Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
WebPortal CMS 0.8b - Multiple Local/Remote File Inclusions
CVE-2009-1444—webappsphp
PHP remote file inclusion vulnerability in indexk.php in WebPortal CMS 0.8-beta allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
eNetman 20050830 - 'index.php' Remote File Inclusion
CVE-2007-4712—webappsphp
PHP remote file inclusion vulnerability in index.php in eNetman 1 allows remote attackers to execute arbitrary PHP code
35RISK
open ↗
Referência✓ VexDay Proof
XAMPP 1.6.8 - Cross-Site Request Forgery (Change Administrative Password)
CVE-2008-6499—remotewindows
security/xamppsecurity.php in XAMPP 1.6.8 performs an extract operation on the SERVER superglobal array, which allows re
23RISK
open ↗
Referência✓ VexDay Proof
CMS little 0.0.1 - 'term' SQL Injection
CVE-2008-5628—webappsphp
SQL injection vulnerability in index.php in CMS little 0.0.1 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Bux.to Clone Script - Insecure Cookie Handling
CVE-2008-6162—webappsphp
Bux.to Clone script allows remote attackers to bypass authentication and gain administrative access by setting the logge
23RISK
open ↗
Referência✓ VexDay Proof
X-Forum 0.6.2 - Remote Command Execution
CVE-2009-1508—webappsphp
SQL injection vulnerability in the xforum_validateUser function in Common.php in X-Forum 0.6.2 allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
netForo! 0.1 - 'down.php?file_to_download' Remote File Disclosure
CVE-2007-1392—webappsphp
Directory traversal vulnerability in down.php in netForo! 0.1g allows remote attackers to read arbitrary files via a ..
23RISK
open ↗
Referência✓ VexDay Proof
AnyInventory 2.0 - 'Environment.php' Remote File Inclusion
CVE-2007-4744—webappsphp
PHP remote file inclusion vulnerability in environment.php in AnyInventory 1.9.1 and 2.0, when register_globals is enabl
35RISK
open ↗
Referência✓ VexDay Proof
Cobalt 0.1 - Multiple SQL Injections
CVE-2008-6202—webappsasp
SQL injection vulnerability in CoBaLT 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter
23RISK
open ↗
Referência✓ VexDay Proof
Coppermine Photo Gallery 1.4.9 - SQL Injection
CVE-2006-5622—webappsphp
SQL injection vulnerability in picmgr.php in Coppermine Photo Gallery 1.4.9 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows - '.doc' Malformed Pointers Denial of Service
CVE-2007-1347—doswindows
Microsoft Windows Explorer on Windows 2000 SP4 FR and XP SP2 FR, and possibly other versions and platforms, allows remot
35RISK
open ↗
Referência✓ VexDay Proof
PHP 'COM' Extensions - inconsistent Win32 'safe_mode' Bypass
CVE-2007-1382—localwindows
The PHP COM extensions for PHP on Windows systems allow context-dependent attackers to execute arbitrary code via a WScr
23RISK
open ↗
Referência✓ VexDay Proof
ABC Advertise 1.0 - Admin Password Disclosure
CVE-2009-1550—webappsphp
Zakkis Technology ABC Advertise 1.0 does not properly restrict access to admin.inc.php, which allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Mooseguy Blog System 1.0 - 'month' SQL Injection
CVE-2008-0424—webappsphp
SQL injection vulnerability in blog.php in Mooseguy Blog System (MGBS) 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
32bit FTP (09.04.24) - 'Banner' Remote Buffer Overflow (PoC)
CVE-2009-1592—doswindows_x86
Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a
23RISK
open ↗
Referência✓ VexDay Proof
EncapsCMS 0.3.6 - '/core/core.php' Remote File Inclusion
CVE-2006-5895—webappsphp
PHP remote file inclusion vulnerability in core/core.php in EncapsCMS 0.3.6 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Diesel Pay Script - 'area' SQL Injection
CVE-2008-6468—webappsphp
SQL injection vulnerability in index.php in Diesel Pay allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência✓ VexDay Proof
Roundcube Webmail 0.2-3 Beta - Code Execution
CVE-2008-5619—webappsphp
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail)
35RISK
open ↗
Referência✓ VexDay Proof
Pre Shopping Mall - Insecure Cookie Handling
CVE-2008-6232—webappsphp
Pre Shopping Mall allows remote attackers to bypass authentication and gain administrative access by setting the (1) adm
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component flash fun! 1.0 - Remote File Inclusion
CVE-2007-4955—webappsphp
PHP remote file inclusion vulnerability in admin.joomlaflashfun.php in the Flash Fun! (com_joomlaflashfun) 1.0 component
28RISK
open ↗
Referência✓ VexDay Proof
PHP League 0.82 - 'classement.php' SQL Injection
CVE-2006-5676—webappsasp
SQL injection vulnerability in consult/classement.php in Uni-Vert PhpLeague 0.82 and earlier allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
PHP 4.4.6 - 'crack_opendict()' Local Buffer Overflow
CVE-2007-1401—localwindows
Buffer overflow in the crack extension (CrackLib), as bundled with PHP 4.4.6 and other versions before 5.0.0, might allo
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Help Workshop 4.03.0002 - '.cnt' Local Buffer Overflow
CVE-2007-0352—localwindows
Stack-based buffer overflow in Microsoft Help Workshop 4.03.0002 allows user-assisted remote attackers to execute arbitr
35RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Software - 'id' SQL Injection
CVE-2008-6237—webappsphp
SQL injection vulnerability in software-description.php in Scripts For Sites (SFS) Hotscripts-like Site allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
Realty Web-Base 1.0 - Authentication Bypass
CVE-2009-1658—webappsphp
Multiple SQL injection vulnerabilities in admin/admin.php in Realty Webware Technologies Realty Web-Base 1.0 allow remot
23RISK
open ↗
Referência✓ VexDay Proof
XM Easy Personal FTP Server 5.2.1 - Remote Denial of Service
CVE-2006-5728—doswindows
XM Easy Personal FTP Server 5.2.1 and earlier allows remote authenticated users to cause a denial of service via a long
23RISK
open ↗
Referência✓ VexDay Proof
Web Wiz Rich Text Editor 4.0 - Multiple Vulnerabilities
CVE-2008-0481—webappsasp
Directory traversal vulnerability in RTE_file_browser.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to lis
23RISK
open ↗
Referência✓ VexDay Proof
Q-Shop 3.0 - Cross-Site Scripting / SQL Injection
CVE-2008-6258—webappsasp
SQL injection vulnerability in users.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
e107 Plugin BLOG Engine 2.2 - 'uid' Blind SQL Injection
CVE-2008-6438—webappsphp
SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows re
23RISK
open ↗
Referência✓ VexDay Proof
MailEnable Professional/Enterprise 2.37 - 'APPEND' Remote Buffer Overflow
CVE-2007-1301—remotewindows
Stack-based buffer overflow in the IMAP service in MailEnable Enterprise and Professional Editions 2.37 and earlier allo
28RISK
open ↗
← previouspage 640 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.