Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
19,067 exploits
Exploit-DB✓ VexDay Proof
JetPhoto 1.0/2.0/2.1 - 'gallery.php?page' Cross-Site Scripting
CVE-2006-1760—webappsphp11 Apr 2006
Multiple cross-site scripting (XSS) vulnerabilities in JetPhoto allow remote attackers to inject arbitrary web script or
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Saxopress - 'URL' Directory Traversal
CVE-2006-1771—remotewindows11 Apr 2006
Directory traversal vulnerability in misc in pbcs.dll in SAXoTECH SAXoPRESS, aka Saxotech Online (formerly Publicus) all
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Indexu 5.0 - Multiple Remote File Inclusions
CVE-2006-1767—webappsphp11 Apr 2006
Multiple PHP remote file inclusion vulnerabilities in nicecoder.com INDEXU 5.0.0 and 5.0.1 allow remote attackers to exe
23RISK
open ↗
Exploit-DB✓ VexDay Proof
JetPhoto 1.0/2.0/2.1 - 'Slideshow.php?name' Cross-Site Scripting
CVE-2006-1760—webappsphp11 Apr 2006
Multiple cross-site scripting (XSS) vulnerabilities in JetPhoto allow remote attackers to inject arbitrary web script or
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Tritanium Bulletin Board 1.2.3 - Multiple Cross-Site Scripting Vulnerabilities
CVE-2006-1768—webappsphp11 Apr 2006
Multiple cross-site scripting (XSS) vulnerabilities in register.php in Tritanium Bulletin Board (TBB) 1.2.3 allow remote
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Clever Copy 3.0 - 'Connect.INC' Information Disclosure
CVE-2006-1718—webappsphp11 Apr 2006
Magus Perde Clever Copy 3.0 and earlier stores sensitive information under the web root with insufficient access control
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Simplog 0.9.2 - 's' Remote Command Execution
CVE-2006-0146—webappsphp11 Apr 2006
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Neon Responders 5.4 - Remote Clock Synchronization Denial of Service
CVE-2006-1941—dosmultiple10 Apr 2006
Neon Responder 5.4 for LANsurveyor allows remote attackers to cause a denial of service (application outage) via a craft
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHPMyForum 4.0 - 'index.php?type' CRLF Injection
CVE-2006-1714—webappsphp10 Apr 2006
CRLF injection vulnerability in index.php in Christoph Roeder phpMyForum 4.0 allows remote attackers to inject HTTP head
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Shadowed Portal 5.7 - 'Load.php' Cross-Site Scripting
CVE-2006-1701—webappsphp10 Apr 2006
Cross-site scripting (XSS) vulnerability in the Pages module in Shadowed Portal allows remote attackers to inject arbitr
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHPWebGallery 1.4.1 - 'category.php' Cross-Site Scripting
CVE-2006-1675—webappsphp10 Apr 2006
Multiple cross-site scripting (XSS) vulnerabilities in PHPWebGallery 1.4.1 allow remote attackers to inject arbitrary we
23RISK
open ↗
Exploit-DB✓ VexDay Proof
ShopWeezle 2.0 - 'index.php' Multiple SQL Injections
CVE-2006-1706—webappsphp10 Apr 2006
Multiple SQL injection vulnerabilities in Shopweezle 2.0 allow remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Exploit-DB✓ VexDay Proof
SIRE 2.0 - Arbitrary File Upload
CVE-2006-1704—webappsphp10 Apr 2006
Sire 2.0 nws allows remote attackers to upload arbitrary image files without authentication via a direct request to uplo
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP 4.x - 'tempnam() open_basedir' Restriction Bypass
CVE-2006-1494—remotephp10 Apr 2006
Directory traversal vulnerability in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass open_basedir restriction
23RISK
open ↗
Exploit-DB✓ VexDay Proof
ShopWeezle 2.0 - 'login.php?itemID' SQL Injection
CVE-2006-1706—webappsphp10 Apr 2006
Multiple SQL injection vulnerabilities in Shopweezle 2.0 allow remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP 4.x - 'copy() Safe_Mode' Bypass
