Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,020cataloged exploits
35,276CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,446Referência 22,166GitHub PoC 14,080VulnCheck XDB 8,604Nuclei 4,251Metasploit 3,473✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB✓ VexDay Proof
PhpLinkExchange 1.02 - Cross-Site Scripting / Upload
CVE-2008-3679—webappsphp16 Dec 2009
Multiple cross-site scripting (XSS) vulnerabilities in index.php in IDevSpot PhpLinkExchange 1.01 allow remote attackers
23RISK
open ↗
Exploit-DB✓ VexDay Proof
OSSIM 2.1.5 - Remote Command Execution
CVE-2009-4372—webappsphp16 Dec 2009
AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly other versions before 2.1.5-4, allows
23RISK
open ↗
Exploit-DB✓ VexDay Proof
OSSIM 2.1.5 - SQL Injection
CVE-2009-4375—webappsphp16 Dec 2009
SQL injection vulnerability in repository/repository_attachment.php in AlienVault Open Source Security Information Manag
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Digiappz Freekot - Authentication Bypass
CVE-2006-4524—webappsasp16 Dec 2009
Multiple SQL injection vulnerabilities in login_verif.asp in Digiappz Freekot 1.01 allow remote attackers to execute arb
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Drupal Module Sections 5.x-1.2/6.x-1.2 - HTML Injection
CVE-2009-4429—webappsphp16 Dec 2009
Cross-site scripting (XSS) vulnerability in the Sections module 5.x before 5.x-1.3 and 6.x before 6.x-1.3 for Drupal all
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Ez Cart 1.0 - Multiple Cross-Site Request Forgery Vulnerabilities
CVE-2009-4364—webappsphp15 Dec 2009
Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez Blog allows remote attackers to inject arbitrary w
23RISK
open ↗
Exploit-DB✓ VexDay Proof
LinkPal 1.0 - SQL Injection
CVE-2009-2614—webappsasp15 Dec 2009
SQL injection vulnerability in z_admin_login.asp in DataCheck Solutions LinkPal 1.x allows remote attackers to execute a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Horde 3.3.5 - '/Administration Interface admin/cmdshell.php?PATH_INFO' Cross-Site Scripting
CVE-2009-3701—webappsphp15 Dec 2009
Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework befor
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Horde 3.3.5 - '/Administration Interface admin/sqlshell.php?PATH_INFO' Cross-Site Scripting
CVE-2009-3701—webappsphp15 Dec 2009
Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework befor
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Ez Blog 1.0 - Cross-Site Scripting / Cross-Site Request Forgery
CVE-2009-4366—webappsphp15 Dec 2009
Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez Blog 1.0 allows remote attackers to inject arbitra
23RISK
open ↗
Exploit-DB
GalleryPal FE 1.5 - Authentication Bypass
CVE-2009-2365—webappsasp15 Dec 2009
SQL injection vulnerability in login.asp in DataCheck Solutions GalleryPal FE 1.5 allows remote attackers to execute arb
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Ez Cart 1.0 - Multiple Cross-Site Request Forgery Vulnerabilities
CVE-2009-4366—webappsphp15 Dec 2009
Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez Blog 1.0 allows remote attackers to inject arbitra
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Horde 3.3.5 - Cross-Site Scripting
CVE-2009-3701—webappsphp15 Dec 2009
Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework befor
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Ez Cart 1.0 - Multiple Cross-Site Request Forgery Vulnerabilities
CVE-2009-4365—webappsphp15 Dec 2009
Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ScriptsEz Ez Blog 1.0 allow remote attackers
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Ez Blog 1.0 - Cross-Site Scripting / Cross-Site Request Forgery
CVE-2009-4365—webappsphp15 Dec 2009
Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ScriptsEz Ez Blog 1.0 allow remote attackers
23RISK
open ↗
Exploit-DB✓ VexDay Proof
APC Network Management Card - Cross-Site Request Forgery / Cross-Site Scripting
CVE-2009-1798—remotemultiple15 Dec 2009
Multiple cross-site scripting (XSS) vulnerabilities on the Network Management Card (NMC) on American Power Conversion (A
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Ez Blog 1.0 - Cross-Site Scripting / Cross-Site Request Forgery
CVE-2009-4364—webappsphp15 Dec 2009
Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez Blog allows remote attackers to inject arbitrary w
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Link Up Gold - Cross-Site Request Forgery (Add Admin)
CVE-2009-4349—webappsphp14 Dec 2009
Cross-site request forgery (CSRF) vulnerability in administration/administrators.php in Link Up Gold 5.0 allows remote a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Ez Poll Hoster - Multiple Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities
CVE-2009-4385—webappsphp14 Dec 2009
Multiple cross-site request forgery (CSRF) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WSCreator 1.1 - Blind SQL Injection
CVE-2009-4351—webappsphp14 Dec 2009
SQL injection vulnerability in ADMIN/loginaction.php in WSCreator 1.1, when magic_quotes_gpc is disabled, allows remote
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Mail Manager Pro - Cross-Site Request Forgery (Change Admin Password)
CVE-2009-4827—webappslinux14 Dec 2009
Cross-site request forgery (CSRF) vulnerability in admin.php in Mail Manager Pro allows remote attackers to hijack the a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
eoCMS 0.9.03 - Remote File Inclusion
CVE-2009-4319—webappsphp14 Dec 2009
PHP remote file inclusion vulnerability in js/bbcodepress/bbcode-form.php in eoCMS 0.9.03 and earlier, when register_glo
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Ez Poll Hoster - Multiple Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities
CVE-2009-4384—webappsphp14 Dec 2009
Multiple cross-site scripting (XSS) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to inje
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Zabbix Server - Multiple Vulnerabilities
CVE-2009-4501—webappsmultiple14 Dec 2009
The zbx_get_next_field function in libs/zbxcommon/str.c in Zabbix Server before 1.6.8 allows remote attackers to cause a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Smart PHP Subscriber - Multiple Disclosure Vulnerabilities
CVE-2007-0518—webappsphp14 Dec 2009
Scriptsez Smart PHP Subscriber (aka subscribe) stores sensitive information under the web root with insufficient access
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Zabbix Server - Multiple Vulnerabilities
CVE-2009-4499—webappsmultiple14 Dec 2009
SQL injection vulnerability in the get_history_lastid function in the nodewatcher component in Zabbix Server before 1.6.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
RM Downloader 3.0.2.1 - '.m3u' Local Stack Overflow
CVE-2009-1326—localwindows14 Dec 2009
Stack-based buffer overflow in Mini-stream RM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Million Pixel Script 3 - 'pa' Cross-Site Scripting
CVE-2009-4381—webappsphp14 Dec 2009
Cross-site scripting (XSS) vulnerability in index.php in texmedia Million Pixel Script 3 allows remote attackers to inje
23RISK
open ↗
Exploit-DB✓ VexDay Proof
phpFaber CMS 1.3.36 - 'module.php' Cross-Site Scripting
CVE-2009-4382—webappsphp14 Dec 2009
Cross-site scripting (XSS) vulnerability in module.php in PHPFABER CMS, possibly 1.3.36, allows remote attackers to inje
23RISK
open ↗
Exploit-DB✓ VexDay Proof
AdManagerPro - Cross-Site Request Forgery (Add Admin)
CVE-2009-4828—webappsphp14 Dec 2009
Cross-site request forgery (CSRF) vulnerability in administration/admins.php in Ad Manager Pro (aka AdManagerPro) 3.0 al
23RISK
open ↗
← previouspage 406 / 815next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.