Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,449cataloged exploits

35,552CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,367GitHub PoC 14,225VulnCheck XDB 8,649Nuclei 4,283Metasploit 3,474✓ verified onlyrecent popular risk

22,367 exploits

Referência✓ VexDay Proof

bilboblog 2.1 - Multiple Vulnerabilities

CVE-2008-3304—webappsphp

BilboBlog 0.2.1 allows remote attackers to obtain sensitive information via (1) an enable_cache=false query string to fo

23RISK

open ↗

Referência✓ VexDay Proof

Pre Survey Poll - 'catid' SQL Injection

CVE-2008-3310—webappsasp

SQL injection vulnerability in default.asp in Pre Survey Poll allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

Maian Search 1.1 - Insecure Cookie Handling

CVE-2008-3317—webappsphp

admin/index.php in Maian Search 1.1 and earlier allows remote attackers to bypass authentication and gain administrative

23RISK

open ↗

Referência✓ VexDay Proof

Maian Guestbook 3.2 - Insecure Cookie Handling

CVE-2008-3320—webappsphp

admin/index.php in Maian Guestbook 3.2 and earlier allows remote attackers to bypass authentication and gain administrat

23RISK

open ↗

Referência✓ VexDay Proof

Maian Uploader 4.0 - Insecure Cookie Handling

CVE-2008-3321—webappsphp

admin/index.php in Maian Uploader 4.0 and earlier allows remote attackers to bypass authentication and gain administrati

23RISK

open ↗

Referência✓ VexDay Proof

Mantis Bug Tracker 1.1.1 - Code Execution / Cross-Site Scripting / Cross-Site Request Forgery

CVE-2008-3332—webappsphp

Eval injection vulnerability in adm_config_set.php in Mantis before 1.1.2 allows remote authenticated administrators to

23RISK

open ↗

Referência✓ VexDay Proof

ShopCartDx 4.30 - 'pid' SQL Injection

CVE-2008-3346—webappsphp

SQL injection vulnerability in product_detail.php in ShopCart DX allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

Atom Photoblog 1.1.5b1 - 'photoId' SQL Injection

CVE-2008-3351—webappsphp

SQL injection vulnerability in atomPhotoBlog.php in Atom PhotoBlog 1.0.9.1 and 1.1.5b1 allows remote attackers to execut

23RISK

open ↗

Referência

CVE-2026-9512

CVE-2026-9512MEDIUM

Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection

33RISK

open ↗

Referência

CVE-2026-9511

CVE-2026-9511MEDIUM

Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection

33RISK

open ↗

Referência

CVE-2026-9498

CVE-2026-9498MEDIUM

Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine

33RISK

open ↗

Referência✓ VexDay Proof

TubeGuru Video Sharing Script - 'UID' SQL Injection

CVE-2008-3674—webappsphp

SQL injection vulnerability in ugroups.php in PozScripts TubeGuru Video Sharing Script allows remote attackers to execut

23RISK

open ↗

Referência

CVE-2018-5981

CVE-2018-5981—

SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter.

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Visual Studio - 'Msmask32.ocx' ActiveX Remote Buffer Overflow (PoC)

CVE-2008-3704—doswindows

Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions befo

50RISK

open ↗

Referência✓ VexDay Proof

Microsoft Visual Studio - 'Msmask32.ocx' ActiveX Remote Buffer Overflow

CVE-2008-3704—remotewindows

Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions befo

50RISK

open ↗

Referência✓ VexDay Proof

phpArcadeScript 4 - 'cat' SQL Injection

CVE-2008-3711—webappsphp

SQL injection vulnerability in index.php in PHPArcadeScript (PHP Arcade Script) 4.0 allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

cyberBB 0.6 - Multiple SQL Injections

CVE-2008-3718—webappsphp

Multiple SQL injection vulnerabilities in cyberBB 0.6 allow remote authenticated users to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

Ad Board - 'id' SQL Injection

CVE-2008-3725—webappsphp

SQL injection vulnerability in trr.php in YourFreeWorld Ad Board Script allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Banner Management Script - 'id' SQL Injection

CVE-2008-3749—webappsphp

SQL injection vulnerability in tr.php in YourFreeWorld Banner Management Script allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

YourFreeWorld Classifieds - 'category' SQL Injection

CVE-2008-3755—webappsphp

SQL injection vulnerability in view.php in YourFreeWorld Classifieds Script allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

YourFreeWorld Viral Marketing - SQL Injection

CVE-2008-3756—webappsphp

SQL injection vulnerability in tr.php in YourFreeWorld Viral Marketing Script allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

VMware Workstation 6.5.1 - 'hcmon.sys 6.0.0.45731' Local Denial of Service

CVE-2008-3761—doswindows

hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VM

23RISK

open ↗

Referência✓ VexDay Proof

PHP Live Helper 2.0.1 - Multiple Vulnerabilities

CVE-2008-3762—webappsphp

SQL injection vulnerability in onlinestatus_html.php in Turnkey PHP Live Helper 2.0.1 and earlier allows remote attacker

23RISK

open ↗

Referência

CVE-2008-3765

CVE-2008-3765—

SQL injection vulnerability in code.php in Quick Poll Script allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência✓ VexDay Proof

Quick Poll Script - 'id' SQL Injection

CVE-2008-3765—webappsphp

SQL injection vulnerability in code.php in Quick Poll Script allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência

CVE-2018-5982

CVE-2018-5982—

SQL Injection exists in the Advertisement Board 3.1.0 component for Joomla! via a task=show_rss_categories&catname= requ

23RISK

open ↗

Referência✓ VexDay Proof

SunShop Shopping Cart 4.1.4 - 'id' SQL Injection

CVE-2008-3768—webappsphp

Multiple SQL injection vulnerabilities in class.ajax.php in Turnkey Web Tools SunShop Shopping Cart before 4.1.5 allow r

23RISK

open ↗

Referência✓ VexDay Proof

Pars4U Videosharing 1.0 - Cross-Site Scripting / Blind SQL Injection

CVE-2008-3772—webappsphp

SQL injection vulnerability in categories_portal.php in Pars4u Videosharing 1 allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

Matterdaddy Market 1.1 - 'index.php' Multiple SQL Injections

CVE-2008-3783—webappsphp

Multiple SQL injection vulnerabilities in index.php in Matterdaddy Market 1.1, when magic_quotes_gpc is disabled, allow

23RISK

open ↗

Referência✓ VexDay Proof

VideoLAN VLC Media Player 0.8.6i - Mms Protocol Handling Heap Overflow (PoC)

CVE-2008-3794—dosmultiple

Integer signedness error in the mms_ReceiveCommand function in modules/access/mms/mmstu.c in VLC Media Player 0.8.6i all

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.