CVE-2006-1608—remotephp10 Apr 2006
The copy function in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass safe mode and read arbitrary files via a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHPWebGallery 1.4.1 - 'picture.php' Cross-Site Scripting
CVE-2006-1675—webappsphp10 Apr 2006
Multiple cross-site scripting (XSS) vulnerabilities in PHPWebGallery 1.4.1 allow remote attackers to inject arbitrary we
23RISK
open ↗
Exploit-DB✓ VexDay Proof
SPIP 1.8.3 - 'Spip_login.php' Remote File Inclusion
CVE-2006-1702—webappsphp10 Apr 2006
PHP remote file inclusion vulnerability in spip_login.php3 in SPIP 1.8.3 allows remote attackers to execute arbitrary PH
23RISK
open ↗
Exploit-DB✓ VexDay Proof
ShopWeezle 2.0 - 'memo.php?itemID' SQL Injection
CVE-2006-1706—webappsphp10 Apr 2006
Multiple SQL injection vulnerabilities in Shopweezle 2.0 allow remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Exploit-DB✓ VexDay Proof
VegaDNS 0.9.9 - 'index.php?cid' SQL Injection
CVE-2006-1758—webappsphp10 Apr 2006
SQL injection vulnerability in index.php in Vegadns 0.99 allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHPMyForum 4.0 - 'page' Cross-Site Scripting
CVE-2006-1713—webappsphp10 Apr 2006
Cross-site scripting (XSS) vulnerability in index.php in Christoph Roeder phpMyForum 4.0 allows remote attackers to inje
23RISK
open ↗
Exploit-DB✓ VexDay Proof
JBook 1.3 - 'index.php' Cross-Site Scripting
CVE-2006-1765—webappsphp10 Apr 2006
Cross-site scripting (XSS) vulnerability in index.php in JBook 1.3 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Horde 3.0.9/3.1.0 - Help Viewer Remote Code Execution (Metasploit)
CVE-2006-1491—webappsphp10 Apr 2006
Eval injection vulnerability in Horde Application Framework versions 3.0 before 3.0.10 and 3.1 before 3.1.1 allows remot
35RISK
open ↗
Exploit-DB✓ VexDay Proof
AWeb's Banner Generator 3.0 - Cross-Site Scripting
CVE-2006-1699—webappsphp07 Apr 2006
Cross-site scripting (XSS) vulnerability in index.php in Aweb Banner Generator 3.0 and earlier allows remote attackers t
23RISK
open ↗
Exploit-DB✓ VexDay Proof
vBulletin 3.5.1 - 'Vbugs.php' Cross-Site Scripting
CVE-2006-1673—webappsphp07 Apr 2006
Cross-site scripting (XSS) vulnerability in vbugs.php in Dark_Wizard vBug Tracker 3.5.1 and earlier allows remote attack
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Tony Cook Imager 0.4x - '.JPEG' / '.TGA' Images Denial of Service
CVE-2006-0053—doslinux07 Apr 2006
Imager (libimager-perl) before 0.50 allows user-assisted attackers to cause a denial of service (segmentation fault) by
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Bitweaver CMS 1.3 - Multiple Cross-Site Scripting Vulnerabilities
CVE-2006-1745—webappsphp07 Apr 2006
Cross-site scripting (XSS) vulnerability in login.php in Bitweaver 1.3 allows remote attackers to inject arbitrary web s
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Jupiter CMS 1.1.5 - 'index.php' Cross-Site Scripting
CVE-2006-1679—webappsphp07 Apr 2006
Cross-site scripting (XSS) vulnerability in modules/online.php in Jupiter CMS 1.1.5 allows remote attackers to inject ar
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Matt Wright Guestbook 2.3.1 - Guestbook.pl Multiple HTML Injection Vulnerabilities
CVE-2006-1697—webappscgi07 Apr 2006
Cross-site scripting (XSS) vulnerability in Matt Wright Guestbook 2.3.1 allows remote attackers to execute arbitrary web
23RISK
open ↗
Exploit-DB✓ VexDay Proof
TalentSoft Web+ Shop 5.0 - 'Deptname' Cross-Site Scripting
CVE-2006-1682—webappscgi07 Apr 2006
Cross-site scripting (XSS) vulnerability in webplus.exe in TalentSoft Web+Shop 5.0 and earlier allows remote attackers t
23RISK
open ↗
← previouspage 431 / 636next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.