Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,331cataloged exploits

40,631CVEs with public exploitation

24,696lab-tested

All Referência 26,377Exploit-DB 24,489GitHub PoC 18,131VulnCheck XDB 10,218Nuclei 4,577Metasploit 3,539✓ verified onlyrecent popular risk

26,327 exploits

Referência✓ VexDay Proof

BaoFeng - ActiveX 'OnBeforeVideoDownload()' Remote Buffer Overflow

CVE-2009-1612—remotewindows

Stack-based buffer overflow in the MPS.StormPlayer.1 ActiveX control in mps.dll 3.9.4.27 in Baofeng Storm allows remote

50RISK

open ↗

Referência

CVE-2010-4638

CVE-2010-4638—

SQL injection vulnerability in the submitSurvey function in controller.php in JQuarks4s (com_jquarks4s) component 1.0.0

23RISK

open ↗

Referência

CVE-2010-4701

CVE-2010-4701—

Heap-based buffer overflow in the CDrawPoly::Serialize function in fxscover.exe in Microsoft Windows Fax Services Cover

35RISK

open ↗

Referência

CVE-2010-4735

CVE-2010-4735—

SQL injection vulnerability in shoppingcart.asp in Ecommercemax Solutions Digital-goods seller (DGS) 1.5 allows remote a

23RISK

open ↗

Referência

CVE-2019-15107

CVE-2019-15107CRITICALunder attackransomware

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RISK

open ↗

Referência✓ VexDay Proof

ashNews 0.83 - 'pathtoashnews' Remote File Inclusion

CVE-2003-1292—webappsphp

PHP remote file include vulnerability in Derek Ashauer ashNews 0.83 allows remote attackers to include and execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

CCProxy 6.2 - 'ping' Remote Buffer Overflow

CVE-2004-2685—remotewindows

Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long addre

28RISK

open ↗

Referência✓ VexDay Proof

Ax Developer CMS 0.1.1 - 'index.php?module' Local File Inclusion

CVE-2007-5820—webappsphp

Directory traversal vulnerability in index.php in Ax Developer CMS (AxDCMS) 0.1.1 allows remote attackers to include and

23RISK

open ↗

Referência✓ VexDay Proof

SyndeoCMS 2.5.01 - 'cmsdir' Remote File Inclusion

CVE-2007-5840—webappsphp

PHP remote file inclusion vulnerability in starnet/themes/c-sky/main.inc.php in Fred Stuurman SyndeoCMS 2.5.01 allows re

23RISK

open ↗

Referência✓ VexDay Proof

Mega File Hosting Script 1.2 - 'fid' SQL Injection

CVE-2008-2521—webappsphp

SQL injection vulnerability in members.php in YABSoft Mega File Hosting Script (aka MFH or MFHS) 1.2 allows remote authe

23RISK

open ↗

Referência✓ VexDay Proof

phpAuction 3.2.1 - 'item.php' SQL Injection

CVE-2008-2900—webappsphp

SQL injection vulnerability in item.php in PHPAuction 3.2 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

GLLCTS2 - 'sort' Blind SQL Injection

CVE-2008-2919—webappsphp

SQL injection vulnerability in listing.php in Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component ArtForms 2.1 b7 - Remote File Inclusion

CVE-2009-1822—webappsphp

Multiple PHP remote file inclusion vulnerabilities in the InterJoomla ArtForms (com_artforms) component 2.1b7 for Joomla

23RISK

open ↗

Referência✓ VexDay Proof

Banner Management Script - 'id' SQL Injection

CVE-2008-3749—webappsphp

SQL injection vulnerability in tr.php in YourFreeWorld Banner Management Script allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

WEBBDOMAIN Quiz 1.02 - Authentication Bypass

CVE-2008-6626—webappsphp

SQL injection vulnerability in getin.php in WEBBDOMAIN Quiz 1.02 and earlier allows remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

Winamp 5.55 - MAKI script Universal Integer Overflow

CVE-2009-1831—localwindows

The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute

50RISK

open ↗

Referência

CVE-2010-4948

CVE-2010-4948—

PHP remote file inclusion vulnerability in libs/adodb/adodb.inc.php in PHP Free Photo Gallery script allows remote attac

23RISK

open ↗

Referência

CVE-2010-4959

CVE-2010-4959—

SQL injection vulnerability in the login feature in Pre Projects Pre Podcast Portal allows remote attackers to execute a

23RISK

open ↗

Referência

CVE-2010-4972

CVE-2010-4972—

SQL injection vulnerability in index.php in YPNinc JokeScript allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2019-16662

CVE-2019-16662—

An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to a

60RISK

open ↗

Referência

CVE-2019-16759

CVE-2019-16759CRITICALunder attack

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge

100RISK

open ↗

Referência✓ VexDay Proof

WebED 0.0.9 - 'index.php' Remote File Disclosure

CVE-2007-6213—webappsphp

Multiple directory traversal vulnerabilities in mod/chat/index.php in WebED 0.0.9 allow remote attackers to read arbitra

23RISK

open ↗

Referência

CVE-2021-34523

CVE-2021-34523CRITICALunder attackransomware

Microsoft Exchange Server Elevation of Privilege Vulnerability

100RISK

open ↗

Referência✓ VexDay Proof

Mcms Easy Web Make - 'index.php?template' Local File Inclusion

CVE-2007-6344—webappsphp

Directory traversal vulnerability in modules/cms/index.php in Mcms Easy Web Make 1.3, allows remote attackers to include

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component JoomRadio 1.0 - 'id' SQL Injection

CVE-2008-2633—webappsphp

Multiple SQL injection vulnerabilities in the EXP JoomRadio (com_joomradio) component 1.0 for Joomla! allow remote attac

23RISK

open ↗

Referência✓ VexDay Proof

BareNuked CMS 1.1.0 - Arbitrary Add Admin

CVE-2008-3133—webappsphp

SQL injection vulnerability in admin/index.php in BareNuked CMS 1.1.0, when magic_quotes_gpc is disabled, allows remote

23RISK

open ↗

Referência

CVE-2013-2010

CVE-2013-2010—

WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability

60RISK

open ↗

Referência

CVE-2013-2094

CVE-2013-2094HIGHunder attack

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data t

83RISK

open ↗

Referência✓ VexDay Proof

Active Bids 3.5 - 'itemID' Blind SQL Injection

CVE-2008-5640—webappsphp

SQL injection vulnerability in bidhistory.asp in Active Bids 3.5 allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

Kusaba 1.0.4 - Remote Code Execution (2)

CVE-2008-5663—webappsphp

Multiple unrestricted file upload vulnerabilities in Kusaba 1.0.4 and earlier allow remote authenticated users to execut

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.