Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,794cataloged exploits

36,057CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,459Referência 22,721GitHub PoC 14,946VulnCheck XDB 8,829Nuclei 4,350Metasploit 3,489✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

PHP Forge 3 Beta 2 - 'id' SQL Injection

CVE-2008-2088—webappsphp

SQL injection vulnerability in admin/news.php in PHP Forge 3.0 beta 2 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component FlippingBook 1.0.4 - SQL Injection

CVE-2008-2095—webappsphp

SQL injection vulnerability in index.php in the FlippingBook (com_flippingbook) 1.0.4 component for Joomla! allows remot

23RISK

open ↗

Referência✓ VexDay Proof

BackLinkSpider 1.1 - 'cat_id' SQL Injection

CVE-2008-2096—webappsphp

SQL injection vulnerability in BackLinkSpider allows remote attackers to execute arbitrary SQL commands via the cat_id p

23RISK

open ↗

Referência✓ VexDay Proof

Psi Jabber Client (Windows / Linux) - Remote Denial of Service

CVE-2008-6393—dosmultiple

PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitr

28RISK

open ↗

Referência✓ VexDay Proof

Pre Shopping Mall 1.1 - 'search.php' SQL Injection

CVE-2008-2114—webappsphp

SQL injection vulnerability in emall/search.php in Pre Shopping Mall 1.1 allows remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência✓ VexDay Proof

Power Editor 2.0 - Remote File Disclosure / Edit

CVE-2008-2115—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in editor.php in ScriptsEZ.net Power Editor 2.0 allow remote attacke

23RISK

open ↗

Referência✓ VexDay Proof

MusicBox 2.3.7 - 'artistId' SQL Injection

CVE-2008-2125—webappsphp

SQL injection vulnerability in viewalbums.php in Musicbox 2.3.6 and 2.3.7 allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

Galleristic 1.0 - 'cat' SQL Injection

CVE-2008-2129—webappsphp

SQL injection vulnerability in index.php in Galleristic 1.0, when magic_quotes_gpc is disabled, allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

PostcardMentor - 'cat_fldAuto' SQL Injection

CVE-2008-2132—webappsasp

SQL injection vulnerability in step1.asp in Systementor PostcardMentor allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

BlogMe PHP 1.1 - 'comments.php' SQL Injection

CVE-2008-2175—webappsphp

SQL injection vulnerability in comments.php in Gamma Scripts BlogMe PHP 1.1 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Cplinks 1.03 - Authentication Bypass / SQL Injection / Cross-Site Scripting

CVE-2008-2180—webappsphp

Multiple SQL injection vulnerabilities in cpLinks 1.03, when magic_quotes_gpc is disabled, allow remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

Online Rental Property Script 4.5 - 'pid' SQL Injection

CVE-2008-2190—webappsphp

SQL injection vulnerability in index.php in Online Rent (aka Online Rental Property Script) 4.5 and earlier allows remot

23RISK

open ↗

Referência✓ VexDay Proof

PostNuke Module pnEncyclopedia 0.2.0 - SQL Injection

CVE-2008-2191—webappsphp

SQL injection vulnerability in the pnEncyclopedia module 0.2.0 and earlier for PostNuke allows remote attackers to execu

23RISK

open ↗

Referência✓ VexDay Proof

ScorpNews 1.0 - 'site' Remote File Inclusion

CVE-2008-2193—webappsphp

PHP remote file inclusion vulnerability in example.php in Thomas Gossmann ScorpNews 2.0 allows remote attackers to execu

23RISK

open ↗

Referência✓ VexDay Proof

Miniweb 2.0 - 'historymonth' SQL Injection

CVE-2008-2197—webappsphp

SQL injection vulnerability in the blogwriter module 2.0 for Miniweb allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

Kmita Mail 3.0 - 'file' Remote File Inclusion

CVE-2008-2199—webappsphp

PHP remote file inclusion vulnerability in kmitaadmin/kmitam/htmlcode.php in Kmita Mail 3.0 and earlier, when register_g

23RISK

open ↗

Referência✓ VexDay Proof

Project Based Calendaring System (PBCS) 0.7.1 - Multiple Vulnerabilities

CVE-2008-2216—webappsphp

Unrestricted file upload vulnerability in src/yopy_upload.php in Project-Based Calendaring System (PBCS) 0.7.1 allows re

23RISK

open ↗

Referência✓ VexDay Proof

Content Management System for Phprojekt 0.6.1 - File Disclosure

CVE-2008-2217—webappsphp

Directory traversal vulnerability in cm/graphie.php in Content Management System 0.6.1 for Phprojekt allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

CodeDB 1.1.1 - 'list.php' Local File Inclusion

CVE-2008-3190—webappsphp

Directory traversal vulnerability in list.php in 1Scripts CodeDB 1.1.1 allows remote attackers to include and execute ar

23RISK

open ↗

Referência✓ VexDay Proof

jsite 1.0 oe - SQL Injection / Local File Inclusion

CVE-2008-3193—webappsphp

SQL injection vulnerability in jSite 1.0 OE allows remote attackers to execute arbitrary SQL commands via the page param

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Windows - InternalOpenColorProfile Heap Overflow (PoC) (MS08-046)

CVE-2008-2245—doswindows

Heap-based buffer overflow in the InternalOpenColorProfile function in mscms.dll in Microsoft Windows Image Color Manage

35RISK

open ↗

Referência✓ VexDay Proof

JETIK-WEB Software - 'kat' SQL Injection

CVE-2008-6401—webappsphp

SQL injection vulnerability in sayfa.php in JETIK-WEB allows remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência✓ VexDay Proof

OpenRat 0.8-beta4 - 'tpl_dir' Remote File Inclusion

CVE-2008-6403—webappsphp

PHP remote file inclusion vulnerability in themes/default/include/html/insert.inc.php in OpenRat 0.8-beta4 and earlier a

23RISK

open ↗

Referência✓ VexDay Proof

Linkspile - 'cat_id' SQL Injection

CVE-2008-2263—webappsphp

SQL injection vulnerability in linking.page.php in Automated Link Exchange Portal allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

Kostenloses Linkmanagementscript - Remote File Inclusion

CVE-2008-2270—webappsphp

Multiple PHP remote file inclusion vulnerabilities in PHPWAY Kostenloses Linkmanagementscript allow remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

Feedback and Rating Script 1.0 - 'detail.php' SQL Injection

CVE-2008-2277—webappsphp

SQL injection vulnerability in detail.php in Feedback and Rating Script 1.0 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Miplex2 - 'SmartyFU.class.php' Remote File Inclusion

CVE-2007-2608—webappsphp

PHP remote file inclusion vulnerability in lib/smarty/SmartyFU.class.php in Miplex2 Alpha 1 allows remote attackers to e

23RISK

open ↗

Referência✓ VexDay Proof

PHPLojaFacil 0.1.5 - 'path_local' Remote File Inclusion

CVE-2007-2615—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Crie seu PHPLojaFacil 0.1.5 allow remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

Original 0.11 - 'config.inc.php?x[1]' Remote File Inclusion

CVE-2007-2620—webappsphp

PHP remote file inclusion vulnerability in inc/config.inc.php in Jakub Steiner (aka jimmac) original 0.11 allows remote

23RISK

open ↗

Referência✓ VexDay Proof

Snaps! Gallery 1.4.4 - Remote User Pass Change

CVE-2007-2715—webappsphp

Admin/users.php in Snaps! Gallery 1.4.4 allows remote attackers to change arbitrary usernames and passwords via the (1)

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.