Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,600cataloged exploits
39,734CVEs with public exploitation
24,695lab-tested
AllReferência 25,742Exploit-DB 24,486GitHub PoC 16,618VulnCheck XDB 9,736Nuclei 4,493Metasploit 3,525✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Macromedia 10.1.4.20 - 'SwDir.dll' Internet Explorer Stack Overflow Denial of Service
CVE-2007-1403—doswindows
Multiple stack-based buffer overflows in an ActiveX control in SwDir.dll 10.1.4.20 in Macromedia Shockwave allow remote
28RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Top Sites - SQL Injection
CVE-2008-6247—webappsphp
SQL injection vulnerability in topsite.php in Scripts For Sites (SFS) EZ Top Sites allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
T-Dreams Job Career Package 3.0 - Insecure Cookie Handling
CVE-2009-1638—webappsasp
Techno Dreams Job Career Package 3.0 allows remote attackers to bypass authentication and obtain administrative access b
23RISK
open ↗
Referência✓ VexDay Proof
XM Easy Personal FTP Server 5.2.1 - Remote Denial of Service
CVE-2006-5728—doswindows
XM Easy Personal FTP Server 5.2.1 and earlier allows remote authenticated users to cause a denial of service via a long
23RISK
open ↗
Referência✓ VexDay Proof
Web Wiz Rich Text Editor 4.0 - Multiple Vulnerabilities
CVE-2008-0481—webappsasp
Directory traversal vulnerability in RTE_file_browser.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to lis
23RISK
open ↗
Referência✓ VexDay Proof
Q-Shop 3.0 - Cross-Site Scripting / SQL Injection
CVE-2008-6258—webappsasp
SQL injection vulnerability in users.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
Realty Web-Base 1.0 - Authentication Bypass
CVE-2009-1658—webappsphp
Multiple SQL injection vulnerabilities in admin/admin.php in Realty Webware Technologies Realty Web-Base 1.0 allow remot
23RISK
open ↗
Referência✓ VexDay Proof
T.G.S. CMS 0.1.7 - 'logout.php' SQL Injection
CVE-2006-5732—webappsphp
SQL injection vulnerability in logout.php in T.G.S. CMS 0.1.7 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component musepoes - 'aid' SQL Injection
CVE-2008-0515—webappsphp
SQL injection vulnerability in index.php in the musepoes (com_musepoes) component for Mambo and Joomla! allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
Q-Shop 3.0 - Cross-Site Scripting / SQL Injection
CVE-2008-6259—webappsasp
Cross-site scripting (XSS) vulnerability in search.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
exV2 < 2.0.4.3 - 'extract()' Remote Command Execution
CVE-2006-7080—webappsphp
Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to de
23RISK
open ↗
Referência✓ VexDay Proof
Family Project 2.x - Authentication Bypass
CVE-2008-6274—webappsphp
Multiple SQL injection vulnerabilities in index.php in FamilyProject 2.0 allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_gsticketsystem - 'catid' Blind SQL Injection
CVE-2009-1736—webappsphp
SQL injection vulnerability in the GridSupport (GS) Ticket System (com_gsticketsystem) component for Joomla! allows remo
23RISK
open ↗
Referência✓ VexDay Proof
RakhiSoftware Shopping Cart - SQL Injection
CVE-2008-6277—webappsphp
SQL injection vulnerability in product.php in RakhiSoftware Price Comparison Script (aka Shopping Cart) allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
DGNews 3.0 Beta - 'id' SQL Injection
CVE-2009-1746—webappsphp
SQL injection vulnerability in berita.php in Dian Gemilang DGNews 3.0 Beta allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
phpBurningPortal 1.0.1 - 'lang_path' Remote File Inclusion
CVE-2006-7102—webappsphp
Multiple PHP remote file inclusion vulnerabilities in phpBurningPortal quiz-modul 1.0.1, and possibly earlier, allow rem
23RISK
open ↗
Referência✓ VexDay Proof
2DayBiz Template Monster Clone - 'edituser.php' Change Pass
CVE-2009-1767—webappsphp
admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Article System 0.6 - 'volume.php' Remote File Inclusion
CVE-2006-5766—webappsphp
PHP remote file inclusion vulnerability in volume.php in Article System 0.6 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Power Phlogger 2.0.9 - 'config.inc.php3' File Inclusion
CVE-2006-7106—webappsphp
PHP remote file inclusion vulnerability in config.inc.php3 in Power Phlogger 2.0.9 and earlier allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
my-gesuad 0.9.14 - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2009-1811—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in myGesuad 0.9.14 (aka 0.9) allow remote attackers to inject arbitr
23RISK
open ↗
Referência✓ VexDay Proof
FreeWebShop.org script 2.2.2 - Multiple Vulnerabilities
CVE-2006-5772—webappsphp
Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 and earlier allow remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
JAF CMS 4.0 RC2 - Multiple Remote File Inclusions
CVE-2006-7127—webappsphp
Multiple PHP remote file inclusion vulnerabilities in JAF CMS 4.0 and 4.0 RC2 allow remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
PHPenpals 1.1 - 'mail.php?ID' SQL Injection
CVE-2009-1814—webappsphp
SQL injection vulnerability in mail.php in PHPenpals 1.1 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Free Directory Script 1.1.1 - 'API_HOME_DIR' Remote File Inclusion
CVE-2008-6305—webappsphp
PHP remote file inclusion vulnerability in init.php in Free Directory Script 1.1.1, when register_globals is enabled, al
23RISK
open ↗
Referência✓ VexDay Proof
2DayBiz Custom T-shirt Design - SQL Injection / Cross-Site Scripting
CVE-2009-1820—webappsphp
Cross-site scripting (XSS) vulnerability in product.php in 2daybiz Custom T-shirt Design Script allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
OpenEMR 2.8.1 - 'srcdir' Multiple Remote File Inclusions
CVE-2006-5795—webappsphp
Multiple PHP remote file inclusion vulnerabilities in OpenEMR 2.8.1 and earlier, when register_globals is enabled, allow
23RISK
open ↗
Referência✓ VexDay Proof
FreeWebShop.org script 2.2.2 - Multiple Vulnerabilities
CVE-2006-5773—webappsphp
Directory traversal vulnerability in index.php in FreeWebshop 2.2.1 and earlier allows remote attackers to read arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
iPrimal Forums - '/admin/index.php' Change User Password
CVE-2006-5787—webappsphp
admin/index.php in IPrimal Forums as of 20061105 allows remote attackers to bypass authentication and modify user passwo
23RISK
open ↗
Referência✓ VexDay Proof
PunBB (Private Messaging System 1.2.x) - Multiple Local File Inclusions
CVE-2008-6308—webappsphp
Multiple directory traversal vulnerabilities in Private Messaging System (PMS) 1.2.3 and earlier for PunBB allow remote
23RISK
open ↗
Referência✓ VexDay Proof
Soulseek 157 NS - Remote Buffer Overflow (SEH)
CVE-2009-1830—remotewindows
Stack-based buffer overflow in Soulseek 156 and 157 NS allows remote attackers to execute arbitrary code via a long sear
23RISK
open ↗
← previouspage 42 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.