Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits

40,804CVEs with public exploitation

24,696lab-tested

All Referência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

ASP Product Catalog 1.0 - Cross-Site Scripting / File Disclosure

CVE-2009-1321—webappsphp

Cross-site scripting (XSS) vulnerability in search.asp in ASP Product Catalog 1.0 allows remote attackers to inject arbi

23RISK

open ↗

Referência✓ VexDay Proof

LinkBase 2.0 - Remote Cookie Grabber

CVE-2009-1607—webappsphp

Cross-site scripting (XSS) vulnerability in the administrator panel in phpForm.net LinkBase 2.0 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

yogurt 0.3 - Cross-Site Scripting / SQL Injection

CVE-2009-2033—webappsphp

Cross-site scripting (XSS) vulnerability in index.php in Yogurt 0.3 allows remote attackers to inject arbitrary web scri

23RISK

open ↗

Referência✓ VexDay Proof

GDL 4.x - 'node' SQL Injection

CVE-2009-0965—webappsphp

SQL injection vulnerability in functions/browse.php in Ganesha Digital Library (GDL) 4.0 and 4.2 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Butterfly ORGanizer 2.0.1 - 'id' SQL Injection

CVE-2008-6328—webappsphp

SQL injection vulnerability in view.php in Butterfly Organizer 2.0.0 and 2.0.1 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

CMS NetCat 3.12 - 'password_recovery.php' Blind SQL Injection

CVE-2008-5727—webappsphp

SQL injection vulnerability in modules/auth/password_recovery.php in AIST NetCat 3.12 and earlier, when magic_quotes_gpc

23RISK

open ↗

Referência✓ VexDay Proof

SAWStudio 3.9i - '.prf' Local Buffer Overflow (PoC)

CVE-2008-5722—doswindows

Buffer overflow in SAWStudio 3.9i allows user-assisted remote attackers to cause a denial of service (application crash)

28RISK

open ↗

Referência✓ VexDay Proof

verlihub 0.9.8d-RC2 - Remote Command Execution

CVE-2008-5706—remotelinux

The cTrigger::DoIt function in src/ctrigger.cpp in the trigger mechanism in the daemon in Verlihub 0.9.8d-RC2 and earlie

23RISK

open ↗

Referência✓ VexDay Proof

TxtBlog 1.0 Alpha - Local File Inclusion

CVE-2008-5639—webappsphp

Directory traversal vulnerability in index.php in TxtBlog 1.0 Alpha allows remote attackers to read arbitrary files via

23RISK

open ↗

Referência✓ VexDay Proof

CMS Mini 0.2.2 - Multiple Local File Inclusions

CVE-2008-2961—webappsphp

Multiple directory traversal vulnerabilities in view/index.php in CMS Mini 0.2.2 allow remote attackers to read arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

PHP TV Portal 2.0 - 'mid' SQL Injection

CVE-2008-6285—webappsphp

SQL injection vulnerability in index.php in PHP TV Portal 2.0 and earlier allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

ASPTicker 1.0 - Remote Database Disclosure

CVE-2008-5603—webappsasp

ASPTicker 1.0 stores sensitive information under the web root with insufficient access control, which allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

User Engine Lite ASP - 'users.mdb' Database Disclosure

CVE-2008-5601—webappsphp

User Engine Lite ASP stores sensitive information under the web root with insufficient access control, which allows remo

23RISK

open ↗

Referência✓ VexDay Proof

AJ Auction Web 2.0 - 'cate_id' SQL Injection

CVE-2008-2860—webappsphp

SQL injection vulnerability in category.php in AJSquare AJ Auction Pro web 2.0 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Recipes Complete Website 1.1.14 - SQL Injection

CVE-2006-6220—webappsphp

Multiple SQL injection vulnerabilities in Recipes Website (Recipes Complete Website) 1.1.14 allow remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

MyMarket 1.72 - Blind SQL Injection

CVE-2008-2815—webappsphp

SQL injection vulnerability in shopping/index.php in MyMarket 1.72 allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component VirtueMart Google Base 1.1 - Remote File Inclusion

CVE-2008-6483—webappsphp

PHP remote file inclusion vulnerability in admin.googlebase.php in the Ecom Solutions VirtueMart Google Base (aka com_go

35RISK

open ↗

Referência✓ VexDay Proof

Gforge 4.6 rc1 - 'skill_edit' SQL Injection

CVE-2008-6188—webappsphp

SQL injection vulnerability in people/editprofile.php in Gforge 4.6 rc1 and earlier allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

phpPgAdmin 4.2.1 - '_language' Local File Inclusion

CVE-2008-5587—webappsphp

Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is ena

43RISK

open ↗

Referência✓ VexDay Proof

lcxbbportal 0.1 alpha 2 - Remote File Inclusion

CVE-2008-5585—webappsphp

Multiple PHP remote file inclusion vulnerabilities in lcxBBportal 0.1 Alpha 2 allow remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

RevokeBB 1.0 RC11 - 'Search' SQL Injection

CVE-2008-2778—webappsphp

SQL injection vulnerability in inc/class_search.php in the Search System in RevokeBB 1.0 RC11 allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

LoCal Calendar 1.1 - 'lcUser.php' Remote File Inclusion

CVE-2006-5426—webappsphp

PHP remote file inclusion vulnerability in lib/lcUser.php in LoCal Calendar System 1.1 remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

Prozilla Pub Site Directory - 'Directory.php?cat' SQL Injection

CVE-2007-4258—webappsphp

SQL injection vulnerability in directory.php in Prozilla Pub Site Directory allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Flatnux 2009-01-27 - Remote File Inclusion

CVE-2009-0572—webappsphp

PHP remote file inclusion vulnerability in include/flatnux.php in FlatnuX CMS (aka Flatnuke3) 2009-01-27 and 2009-02-04,

23RISK

open ↗

Referência✓ VexDay Proof

PHP Net Tools 2.7.1 - Remote Code Execution

CVE-2006-1921—webappsphp

nettools.php in PHP Net Tools 2.7.1 allows remote attackers to execute arbitrary commands via shell metacharacters in th

23RISK

open ↗

Referência✓ VexDay Proof

Drake CMS 0.4.11 - Blind SQL Injection

CVE-2008-6475—webappsphp

SQL injection vulnerability in the guestbook component (components/guestbook/guestbook.php) in Drake CMS 0.4.11 and earl

23RISK

open ↗

Referência✓ VexDay Proof

Todd Woolums ASP News Management 2.2 - SQL Injection

CVE-2008-5273—webappsasp

SQL injection vulnerability in viewnews.asp in Todd Woolums ASP News Management 2.2 allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

LiteNews 0.1 - 'id' SQL Injection

CVE-2008-3507—webappsphp

SQL injection vulnerability in index.php in LiteNews 0.1 (aka 01), and possibly 1.2 and earlier, allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

AJ Article 1.0 - 'featured_article.php' SQL Injection

CVE-2008-5213—webappsphp

SQL injection vulnerability in featured_article.php in AJ Article 1.0 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

AJ Auction 6.2.1 - 'classifide_ad.php' SQL Injection

CVE-2008-5212—webappsphp

SQL injection vulnerability in classifide_ad.php in AJ Auction 6.2.1 and earlier allows remote attackers to execute arbi

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.