Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,337cataloged exploits

39,873CVEs with public exploitation

24,696lab-tested

All Referência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

CitectSCADA ODBC Server - Remote Stack Buffer Overflow (Metasploit)

CVE-2008-2639—remotewindows

Stack-based buffer overflow in the ODBC server service in Citect CitectSCADA 6 and 7, and CitectFacilities 7, allows rem

60RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Com BazaarBuilder Shopping Cart 5.0 - SQL Injection

CVE-2009-0381—webappsphp

SQL injection vulnerability in the BazaarBuilder Ecommerce Shopping Cart (com_prod) 5.0 component for Joomla! allows rem

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Webring 1.0 - Remote File Inclusion

CVE-2006-4129—webappsphp

PHP remote file inclusion vulnerability in admin.webring.docs.php in the Webring Component (com_webring) 1.0 and earlier

23RISK

open ↗

Referência✓ VexDay Proof

Magic Photo Storage Website - '_config[site_path]' File Inclusion

CVE-2007-0181—webappsphp

PHP remote file inclusion vulnerability in include/common_function.php in magic photo storage website allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

Jshop Server 1.3 - 'fieldValidation.php' Remote File Inclusion

CVE-2007-0232—webappsphp

PHP remote file inclusion vulnerability in routines/fieldValidation.php in Jshop Server 1.3 allows remote attackers to e

23RISK

open ↗

Referência✓ VexDay Proof

Media Gallery for Geeklog 1.4.8a - Remote File Inclusion

CVE-2007-2706—webappsphp

PHP remote file inclusion vulnerability in maint/ftpmedia.php in Media Gallery 1.4.8a and earlier for Geeklog allows rem

23RISK

open ↗

Referência✓ VexDay Proof

TotalCalendar 2.402 - 'view_event.php' SQL Injection

CVE-2007-3515—webappsphp

SQL injection vulnerability in view_event.php in TotalCalendar 2.402 and earlier allows remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

Nortel SSL VPN Linux Client 6.0.3 - Local Privilege Escalation

CVE-2007-1057—locallinux

The Net Direct client for Linux before 6.0.5 in Nortel Application Switch 2424, VPN 3050 and 3070, and SSL VPN Module 10

23RISK

open ↗

Referência✓ VexDay Proof

Pagode 0.5.8 - 'navigator_ok.php?asolute' Remote File Disclosure

CVE-2007-2200—webappsphp

Directory traversal vulnerability in navigator/navigator_ok.php in Pagode 0.5.8 allows remote attackers to read and poss

28RISK

open ↗

Referência✓ VexDay Proof

YourFreeScreamer 1.0 - 'serverPath' Remote File Inclusion

CVE-2007-3271—webappsphp

PHP remote file inclusion vulnerability in templates/2blue/bodyTemplate.php in YourFreeScreamer 1.0 allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

BoastMachine 3.1 - 'mail.php' id SQL Injection

CVE-2008-0422—webappsphp

SQL injection vulnerability in mail.php in boastMachine (aka bMachine) 3.1 and earlier allows remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

Community CMS 0.4 - 'id' Blind SQL Injection

CVE-2009-0406—webappsphp

SQL injection vulnerability in index.php in Community CMS 0.4 and earlier allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

MyBulletinBoard (MyBB) 1.2.5 - 'calendar.php' Blind SQL Injection

CVE-2007-2211—webappsphp

SQL injection vulnerability in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allows remote attackers to e

23RISK

open ↗

Referência✓ VexDay Proof

DMXReady Classified Listings Manager 1.1 - SQL Injection

CVE-2009-0426—webappsasp

SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Classified Listings Manager 1.1 and

23RISK

open ↗

Referência✓ VexDay Proof

MyDesing Sayac 2.0 - Authentication Bypass

CVE-2009-0447—webappsasp

Multiple SQL injection vulnerabilities in default.asp in MyDesign Sayac 2.0 allow remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

phpBB Module NoMoKeTos Rules 0.0.1 - Remote File Inclusion

CVE-2007-1106—webappsphp

PHP remote file inclusion vulnerability in includes/functions_nomoketos_rules.php in the NoMoKeTos Rules 0.0.1 module fo

