Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,137cataloged exploits

35,961CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,458Referência 22,657GitHub PoC 14,424VulnCheck XDB 8,773Nuclei 4,340Metasploit 3,485✓ verified onlyrecent popular risk

22,640 exploits

Referência✓ VexDay Proof

PHP Photo Gallery 1.0 - 'photo_id' SQL Injection

CVE-2008-1711—webappsphp

Terong PHP Photo Gallery (aka Advanced Web Photo Gallery) 1.0 stores passwords in cleartext in a MySQL database, which a

23RISK

open ↗

Referência

CVE-2018-0894

CVE-2018-0894—

The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve

23RISK

open ↗

Referência

CVE-2018-11442

CVE-2018-11442—

A CSRF issue was discovered in EasyService Billing 1.0, which was triggered via a quotation-new3-new2.php?add=true&id= U

23RISK

open ↗

Referência

CVE-2020-15149

CVE-2020-15149CRITICAL

Account takeover in NodeBB

48RISK

open ↗

Referência

CVE-2012-2437

CVE-2012-2437—

cookie_gen.php in ar web content manager (AWCM) 2.2 does not require authentication, which allows remote attackers to ge

23RISK

open ↗

Referência

CVE-2019-1170

CVE-2019-1170HIGH

Windows NTFS Elevation of Privilege Vulnerability

41RISK

open ↗

Referência

CVE-2013-0803

CVE-2013-0803—

A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a malicious user execute arb

60RISK

open ↗

Referência

CVE-2010-1740

CVE-2010-1740—

SQL injection vulnerability in newsletter.php in GuppY 4.5.18 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2010-1740

CVE-2010-1740—

SQL injection vulnerability in newsletter.php in GuppY 4.5.18 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2017-14618

CVE-2017-14618—

Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject

23RISK

open ↗

Referência✓ VexDay Proof

Cartweaver 3 - 'prodId' Blind SQL Injection

CVE-2008-2918—webappsphp

SQL injection vulnerability in details.php in Application Dynamics Cartweaver 3.0 allows remote attackers to execute arb

23RISK

open ↗

Referência

CVE-2019-0555

CVE-2019-0555—

An elevation of privilege vulnerability exists in the Microsoft XmlDocument class that could allow an attacker to escape

23RISK

open ↗

Referência✓ VexDay Proof

WebAlbum 2.02pl - COOKIE[skin2] Remote Code Execution

CVE-2006-1480—webappsphp

Directory traversal vulnerability in start.php in WebAlbum 2.02 allows remote attackers to include arbitrary files and e

23RISK

open ↗

Referência✓ VexDay Proof

PHP Ticket 0.71 - 'search.php' SQL Injection

CVE-2006-1481—webappsphp

SQL injection vulnerability in search.php in PHP Ticket 0.71 allows remote authenticated users to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2013-0803

CVE-2013-0803—

A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a malicious user execute arb

60RISK

open ↗

Referência✓ VexDay Proof

iWare Pro 5.0.4 - 'chat_panel.php' Remote Code Execution

CVE-2006-5837—webappsphp

Static code injection vulnerability in chat_panel.php in the SimpleChat 1.0.0 module for iWare Professional CMS allows r

23RISK

open ↗

Referência✓ VexDay Proof

TorrentFlux 2.2 - 'downloaddetails.php' Local File Disclosure

CVE-2006-6598—webappsphp

Directory traversal vulnerability in viewnfo.php in (1) TorrentFlux before 2.2 and (2) torrentflux-b4rt before 2.1-b4rt-

23RISK

open ↗

Referência✓ VexDay Proof

NewsCMSLite - 'newsCMS.mdb' Remote Password Disclosure

CVE-2007-0091—webappsasp

newsCMSlite stores sensitive information under the web root with insufficient access control, which allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

Pakupaku CMS 0.4 - Arbitrary File Upload / Local File Inclusion

CVE-2007-4640—webappsphp

Unrestricted file upload vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to upload an

23RISK

open ↗

Referência

CVE-2010-2860

CVE-2010-2860—

The EMC Celerra Network Attached Storage (NAS) appliance accepts external network traffic to IP addresses intended for a

23RISK

open ↗

Referência

CVE-2015-4137

CVE-2015-4137—

SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2015-4137

CVE-2015-4137—

SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2012-1027

CVE-2012-1027—

Cross-site scripting (XSS) vulnerability in account-closed.tcl in ]project-open[ (aka ]po[) 3.4.x, 3.5.0.1-2, and possib

23RISK

open ↗

Referência

CVE-2018-1204

CVE-2018-1204—

Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, an

23RISK

open ↗

Referência✓ VexDay Proof

Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal (PoC)

CVE-2008-2938—remotemultiple

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16,

60RISK

open ↗

Referência

CVE-2015-1400

CVE-2015-1400—

SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

Cahier de texte 2.2 - Bypass General Access Protection

CVE-2006-6849—webappsphp

administration/index.php in Cahier de texte (CDT) 2.2 does not properly exit when authentication fails, which allows rem

23RISK

open ↗

Referência✓ VexDay Proof

Shop-Script FREE 2.0 - Remote Command Execution

CVE-2007-4933—webappsphp

Direct static code injection vulnerability in includes/admin/sub/conf_appearence.php in Shop-Script FREE 2.0 and earlier

23RISK

open ↗

Referência✓ VexDay Proof

iziContents rc6 - Local/Remote File Inclusion

CVE-2007-5055—webappsphp

Multiple directory traversal vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to include and exec

23RISK

open ↗

Referência✓ VexDay Proof

Flat PHP Board 1.2 - Multiple Vulnerabilities

CVE-2007-6396—webappsphp

Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inj

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.