Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,302cataloged exploits
35,469CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,301GitHub PoC 14,141VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
IBM Lotus Sametime 8.0 - Multiplexer Buffer Overflow
CVE-2008-2499—remoteunix21 May 2008
Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1
60RISK
open ↗
Exploit-DB✓ VexDay Proof
SAP Web Application Server 7.0 - '/sap/bc/gui/sap/its/webgui/' Cross-Site Scripting
CVE-2008-2421—webappsjava21 May 2008
Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (ak
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Mozilla Firefox 2.0.0.14 - JSframe Heap Corruption Denial of Service
CVE-2008-2419—dosmultiple21 May 2008
Mozilla Firefox 2.0.0.14 allows remote attackers to cause a denial of service (heap corruption and application crash) or
23RISK
open ↗
Exploit-DB✓ VexDay Proof
AppServ Open Project 2.5.10 - 'appservlang' Cross-Site Scripting
CVE-2008-2398—webappsphp20 May 2008
Cross-site scripting (XSS) vulnerability in index.php in AppServ Open Project 2.5.10 and earlier allows remote attackers
38RISK
open ↗
Exploit-DB✓ VexDay Proof
Starsgames Control Panel 4.6.2 - 'index.php' Cross-Site Scripting
CVE-2008-2458—webappsphp20 May 2008
Cross-site scripting (XSS) vulnerability in index.php in Starsgames Control Panel 4.6.2 and earlier allows remote attack
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Web Slider 0.6 - 'slide' SQL Injection
CVE-2008-2422—webappsphp20 May 2008
SQL injection vulnerability in index.php in Web Slider 0.6 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Exploit-DB✓ VexDay Proof
bcoos 1.0.13 - 'file' Local File Inclusion
CVE-2008-2350—webappsphp19 May 2008
Directory traversal vulnerability in highlight.php in bcoos 1.0.9 through 1.0.13 allows remote attackers to read arbitra
23RISK
open ↗
Exploit-DB✓ VexDay Proof
cPanel 11.21 - 'wwwact' Privilege Escalation
CVE-2008-2478—webappsphp19 May 2008
scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users w
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP-AGTC Membership System 1.1a - Arbitrary Add Admin
CVE-2007-5752—webappsphp18 May 2008
adduser.php in PHP-AGTC Membership (AGTC-Membership) System 1.1a does not require authentication, which allows remote at
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FicHive 1.0 - 'category' Blind SQL Injection
CVE-2008-2425—webappsphp17 May 2008
SQL injection vulnerability in index.php in FicHive 1.0 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Exploit-DB✓ VexDay Proof
ACGV News 0.9.1 - 'glossaire.php?id' SQL Injection
CVE-2008-2412—webappsphp16 May 2008
SQL injection vulnerability in glossaire.php in ACGV News 0.9.1 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
ACGV News 0.9.1 - 'glossaire.php?id' Cross-Site Scripting
CVE-2008-2413—webappsphp16 May 2008
Cross-site scripting (XSS) vulnerability in glossaire.php in ACGV News 0.9.1 allows remote attackers to inject arbitrary
23RISK
open ↗
Exploit-DB✓ VexDay Proof
AN Guestbook 0.4 - 'send_email.php' Cross-Site Scripting
CVE-2008-2414—webappsphp16 May 2008
Cross-site scripting (XSS) vulnerability in send_email.php in AN Guestbook (ANG) 0.4 allows remote attackers to inject a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Digital Hive 2.0 - 'base_include.php' Local File Inclusion
CVE-2008-2415—webappsphp16 May 2008
Directory traversal vulnerability in template/purpletech/base_include.php in DigitalHive (aka hive) 2.0 RC2 allows remot
23RISK
open ↗
Exploit-DB✓ VexDay Proof
SunShop Shopping Cart 3.5.1 - 'index.php' SQL Injection
CVE-2008-2339—webappsphp15 May 2008
SQL injection vulnerability in index.php in Turnkey Web Tools SunShop Shopping Cart 3.5.1 allows remote attackers to exe
