion
CVE-2007-1076—webappsphp21 Feb 2007
Multiple directory traversal vulnerabilities in phpTrafficA 1.4.1, and possibly earlier, allow remote attackers to inclu
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Magic News Plus 1.0.2 - 'preview.php?PHP_script_path' Remote File Inclusion
CVE-2007-1141—webappsphp21 Feb 2007
PHP remote file inclusion vulnerability in preview.php in Magic News Plus 1.0.2 allows remote attackers to execute arbit
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Magic News Plus 1.0.2 - 'news.php?&link_parameters' Cross-Site Scripting
CVE-2007-1142—webappsphp21 Feb 2007
Cross-site scripting (XSS) vulnerability in Magic News Plus 1.0.2 allows remote attackers to inject arbitrary web script
23RISK
open ↗
Exploit-DB✓ VexDay Proof
phpTrafficA 1.4.1 - 'banref.php?lang' Traversal Local File Inclusion
CVE-2007-1076—webappsphp21 Feb 2007
Multiple directory traversal vulnerabilities in phpTrafficA 1.4.1, and possibly earlier, allow remote attackers to inclu
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Magic News Plus 1.0.2 - 'n_layouts.php?link_parameters' Cross-Site Scripting
CVE-2007-1142—webappsphp21 Feb 2007
Cross-site scripting (XSS) vulnerability in Magic News Plus 1.0.2 allows remote attackers to inject arbitrary web script
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple Mac OSX 10.4.8 - ImageIO GIF Image Integer Overflow
CVE-2007-1071—dososx20 Feb 2007
Integer overflow in the gifGetBandProc function in ImageIO in Apple Mac OS X 10.4.8 allows remote attackers to cause a d
28RISK
open ↗
Exploit-DB✓ VexDay Proof
NukeSentinel 2.5.05 - 'nsbypass.php' Blind SQL Injection
CVE-2007-5125—webappsphp20 Feb 2007
20RISK
open ↗
Exploit-DB✓ VexDay Proof
NukeSentinel 2.5.05 - 'nukesentinel.php' File Disclosure
CVE-2007-1493—webappsphp20 Feb 2007
nukesentinel.php in NukeSentinel 2.5.06 and earlier uses a permissive regular expression to validate an IP address, whic
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP-Nuke 8.0 Final - 'INSERT' SQL Injection
CVE-2007-1061—webappsphp20 Feb 2007
SQL injection vulnerability in index.php in Francisco Burzi PHP-Nuke 8.0 Final and earlier, when the "HTTP Referers" blo
35RISK
open ↗
Exploit-DB✓ VexDay Proof
AbleDesign MyCalendar 2.20.3 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
CVE-2007-1050—webappsphp20 Feb 2007
Multiple cross-site scripting (XSS) vulnerabilities in index.php in AbleDesign MyCalendar allow remote attackers to inje
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Mozilla Firefox 2.0.0.1 - 'location.hostname' Cross-Domain
CVE-2007-0981—remotewindows20 Feb 2007
Mozilla based browsers, including Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8, allow remo
28RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP-Nuke 8.0 Final - 'INSERT' Blind SQL Injection (MySQL)
CVE-2007-1061—webappsphp20 Feb 2007
SQL injection vulnerability in index.php in Francisco Burzi PHP-Nuke 8.0 Final and earlier, when the "HTTP Referers" blo
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Design4Online - 'Userpages2 Page.asp' SQL Injection
CVE-2007-1077—webappsasp20 Feb 2007
SQL injection vulnerability in page.asp in Design4Online UserPages2 2.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6 - Local File Access
CVE-2007-3406—remotewindows20 Feb 2007
Multiple absolute path traversal vulnerabilities in Microsoft Internet Explorer 6 on Windows XP SP2 allow remote attacke
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Spyce 2.1.3 - spyce/examples/automaton.spy Direct Request Error Message Information Disclosure
CVE-2008-0982—webappsphp19 Feb 2007
Spyce - Python Server Pages (PSP) 2.1.3 allows remote attackers to obtain sensitive information via a direct request for
23RISK
open ↗
← previouspage 367 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.