Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,958cataloged exploits
36,206CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,460Referência 22,832GitHub PoC 14,991VulnCheck XDB 8,829Nuclei 4,357Metasploit 3,489✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Web Wiz Rich Text Editor 4.0 - Multiple Vulnerabilities
CVE-2008-0481—webappsasp
Directory traversal vulnerability in RTE_file_browser.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to lis
23RISK
open ↗
Referência✓ VexDay Proof
Q-Shop 3.0 - Cross-Site Scripting / SQL Injection
CVE-2008-6258—webappsasp
SQL injection vulnerability in users.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component MooFAQ (com_moofaq) - Local File Inclusion
CVE-2009-2015—webappsphp
Directory traversal vulnerability in includes/file_includer.php in the Ideal MooFAQ (com_moofaq) component 1.0 for Jooml
38RISK
open ↗
Referência✓ VexDay Proof
Q-Shop 3.0 - Cross-Site Scripting / SQL Injection
CVE-2008-6259—webappsasp
Cross-site scripting (XSS) vulnerability in search.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
SaturnCMS - Blind SQL Injection
CVE-2008-6263—webappsphp
SQL injection vulnerability in lib/user/t_user.php in SaturnCMS allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component musepoes - 'aid' SQL Injection
CVE-2008-0515—webappsphp
SQL injection vulnerability in index.php in the musepoes (com_musepoes) component for Mambo and Joomla! allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
VideoLAN VLC Media Player 0.8.6i - '.tta' File Parsing Heap Overflow (PoC)
CVE-2008-3732—dosmultiple
Integer overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remote attackers to cause
28RISK
open ↗
Referência✓ VexDay Proof
WEBBDOMAIN WebShop 1.02 - SQL Injection / Cross-Site Scripting
CVE-2008-6268—webappsphp
SQL injection vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote attackers to e
23RISK
open ↗
Referência✓ VexDay Proof
Family Project 2.x - Authentication Bypass
CVE-2008-6274—webappsphp
Multiple SQL injection vulnerabilities in index.php in FamilyProject 2.0 allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
RakhiSoftware Shopping Cart - SQL Injection
CVE-2008-6277—webappsphp
SQL injection vulnerability in product.php in RakhiSoftware Price Comparison Script (aka Shopping Cart) allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
Lycos FileUploader Control - ActiveX Remote Buffer Overflow
CVE-2008-0443—remotewindows
Heap-based buffer overflow in the FileUploader.FUploadCtl.1 ActiveX control in FileUploader.dll 2.0.0.2 in Lycos FileUpl
28RISK
open ↗
Referência✓ VexDay Proof
PHP TV Portal 2.0 - 'mid' SQL Injection
CVE-2008-6285—webappsphp
SQL injection vulnerability in index.php in PHP TV Portal 2.0 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
Tours Manager 1.0 - SQL Injection
CVE-2008-6289—webappsphp
SQL injection vulnerability in cityview.php in Tours Manager 1.0 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
elvin bts 1.2.0 - Multiple Vulnerabilities
CVE-2009-2129—webappsphp
Cross-site request forgery (CSRF) vulnerability in login.php in Elvin 1.2.0 allows remote attackers to hijack the authen
23RISK
open ↗
Referência✓ VexDay Proof
SapLPD 6.28 (Windows x86) - Remote Buffer Overflow
CVE-2008-0621—remotewindows_x86
Buffer overflow in SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to
60RISK
open ↗
Referência✓ VexDay Proof
Acc Statistics 1.1 - Insecure Cookie Handling
CVE-2008-6294—webappsphp
admin/Index.php in Acc Statistics 1.1 allows remote attackers to bypass authentication and gain administrative access by
23RISK
open ↗
Referência✓ VexDay Proof
phpBB Mod Small ShoutBox 1.4 - Remote Edit/Delete Messages
CVE-2008-6301—webappsphp
SQL injection vulnerability in shoutbox_view.php in the Small ShoutBox module 1.4 for phpBB allows remote attackers to e
23RISK
open ↗
Referência✓ VexDay Proof
ToursManager - 'tourview.php' Blind SQL Injection
CVE-2008-6303—webappsphp
SQL injection vulnerability in tourview.php in ToursManager allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
Free Directory Script 1.1.1 - 'API_HOME_DIR' Remote File Inclusion
CVE-2008-6305—webappsphp
PHP remote file inclusion vulnerability in init.php in Free Directory Script 1.1.1, when register_globals is enabled, al
23RISK
open ↗
Referência✓ VexDay Proof
E-topbiz Link Back Checker 1 - Insecure Cookie Handling
CVE-2008-6307—webappsphp
E-topbiz Link Back Checker 1 allows remote attackers to bypass authentication and gain administrative access by setting
23RISK
open ↗
Referência✓ VexDay Proof
PunBB (Private Messaging System 1.2.x) - Multiple Local File Inclusions
CVE-2008-6308—webappsphp
Multiple directory traversal vulnerabilities in Private Messaging System (PMS) 1.2.3 and earlier for PunBB allow remote
23RISK
open ↗
Referência✓ VexDay Proof
RevSense 1.0 - Authentication Bypass
CVE-2008-6310—webappsphp
SQL injection vulnerability in index.php in W3matter RevSense 1.0 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
phpAddEdit 1.3 - 'editform' Local File Inclusion
CVE-2008-6313—webappsphp
Directory traversal vulnerability in addedit-render.php in phpAddEdit 1.3, when magic_quotes_gpc is disabled, allows rem
23RISK
open ↗
Referência✓ VexDay Proof
PHPmyGallery 1.0beta2 - Local/Remote File Inclusion
CVE-2008-6316—webappsphp
Directory traversal vulnerability in _conf/core/common-tpl-vars.php in PHPmyGallery 1.0 beta2 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Adobe Acrobat 9 - ActiveX Remote Denial of Service
CVE-2008-4071—doswindows
A certain ActiveX control in Adobe Acrobat 9, when used with Microsoft Windows Vista and Internet Explorer 7, allows rem
28RISK
open ↗
Referência✓ VexDay Proof
PHPmyGallery 1.5beta - '/common-tpl-vars.php' Local/Remote File Inclusion
CVE-2008-6317—webappsphp
Directory traversal vulnerability in _conf/_php-core/common-tpl-vars.php in PHPmyGallery 1.5 beta allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
PHPmyGallery 1.5beta - '/common-tpl-vars.php' Local/Remote File Inclusion
CVE-2008-6318—webappsphp
PHP remote file inclusion vulnerability in _conf/_php-core/common-tpl-vars.php in PHPmyGallery 1.5 beta allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin User Photo Component - Arbitrary File Upload
CVE-2013-1916—webappsphp
In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upl
28RISK
open ↗
Referência✓ VexDay Proof
LoveCMS 1.6.2 Final - Remote Code Execution
CVE-2008-3509—webappsphp
LoveCMS 1.6.2 does not require administrative authentication for (1) addblock.php, (2) blocks.php, and (3) themes.php in
23RISK
open ↗
Referência✓ VexDay Proof
Online Fantasy Football League (OFFL) 0.2.6 - Remote File Inclusion
CVE-2007-4809—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Online Fantasy Football League (OFFL) 0.2.6 allow remote attackers
35RISK
open ↗
← previouspage 42 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.