23RISK

open ↗

Referência✓ VexDay Proof

PUMA 1.0 RC 2 - 'config.php' Remote File Inclusion

CVE-2006-4713—webappsphp

PHP remote file inclusion vulnerability in config.php in PSYWERKS PUMA 1.0 RC2 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Segue CMS 1.5.8 - 'themesdir' Remote File Inclusion

CVE-2006-5497—webappsphp

PHP remote file inclusion vulnerability in themes/program/themesettings.inc.php in Segue CMS 1.5.8 and earlier, when reg

23RISK

open ↗

Referência✓ VexDay Proof

a-ConMan 3.2b - 'common.inc.php' Remote File Inclusion

CVE-2006-6078—webappsphp

PHP remote file inclusion vulnerability in common.inc.php in a-ConMan 3.2 beta allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Windows Vista - Access Violation from Limited Account (Blue Screen of Death)

CVE-2008-4510—doswindows

Microsoft Windows Vista Home and Ultimate Edition SP1 and earlier allows local users to cause a denial of service (page

23RISK

open ↗

Referência✓ VexDay Proof

Zeeways PHOTOVIDEOTUBE 1.1 - Authentication Bypass

CVE-2008-5042—webappsphp

Zeeways PhotoVideoTube 1.1 and earlier allows remote attackers to bypass authentication and perform administrative tasks

23RISK

open ↗

Referência✓ VexDay Proof

BlazeVideo HDTV Player 3.5 - '.PLF' Playlist File Local Overflow

CVE-2009-0450—localwindows

Stack-based buffer overflow in BlazeVideo HDTV Player 3.5 and earlier allows remote attackers to execute arbitrary code

28RISK

open ↗

Referência✓ VexDay Proof

QK SMTP 3.01 - 'RCPT TO' Remote Denial of Service

CVE-2006-5551—doswindows

Stack-based buffer overflow in QK SMTP 3.01 and earlier might allow remote attackers to execute arbitrary code via a lon

23RISK

open ↗

Referência✓ VexDay Proof

Ultimate PHP Board 2.0 - 'header_simple.php' File Inclusion

CVE-2006-7169—webappsphp

PHP remote file inclusion vulnerability in includes/header_simple.php in Ultimate PHP Board (UPB) 2.0 and earlier allows

23RISK

open ↗

Referência✓ VexDay Proof

Papoo 3.02 - kontakt menuid SQL Injection

CVE-2007-2320—webappsphp

SQL injection vulnerability in kontakt.php in Papoo 3.02 and earlier allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

E-Smart Cart - 'productsofcat.asp' SQL Injection

CVE-2008-2917—webappsasp

SQL injection vulnerability in productsofcat.asp in E-SMART CART allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

phpBLASTER CMS 1.0 RC1 - Multiple Local File Inclusions

CVE-2008-5171—webappsphp

Multiple directory traversal vulnerabilities in admin/minibb/index.php in phpBLASTER CMS 1.0 RC1, when register_globals

23RISK

open ↗

Referência✓ VexDay Proof

KVIrc 3.4.2 Shiny - URI handler Remote Command Execution

CVE-2008-7070—remotewindows

Argument injection vulnerability in the URI handler in KVIrc 3.4.2 Shiny allows remote attackers to execute arbitrary co

23RISK

open ↗

Referência✓ VexDay Proof

groone's Guestbook 2.0 - Remote File Inclusion

CVE-2009-0464—webappsphp

PHP remote file inclusion vulnerability in includes/header.php in Groone GBook 2.0 allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

Extcalendar 2 - 'profile.php' Remote User Pass Change

CVE-2007-0681—webappsphp

profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrary users without prov

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.