23RISK
open ↗
Exploit-DB✓ VexDay Proof
philboard 0.5 - 'W1L3D4_foruma_yeni_konu_ac.asp?forumid' SQL Injection
CVE-2008-2334—webappsasp14 May 2008
Multiple SQL injection vulnerabilities in W1L3D4 Philboard 0.5 allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Exploit-DB✓ VexDay Proof
philboard 0.5 - 'W1L3D4_konuya_mesaj_yaz.asp' Multiple SQL Injections
CVE-2008-2334—webappsphp14 May 2008
Multiple SQL injection vulnerabilities in W1L3D4 Philboard 0.5 allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Exploit-DB✓ VexDay Proof
philboard 0.5 - 'W1L3D4_konuoku.asp?id' SQL Injection
CVE-2008-2334—webappsphp14 May 2008
Multiple SQL injection vulnerabilities in W1L3D4 Philboard 0.5 allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHPInstantGallery 2.0 - 'image.php' Multiple Cross-Site Scripting Vulnerabilities
CVE-2008-2449—webappsphp12 May 2008
Multiple cross-site scripting (XSS) vulnerabilities in Isaac McGowan phpInstantGallery 2.0 allow remote attackers to inj
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHPInstantGallery 2.0 - 'index.php?Gallery' Cross-Site Scripting
CVE-2008-2449—webappsphp12 May 2008
Multiple cross-site scripting (XSS) vulnerabilities in Isaac McGowan phpInstantGallery 2.0 allow remote attackers to inj
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Fusebox 5.5.1 - 'fusebox5.php' Remote File Inclusion
CVE-2008-2284—webappsphp12 May 2008
PHP remote file inclusion vulnerability in fusebox5.php in Fusebox 5.5.1 allows remote attackers to execute arbitrary PH
23RISK
open ↗
Exploit-DB✓ VexDay Proof
CyrixMED 1.4 - 'index.php' Cross-Site Scripting
CVE-2008-2264—webappsphp12 May 2008
Cross-site scripting (XSS) vulnerability in index.php in CyrixMED 1.4 allows remote attackers to inject arbitrary web sc
23RISK
open ↗
Exploit-DB✓ VexDay Proof
ScrewTurn Software ScrewTurn Wiki 2.0.x - 'System Log' Page HTML Injection
CVE-2008-3483—webappsphp11 May 2008
Cross-site scripting (XSS) vulnerability in ScrewTurn Wiki 2.0.29 and 2.0.30 allows remote attackers to inject arbitrary
23RISK
open ↗
Exploit-DB✓ VexDay Proof
BlogPHP 2.0 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
CVE-2008-6631—webappsphp10 May 2008
Multiple cross-site scripting (XSS) vulnerabilities in index.php in BlogPHP 2.0 allow remote attackers to inject arbitra
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Ktools Photostore 3.5.2 - Multiple SQL Injections
CVE-2008-6647—webappsphp10 May 2008
SQL injection vulnerability in gallery.php in Ktools PhotoStore 3.4.3 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Ktools Photostore 3.5.1 - 'gid' SQL Injection
CVE-2008-6649—webappsphp09 May 2008
SQL injection vulnerability in manager/image_details_editor.php in Ktools PhotoStore 2.5, 2.9.8, 3.1.0, and other versio
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Ktools Photostore 3.5.1 - 'gid' SQL Injection
CVE-2008-6648—webappsphp09 May 2008
SQL injection vulnerability in crumbs.php in Ktools PhotoStore 3.4.3 and 3.5.2 allows remote attackers to execute arbitr
23RISK
open ↗
Exploit-DB✓ VexDay Proof
cPanel 11.x - '/scripts2/listaccts?search' Cross-Site Scripting
CVE-2008-2070—webappsphp09 May 2008
The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS
23RISK
open ↗
Exploit-DB✓ VexDay Proof
cPanel 11.x - '/scripts2/knowlegebase?issue' Cross-Site Scripting
CVE-2008-2070—webappsphp09 May 2008
The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS
23RISK
open ↗
Exploit-DB✓ VexDay Proof
cPanel 11.x - '/scripts2/changeip?user' Cross-Site Scripting
CVE-2008-2070—webappsphp09 May 2008
The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS
23RISK
open ↗
← previouspage 485 / 816next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.