Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Forest Blog 1.3.2 - Remote Database Disclosure
CVE-2008-5780—webappsasp
Forest Blog 1.3.2 stores sensitive information under the web root with insufficient access control, which allows remote
23RISK
open ↗
Referência✓ VexDay Proof
ASP AutoDealer - Remote Database Disclosure
CVE-2008-5608—webappsasp
ASP AutoDealer stores sensitive information under the web root with insufficient access control, which allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
Enthrallweb eNews 1.0 - Remote User Pass Change
CVE-2006-6821—webappsasp
myprofile.asp in Enthrallweb eNews does not properly validate the MM_recordId parameter during profile updates, which al
23RISK
open ↗
Referência✓ VexDay Proof
Poppler 0.8.4 - libpoppler Uninitialized pointer Code Execution
CVE-2008-2950—locallinux
The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not
28RISK
open ↗
Referência✓ VexDay Proof
PHP TV Portal 2.0 - 'mid' SQL Injection
CVE-2008-6285—webappsphp
SQL injection vulnerability in index.php in PHP TV Portal 2.0 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
ASPTicker 1.0 - Remote Database Disclosure
CVE-2008-5603—webappsasp
ASPTicker 1.0 stores sensitive information under the web root with insufficient access control, which allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
PHPTest 0.6.3 - SQL Injection
CVE-2008-3377—webappsphp
SQL injection vulnerability in picture.php in phpTest 0.6.3 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
User Engine Lite ASP - 'users.mdb' Database Disclosure
CVE-2008-5601—webappsphp
User Engine Lite ASP stores sensitive information under the web root with insufficient access control, which allows remo
23RISK
open ↗
Referência✓ VexDay Proof
AJ Auction Web 2.0 - 'cate_id' SQL Injection
CVE-2008-2860—webappsphp
SQL injection vulnerability in category.php in AJSquare AJ Auction Pro web 2.0 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Fusion Mod Classifieds - 'lid' SQL Injection
CVE-2008-5197—webappsphp
SQL injection vulnerability in classifieds.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Recipes Complete Website 1.1.14 - SQL Injection
CVE-2006-6220—webappsphp
Multiple SQL injection vulnerabilities in Recipes Website (Recipes Complete Website) 1.1.14 allow remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
MyMarket 1.72 - Blind SQL Injection
CVE-2008-2815—webappsphp
SQL injection vulnerability in shopping/index.php in MyMarket 1.72 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component VirtueMart Google Base 1.1 - Remote File Inclusion
CVE-2008-6483—webappsphp
PHP remote file inclusion vulnerability in admin.googlebase.php in the Ecom Solutions VirtueMart Google Base (aka com_go
35RISK
open ↗
Referência✓ VexDay Proof
Gforge 4.6 rc1 - 'skill_edit' SQL Injection
CVE-2008-6188—webappsphp
SQL injection vulnerability in people/editprofile.php in Gforge 4.6 rc1 and earlier allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
zeeproperty 1.0 - Arbitrary File Upload / Cross-Site Scripting
CVE-2008-6915—webappsphp
Cross-site scripting (XSS) vulnerability in view_prop_details.php in Zeeways ZEEPROPERTY 1.0 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
phpPgAdmin 4.2.1 - '_language' Local File Inclusion
CVE-2008-5587—webappsphp
Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is ena
43RISK
open ↗
Referência✓ VexDay Proof
lcxbbportal 0.1 alpha 2 - Remote File Inclusion
CVE-2008-5585—webappsphp
Multiple PHP remote file inclusion vulnerabilities in lcxBBportal 0.1 Alpha 2 allow remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
RevokeBB 1.0 RC11 - 'Search' SQL Injection
CVE-2008-2778—webappsphp
SQL injection vulnerability in inc/class_search.php in the Search System in RevokeBB 1.0 RC11 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
MailEnable 3.13 SMTP Service - 'VRFY/EXPN' Denial of Service
CVE-2008-1275—doswindows
Multiple unspecified vulnerabilities in the SMTP service in MailEnable Standard Edition 1.x, Professional Edition 3.x an
23RISK
open ↗
Referência✓ VexDay Proof
LoCal Calendar 1.1 - 'lcUser.php' Remote File Inclusion
CVE-2006-5426—webappsphp
PHP remote file inclusion vulnerability in lib/lcUser.php in LoCal Calendar System 1.1 remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
PHP Net Tools 2.7.1 - Remote Code Execution
CVE-2006-1921—webappsphp
nettools.php in PHP Net Tools 2.7.1 allows remote attackers to execute arbitrary commands via shell metacharacters in th
23RISK
open ↗
Referência✓ VexDay Proof
Drake CMS 0.4.11 - Blind SQL Injection
CVE-2008-6475—webappsphp
SQL injection vulnerability in the guestbook component (components/guestbook/guestbook.php) in Drake CMS 0.4.11 and earl
23RISK
open ↗
Referência✓ VexDay Proof
Todd Woolums ASP News Management 2.2 - SQL Injection
CVE-2008-5273—webappsasp
SQL injection vulnerability in viewnews.asp in Todd Woolums ASP News Management 2.2 allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
LiteNews 0.1 - 'id' SQL Injection
CVE-2008-3507—webappsphp
SQL injection vulnerability in index.php in LiteNews 0.1 (aka 01), and possibly 1.2 and earlier, allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Mobius 1.4.4.1 - SQL Injection
CVE-2008-3420—webappsphp
Multiple SQL injection vulnerabilities in Mobius for Mimsy XG 1 1.4.4.1 and earlier allow remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
e107 Plugin Image Gallery 0.9.6.2 - SQL Injection
CVE-2008-6466—webappsphp
SQL injection vulnerability in image_gallery.php in the Akira Powered Image Gallery (image_gallery) plugin 0.9.6.2 for e
23RISK
open ↗
Referência✓ VexDay Proof
Camera Life 2.6.2b4 - SQL Injection / Cross-Site Scripting
CVE-2008-6086—webappsphp
SQL injection vulnerability in album.php in Camera Life 2.6.2b4 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
SyndeoCMS 2.6.0 - Local File Inclusion / Cross-Site Scripting
CVE-2008-5271—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Fred Stuurman SyndeoCMS 2.6.0 allows remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
Yuhhu 2008 SuperStar - 'board' SQL Injection
CVE-2008-5270—webappsphp
SQL injection vulnerability in view.topics.php in Yuhhu Superstar 2008 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Scripts24 iTGP 1.0.4 - 'id' SQL Injection
CVE-2008-3491—webappsphp
SQL injection vulnerability in go.php in Scripts24 iPost 1.0.1 and iTGP 1.0.4 allows remote attackers to execute arbitra
23RISK
open ↗
← previouspage 638 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.