Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,035cataloged exploits

39,531CVEs with public exploitation

24,695lab-tested

All Referência 25,557Exploit-DB 24,485GitHub PoC 16,313VulnCheck XDB 9,678Nuclei 4,478Metasploit 3,524✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

OneCMS 2.4 - SQL Injection / Upload

CVE-2008-7209—webappsphp

Unrestricted file upload vulnerability in the add2 action in a_upload.php in OneCMS 2.4, and possibly earlier, allows re

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Works 7 - 'WkImgSrv.dll' ActiveX Denial of Service (PoC)

CVE-2008-1898—doswindows

A certain ActiveX control in WkImgSrv.dll 7.03.0616.0, as distributed in Microsoft Works 7 and Microsoft Office 2003 and

50RISK

open ↗

Referência✓ VexDay Proof

pNews 2.08 - 'shownews' SQL Injection

CVE-2008-2673—webappsphp

SQL injection vulnerability in index.php in Powie pNews 2.08 and 2.10, when magic_quotes_gpc is disabled, allows remote

23RISK

open ↗

Referência✓ VexDay Proof

Vastal I-Tech Toner Cart - 'id' SQL Injection

CVE-2008-4467—webappsphp

SQL injection vulnerability in show_series_ink.php in Vastal I-Tech Toner Cart allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Oceandir 2.9 - 'show_vote.php' SQL Injection

CVE-2008-6452—webappsphp

SQL injection vulnerability in show_vote.php in Oceandir 2.9 and earlier allows remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência✓ VexDay Proof

Morovia Barcode ActiveX Professional 3.3.1304 - Arbitrary File Overwrite

CVE-2007-2644—remotewindows

A certain ActiveX control in Morovia Barcode ActiveX Professional 3.3.1304 allows remote attackers to overwrite arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

Beacon 0.2.0 - 'splash.lang.php' Remote File Inclusion

CVE-2007-2663—webappsphp

PHP remote file inclusion vulnerability in language/1/splash.lang.php in Beacon 0.2.0 allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

Achievo 1.1.0 - 'config_atkroot' Remote File Inclusion

CVE-2007-2736—webappsphp

PHP remote file inclusion vulnerability in index.php in Achievo 1.1.0 allows remote attackers to execute arbitrary PHP c

23RISK

open ↗

Referência✓ VexDay Proof

PreProject Multi-Vendor Shopping Malls - Multiple Vulnerabilities

CVE-2008-6227—webappsphp

SQL injection vulnerability in buyer_detail.php in Pre Multi-Vendor Shopping Malls allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

Mumbo Jumbo Media OP4 - Blind SQL Injection

CVE-2008-6477—webappsphp

SQL injection vulnerability in Mumbo Jumbo Media OP4 allows remote attackers to execute arbitrary SQL commands via the i

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Internet Explorer 7 - Memory Corruption (MS09-002)

CVE-2009-0075—remotewindows

Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows r

60RISK

open ↗

Referência✓ VexDay Proof

RiotPix 0.61 - Authentication Bypass

CVE-2009-0109—webappsphp

SQL injection vulnerability in index.php in RiotPix 0.61 and earlier allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

VUPlayer 2.49 - '.asx' HREF Local Buffer Overflow (1)

CVE-2009-0174—localwindows

Stack-based buffer overflow in VUPlayer 2.49 allows remote attackers to execute arbitrary code via a long .asf URI in th

28RISK

open ↗

Referência✓ VexDay Proof

VUPlayer 2.49 - '.asx' HREF Local Buffer Overflow (2)

CVE-2009-0174—localwindows

Stack-based buffer overflow in VUPlayer 2.49 allows remote attackers to execute arbitrary code via a long .asf URI in th

28RISK

open ↗

Referência✓ VexDay Proof

TutorialCMS 1.01 - Authentication Bypass

CVE-2007-2822—webappsphp

TutorialCMS 1.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication via the

23RISK

open ↗

Referência✓ VexDay Proof

IP Reg 0.4 - Blind SQL Injection

CVE-2008-4523—webappsphp

SQL injection vulnerability in login.php in IP Reg 0.4 and earlier allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

TROforum 0.1 - 'admin.php?site_url' Remote File Inclusion

CVE-2007-2937—webappsphp

PHP remote file inclusion vulnerability in admin/admin.php in TROforum 0.1 allows remote attackers to execute arbitrary

35RISK

open ↗

Referência✓ VexDay Proof

Rankem - File Disclosure / Cross-Site Scripting / Cookie

CVE-2009-0249—webappsphp

Katy Whitton RankEm stores sensitive information under the web root with insufficient access control, which allows remot

23RISK

open ↗

Referência✓ VexDay Proof

Jadu Galaxies - 'categoryId' Blind SQL Injection

CVE-2008-6254—webappsphp

SQL injection vulnerability in scripts/documents.php in Jadu Galaxies allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

MatPo Link 1.2b - SQL Injection

CVE-2008-6606—webappsphp

SQL injection vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

Wazzum Dating Software - 'userid' SQL Injection

CVE-2009-0293—webappsphp

SQL injection vulnerability in profile_view.php in Wazzum Dating Software, possibly 2.0, allows remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

Script Toko Online 5.01 - SQL Injection

CVE-2009-0296—webappsphp

SQL injection vulnerability in shop_display_products.php in Script Toko Online 5.01 allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

ClickAuction - Authentication Bypass

CVE-2009-0297—webappsphp

SQL injection vulnerability in login_check.asp in ClickAuction allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

Pheap 2.0 - Authentication Bypass / Remote Code Execution

CVE-2007-2985—webappsphp

Pheap 2.0 allows remote attackers to bypass authentication by setting a pheap_login cookie value to the administrator's

23RISK

open ↗

Referência✓ VexDay Proof

Ninja Blog 4.8 - Remote Information Disclosure

CVE-2009-0325—webappsphp

Directory traversal vulnerability in entries/index.php in Ninja Blog 4.8, when magic_quotes_gpc is disabled, allows remo

23RISK

open ↗

Referência✓ VexDay Proof

Macrovision FlexNet DownloadManager - Insecure Methods

CVE-2008-4587—remotewindows

Insecure method vulnerability in the MSVNClientDownloadManager61Lib.DownloadManager.1 ActiveX control (ISDM.exe 6.1.100.

28RISK

open ↗

Referência✓ VexDay Proof

Bluo CMS 1.2 - Blind SQL Injection

CVE-2008-6281—webappsphp

SQL injection vulnerability in index.php in Bluo CMS 1.2 allows remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência✓ VexDay Proof

z1exchange 1.0 - 'site' SQL Injection

CVE-2008-6284—webappsphp

SQL injection vulnerability in edit.php in Z1Exchange 1.0 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

WEBBDOMAIN Post Card 1.02 - 'catid' SQL Injection

CVE-2008-6622—webappsphp

SQL injection vulnerability in choosecard.php in WEBBDOMAIN Post Card (aka Web Postcards) 1.02, 1.01, and earlier allows

23RISK

open ↗

Referência✓ VexDay Proof

RoomPHPlanning 1.5 - Multiple SQL Injections

CVE-2008-6634—webappsphp

SQL injection vulnerability in RoomPHPlanning 1.5 allows remote attackers to execute arbitrary SQL commands via the idro

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.