Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,533cataloged exploits

35,607CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,407GitHub PoC 14,247VulnCheck XDB 8,663Nuclei 4,287Metasploit 3,474✓ verified onlyrecent popular risk

22,407 exploits

Referência✓ VexDay Proof

traindepot 0.1 - Local File Inclusion / Cross-Site Scripting

CVE-2008-2839—webappsphp

Cross-site scripting (XSS) vulnerability in the search module in Traindepot 0.1 allows remote attackers to inject arbitr

23RISK

open ↗

Referência✓ VexDay Proof

XChat 2.8.7b - 'URI Handler' Remote Code Execution (Internet Explorer 6/7)

CVE-2008-2841—remotewindows

Argument injection vulnerability in XChat 2.8.7b and earlier on Windows, when Internet Explorer is used, allows remote a

28RISK

open ↗

Referência✓ VexDay Proof

doITlive CMS 2.50 - SQL Injection / Cross-Site Scripting

CVE-2008-2842—webappsasp

Cross-site scripting (XSS) vulnerability in edit/showmedia.asp in doITLive CMS 2.50 and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

BoatScripts Classifieds - 'type' SQL Injection

CVE-2008-2846—webappsphp

SQL injection vulnerability in index.php in BoatScripts Classifieds allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

AJ Auction Web 2.0 - 'cate_id' SQL Injection

CVE-2008-2860—webappsphp

SQL injection vulnerability in category.php in AJSquare AJ Auction Pro web 2.0 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

PHP Site Lock 2.0 - 'index.php' SQL Injection

CVE-2008-2865—webappsphp

SQL injection vulnerability in index.php in Kalptaru Infotech PHP Site Lock 2.0 allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

E-topbiz ViralDX 2.07 - 'bannerid' SQL Injection

CVE-2008-2867—webappsphp

SQL injection vulnerability in adclick.php in E-topbiz Viral DX 1 2.07 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2018-5756

CVE-2018-5756—

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev4

23RISK

open ↗

Referência✓ VexDay Proof

DUcalendar 1.0 - 'iEve' SQL Injection

CVE-2008-2868—webappsasp

SQL injection vulnerability in detail.asp in DUware DUcalendar 1.0 and possibly earlier allows remote attackers to execu

23RISK

open ↗

Referência✓ VexDay Proof

Jokes & Funny Pics Script - 'sb_jokeid' SQL Injection

CVE-2008-2874—webappsphp

SQL injection vulnerability in index.php in Softbiz Jokes & Funny Pics Script allows remote attackers to execute arbitra

23RISK

open ↗

Referência

CVE-2018-5756

CVE-2018-5756—

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev4

23RISK

open ↗

Referência✓ VexDay Proof

Hedgehog-CMS 1.21 - 'header.php' Local File Inclusion

CVE-2008-2898—webappsphp

Directory traversal vulnerability in includes/header.php in Hedgehog-CMS 1.21 allows remote attackers to include and exe

23RISK

open ↗

Referência✓ VexDay Proof

phpAuction 3.2.1 - 'item.php' SQL Injection

CVE-2008-2900—webappsphp

SQL injection vulnerability in item.php in PHPAuction 3.2 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

Advanced Webhost Billing System (AWBS) 2.7.1 - 'news.php' SQL Injection

CVE-2008-2903—webappsphp

SQL injection vulnerability in news.php in Advanced Webhost Billing System (AWBS) 2.3.3 through 2.7.1, when magic_quotes

23RISK

open ↗

Referência✓ VexDay Proof

Mambo 4.6.4 - 'Output.php' Remote File Inclusion

CVE-2008-2905—webappsphp

PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4.6.4 and e

43RISK

open ↗

Referência✓ VexDay Proof

Pre Job Board - 'JobSearch.php' SQL Injection

CVE-2008-2915—webappsphp

Multiple SQL injection vulnerabilities in jobseekers/JobSearch.php (aka the search module) in Pre Job Board allow remote

23RISK

open ↗

Referência✓ VexDay Proof

Pre ADS Portal 2.0 - SQL Injection

CVE-2008-2916—webappsphp

Multiple SQL injection vulnerabilities in Pre ADS Portal 2.0 and earlier, when magic_quotes_gpc is disabled, allow remot

23RISK

open ↗

Referência✓ VexDay Proof

Visual Basic Enterprise Edition SP6 - 'vb6skit.dll' Buffer Overflow (PoC)

CVE-2008-2959—doswindows

Buffer overflow in a certain ActiveX control (vb6skit.dll) in Microsoft Visual Basic Enterprise Edition 6.0 SP6 might al

28RISK

open ↗

Referência✓ VexDay Proof

CMS Mini 0.2.2 - Multiple Local File Inclusions

CVE-2008-2961—webappsphp

Multiple directory traversal vulnerabilities in view/index.php in CMS Mini 0.2.2 allow remote attackers to read arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

Real Estate Manager 1.01 - 'cat_id' SQL Injection

CVE-2008-4674—webappsphp

SQL injection vulnerability in realestate-index.php in Conkurent Real Estate Manager 1.01 allows remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

Mantis Bug Tracker 1.1.3 - Remote Code Execution

CVE-2008-4687—webappsphp

manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort param

50RISK

open ↗

Referência✓ VexDay Proof

Opera 9.60 - Persistent Cross-Site Scripting

CVE-2008-4696—remotewindows

Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary w

50RISK

open ↗

Referência

Joomla! Component Jimtawl 2.1.6 - Arbitrary File Upload

CVE-2018-6580—webappsphp

Arbitrary file upload exists in the Jimtawl 2.1.6 and 2.2.5 component for Joomla! via a view=upload&task=upload&pop=true

35RISK

open ↗

Referência

CVE-2026-19383

CVE-2026-19383MEDIUM

saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload

33RISK

open ↗

Referência✓ VexDay Proof

Peachtree Accounting 2004 - 'PAWWeb11.ocx' ActiveX Insecure Method

CVE-2008-4699—remotewindows

Insecure method vulnerability in the ActiveX control (PAWWeb11.ocx) in Peachtree Accounting 2004 allows remote attackers

28RISK

open ↗

Referência✓ VexDay Proof

Vbgooglemap Hotspot Edition 1.0.3 - SQL Injection

CVE-2008-4706—webappsphp

SQL injection vulnerability in VBGooglemap Hotspot Edition 1.0.3, a vBulletin module, allows remote attackers to execute

23RISK

open ↗

Referência

CVE-2018-6584

CVE-2018-6584—

SQL Injection exists in the DT Register 3.2.7 component for Joomla! via a task=edit&id= request.

23RISK

open ↗

Referência✓ VexDay Proof

Pilot Group eTraining - 'news_read.php' SQL Injection

CVE-2008-4709—webappsphp

SQL injection vulnerability in news_read.php in Pilot Group (PG) eTraining allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2018-6604

CVE-2018-6604—

SQL Injection exists in the Zh YandexMap 6.2.1.0 component for Joomla! via the id parameter in a task=getPlacemarkDetail

23RISK

open ↗

Referência✓ VexDay Proof

Joovili 3.0 - Multiple SQL Injections

CVE-2008-4711—webappsphp

SQL injection vulnerability in Joovili 3.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to ex

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.