Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,057cataloged exploits

36,288CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,460Referência 22,910GitHub PoC 14,997VulnCheck XDB 8,843Nuclei 4,358Metasploit 3,489✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

Silentum LoginSys 1.0.0 - Insecure Cookie Handling

CVE-2008-6763—webappsphp

login2.php in Silentum LoginSys 1.0.0 allows remote attackers to bypass authentication and obtain access to an arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

SerWeb 2.0.0 dev1 2007-02-20 - Multiple Local/Remote File Inclusion Vulnerabilities

CVE-2007-6290—webappsphp

Multiple directory traversal vulnerabilities in js/get_js.php in SERWeb 2.0.0 dev1 and earlier allow remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery

CVE-2008-7057—webappsphp

Cross-site scripting (XSS) vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbi

23RISK

open ↗

Referência✓ VexDay Proof

LoveCMS 1.6.2 Final (Download Manager 1.0) - Arbitrary File Upload

CVE-2008-7062—webappsphp

Unrestricted file upload vulnerability in admin/index.php in Download Manager module 1.0 for LoveCMS 1.6.2 Final allows

23RISK

open ↗

Referência✓ VexDay Proof

Star Articles 6.0 - Blind SQL Injection (1)

CVE-2008-7075—webappsphp

Multiple SQL injection vulnerabilities in Kalptaru Infotech Ltd. Star Articles 6.0 allow remote attackers to inject arbi

23RISK

open ↗

Referência✓ VexDay Proof

BigAnt Server 2.2 - Remote Overflow (SEH)

CVE-2008-1914—remotewindows

Stack-based buffer overflow in the AntServer module (AntServer.exe) in BigAnt IM Server in BigAnt Messenger 2.2 allows r

60RISK

open ↗

Referência✓ VexDay Proof

VBA32 Personal AntiVirus 3.12.8.x - Malformed Archive Denial of Service

CVE-2008-5667—doswindows

The scanning engine in VirusBlokAda VBA32 Personal Antivirus 3.12.8.x allows remote attackers to cause a denial of servi

23RISK

open ↗

Referência✓ VexDay Proof

phpChess Community Edition 2.0 - Multiple Remote File Inclusions

CVE-2007-2677—webappsphp

Multiple PHP remote file inclusion vulnerabilities in phpChess Community Edition 2.0 allow remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

Pligg CMS 9.9.0 - Cross-Site Scripting / Local File Inclusion / SQL Injection

CVE-2008-7091—webappsphp

Multiple SQL injection vulnerabilities in Pligg 9.9 and earlier allow remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

LightBlog 9.5 - 'cp_upload_image.php' Arbitrary File Upload

CVE-2008-0632—webappsphp

Unrestricted file upload vulnerability in cp_upload_image.php in LightBlog 9.5 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

k-rate - SQL Injection / Cross-Site Scripting

CVE-2008-7099—webappsphp

Unspecified vulnerability in the Manage Templates feature in Qsoft K-Rate Premium allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

Moodle 1.5.2 - 'moodledata' Remote Session Disclosure

CVE-2007-1647—webappsphp

Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Excel 2000/2003 - Sheet Name (PoC)

CVE-2007-3490—doswindows

Unspecified vulnerability in Microsoft Excel 2003 SP2 allows remote attackers to have an unknown impact via unspecified

35RISK

open ↗

Referência✓ VexDay Proof

Najdi.si Toolbar - ActiveX Remote Buffer Overflow (PoC)

CVE-2008-7103—doswindows

Stack-based buffer overflow in an ActiveX control in najdisitoolbar.dll in Najdi.si Toolbar 2.0.4.1 allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

phpEventCalendar 0.2.3 - 'eventdisplay.php' SQL Injection

CVE-2007-3519—webappsphp

SQL injection vulnerability in eventdisplay.php in phpEventCalendar 0.2.3 and earlier allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Filiale 1.0.4 - 'idFiliale' SQL Injection

CVE-2008-1935—webappsphp

SQL injection vulnerability in the Filiale 1.0.4 component for Joomla! allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

zKup CMS 2.0 < 2.3 - Remote Add Admin

CVE-2008-7124—webappsphp

zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allo

23RISK

open ↗

Referência✓ VexDay Proof

ArcadeBuilder Game Portal Manager 1.7 - SQL Injection

CVE-2007-3521—webappsphp

SQL injection vulnerability in ArcadeBuilder Game Portal Manager 1.7 allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

W1L3D4 philboard 1.0 - 'philboard_reply.asp' SQL Injection

CVE-2008-1939—webappsasp

Multiple SQL injection vulnerabilities in W1L3D4 Philboard 1.0 allow remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

ZZ FlashChat 3.1 - 'help.php' Local File Inclusion

CVE-2007-5620—webappsphp

Directory traversal vulnerability in admin/inc/help.php in ZZ:FlashChat 3.1 and earlier allows remote attackers to inclu

23RISK

open ↗

Referência✓ VexDay Proof

QNX Neutrino 0.8.4 Atomic Edition - Remote Code Execution

CVE-2008-3150—webappsphp

Directory traversal vulnerability in index.php in Neutrino Atomic Edition 0.8.4 allows remote attackers to read and modi

23RISK

open ↗

Referência✓ VexDay Proof

LightNEasy 1.2 - no database Remote Hash Retrieve

CVE-2008-6537—webappsphp

LightNEasy/lightneasy.php in LightNEasy No database version 1.2 allows remote attackers to obtain the hash of the admini

23RISK

open ↗

Referência✓ VexDay Proof

phosheezy 2.0 - Remote Command Execution

CVE-2009-0250—webappsphp

Ryneezy phoSheezy 0.2 stores sensitive information under the web root with insufficient access control, which allows rem

23RISK

open ↗

Referência✓ VexDay Proof

b1gbb 2.24.0 - SQL Injection / Cross-Site Scripting

CVE-2007-3589—webappsphp

Multiple SQL injection vulnerabilities in b1gbb 2.24.0 allow remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência✓ VexDay Proof

E RESERV 2.1 - 'index.php' SQL Injection

CVE-2008-1975—webappsphp

SQL injection vulnerability in index.php in E-RESERV 2.1 allows remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência✓ VexDay Proof

CodeAvalanche FreeForum - Database Disclosure

CVE-2008-5932—webappsasp

CodeAvalanche FreeForum stores sensitive information under the web root with insufficient access control, which allows r

23RISK

open ↗

Referência✓ VexDay Proof

OraMon 2.0.1 - Remote Configuration File Disclosure

CVE-2008-6869—webappsphp

Oramon Oracle Database Monitoring Tool 2.0.1 stores sensitive information under the web root with insufficient access co

23RISK

open ↗

Referência✓ VexDay Proof

EkinBoard 1.1.0 - Arbitrary File Upload / Authentication Bypass

CVE-2008-7157—webappsphp

Unrestricted file upload vulnerability in EkinBoard 1.1.0 and earlier allows remote attackers to execute arbitrary code

23RISK

open ↗

Referência✓ VexDay Proof

Pinnacle Studio 12 - '.hfz' Directory Traversal

CVE-2009-1743—localwindows

Directory traversal vulnerability in InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Syst

23RISK

open ↗

Referência✓ VexDay Proof

Acidcat CMS 3.4.1 - Multiple Vulnerabilities

CVE-2008-1991—webappsphp

Cross-site scripting (XSS) vulnerability in admin_colors_swatch.asp in Acidcat CMS 3.4.1 allows remote attackers to inje

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.