Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,151cataloged exploits

35,370CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecent popular risk

22,232 exploits

Referência✓ VexDay Proof

Socketwiz BookMarks 2.0 - 'root_dir' Remote File Inclusion

CVE-2006-7069—webappsphp

PHP remote file inclusion vulnerability in smarty_config.php in Socketwiz Bookmarks 2.0 and earlier allows remote attack

23RISK

open ↗

Referência

CVE-2014-2089

CVE-2014-2089—

ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .

23RISK

open ↗

Referência✓ VexDay Proof

gCards 1.45 - Multiple Vulnerabilities

CVE-2006-1347—webappsphp

SQL injection vulnerability in loginfunction.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

NetProxy 4.03 - Web Filter Evasion / Bypass Logging

CVE-2007-1224—remotewindows

Grok Developments NetProxy 4.03 allows remote attackers to bypass URL filtering via a request that omits "http://" from

23RISK

open ↗

Referência✓ VexDay Proof

PHPEasyNews 1.13 RC2 - 'POST' SQL Injection

CVE-2008-2823—webappsphp

SQL injection vulnerability in newsarchive.php in PHPeasyblog (formerly phpeasynews) 1.13 RC2 and earlier allows remote

23RISK

open ↗

Referência✓ VexDay Proof

APC ActionApps CMS 2.8.1 - Remote File Inclusion

CVE-2006-2686—webappsphp

PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a

28RISK

open ↗

Referência

CVE-2014-1206

CVE-2014-1206—

SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before 1.5.5 allows remote attackers

23RISK

open ↗

Referência

CVE-2010-1604

CVE-2010-1604—

Multiple SQL injection vulnerabilities in admin_login.php in NCT Jobs Portal Script allow remote attackers to execute ar

23RISK

open ↗

Referência

CVE-2009-3423

CVE-2009-3423—

23RISK

open ↗

Referência

CVE-2019-12745

CVE-2019-12745—

out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting (XSS) via the name field.

23RISK

open ↗

Referência

CVE-2013-3524

CVE-2013-3524—

SQL injection vulnerability in popupnewsitem/ in the Pop Up News module 2.0 and possibly earlier for phpVMS allows remot

23RISK

open ↗

Referência✓ VexDay Proof

WebBuilder 2.0 - 'StageLoader.php' Remote File Inclusion

CVE-2007-0703—webappsphp

PHP remote file inclusion vulnerability in library/StageLoader.php in WebBuilder 2.0 and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Somery 0.4.6 - 'skin_dir' Remote File Inclusion

CVE-2007-0704—webappsphp

PHP remote file inclusion vulnerability in install.php in Somery 0.4.6 allows remote attackers to execute arbitrary PHP

23RISK

open ↗

Referência

CVE-2018-10366

CVE-2018-10366—

An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the nam

23RISK

open ↗

Referência

CVE-2008-5943

CVE-2008-5943—

Multiple directory traversal vulnerabilities in NavBoard 16 (2.6.0) allow remote attackers to include and execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Webavis 0.1.1 - 'class.php?root' Remote File Inclusion

CVE-2007-2943—webappsphp

PHP remote file inclusion vulnerability in class/class.php in Webavis 0.1.1 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

SQLiteWebAdmin 0.1 - 'tpl.inc.php' Remote File Inclusion

CVE-2006-4102—webappsphp

PHP remote file inclusion vulnerability in tpl.inc.php in Falko Timme and Till Brehm SQLiteWebAdmin 0.1 and earlier allo

23RISK

open ↗

Referência

CVE-2016-4230

CVE-2016-4230—

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows

35RISK

open ↗

Referência

CVE-2016-4264

CVE-2016-4264—

The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attack

35RISK

open ↗

Referência✓ VexDay Proof

LimeSurvey 1.52 - 'language.php' Remote File Inclusion

CVE-2007-5573—webappsphp

PHP remote file inclusion vulnerability in classes/core/language.php in LimeSurvey 1.5.2 and earlier allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

shibby shop 2.2 - Multiple Vulnerabilities

CVE-2008-2872—webappsphp

SQL injection vulnerability in default.asp in sHibby sHop 2.2 and earlier allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

PhpCommander 3.0 - 'upload' Remote Code Execution

CVE-2006-4636—webappsphp

Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute a

23RISK

open ↗

Referência✓ VexDay Proof

shibby shop 2.2 - Multiple Vulnerabilities

CVE-2008-2873—webappsphp

sHibby sHop 2.2 and earlier stores sensitive information under the web root with insufficient access control, which allo

23RISK

open ↗

Referência✓ VexDay Proof

Polaring 0.04.03 - 'general.php' Remote File Inclusion

CVE-2006-5078—webappsphp

PHP remote file inclusion vulnerability in view/general.php in Kristian Niemi Polaring 00.04.03 and earlier allows remot

23RISK

open ↗

Referência✓ VexDay Proof

paBugs 2.0 Beta 3 - 'class.mysql.php' Remote File Inclusion

CVE-2006-5079—webappsphp

PHP remote file inclusion vulnerability in class.mysql.php in Matt Humphrey paBugs 2.0 Beta 3 and earlier allows remote

23RISK

open ↗

Referência✓ VexDay Proof

Ninja Blog 4.8 - Remote Information Disclosure

CVE-2009-0325—webappsphp

Directory traversal vulnerability in entries/index.php in Ninja Blog 4.8, when magic_quotes_gpc is disabled, allows remo

23RISK

open ↗

Referência✓ VexDay Proof

phpYabs 0.1.2 - 'Azione' Remote File Inclusion

CVE-2009-0639—webappsphp

PHP remote file inclusion vulnerability in moduli/libri/index.php in phpyabs 0.1.2 allows remote attackers to execute ar

23RISK

open ↗

Referência

CVE-2014-5520

CVE-2014-5520—

SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência

CVE-2022-40797

CVE-2022-40797CRITICAL

Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.

48RISK

open ↗

Referência

CVE-2014-3871

CVE-2014-3871—

Multiple SQL injection vulnerabilities in register.php in Geodesic Solutions GeoCore MAX 7.3.3 (formerly GeoClassifieds

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.