Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
MyPHP Forum 3.0 - Edit Topics / Blind SQL Injection
CVE-2008-6777—webappsphp
Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Volunteer 2.0 - SQL Injection
CVE-2008-6337—webappsphp
SQL injection vulnerability in the Volunteer Management System (com_volunteer) module 2.0 for Joomla! allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
pForum 1.30 - 'showprofil.php' SQL Injection
CVE-2008-4355—webappsphp
SQL injection vulnerability in showprofil.php in Powie PSCRIPT Forum (aka PHP Forum or pForum) 1.30 and earlier allows r
23RISK
open ↗
Referência✓ VexDay Proof
PayProCart 1146078425 - Multiple Remote File Inclusions
CVE-2006-4672—webappsphp
PHP remote file inclusion vulnerability in profitCode ppalCart 2.5 EE, possibly a component of PayProCart, allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Oracle 10g - MDSYS.SDO_TOPO_DROP_FTBL SQL Injection (Metasploit)
CVE-2008-3979—localmultiple
Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 and 10.2.0.2 allows remote authent
50RISK
open ↗
Referência✓ VexDay Proof
RM Downloader 3.0.0.9 - '.RAM' Local Buffer Overflow
CVE-2009-1646—localwindows
Stack-based buffer overflow in Mini-stream RM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a
23RISK
open ↗
Referência✓ VexDay Proof
smNews 1.0 - Authentication Bypass / Column Truncation
CVE-2009-0750—webappsphp
SQL injection vulnerability in login.php in the smNews example script for txtSQL 2.2 Final allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
w3blabor CMS 3.3.0 - Authentication Bypass
CVE-2009-0597—webappsphp
SQL injection vulnerability in admin/index.php in w3b>cms (aka w3blabor CMS) before 3.4.0, when magic_quotes_gpc is disa
23RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Gaming Directory - 'cat_id' SQL Injection
CVE-2008-6781—webappsphp
SQL injection vulnerability in directory.php in Sites for Scripts (SFS) Gaming Directory allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
eZip Wizard 3.0 - Local Stack Buffer Overflow (PoC) (SEH)
CVE-2009-1058—doswindows
Stack-based buffer overflow in ZipGenius might allow remote attackers to execute arbitrary code via a crafted .zip file
23RISK
open ↗
Referência✓ VexDay Proof
MyShoutPro 1.2 - Final Insecure Cookie Handling
CVE-2008-6738—webappsphp
MyShoutPro 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin_acce
23RISK
open ↗
Referência✓ VexDay Proof
SailPlanner 0.3a - Authentication Bypass
CVE-2008-7077—webappsphp
Multiple SQL injection vulnerabilities in SailPlanner 0.3a allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
mUnky 0.0.1 - 'zone' Local File Inclusion
CVE-2008-2876—webappsphp
Directory traversal vulnerability in index.php in mUnky 0.0.1 allows remote attackers to include and execute arbitrary l
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Webhosting - 'catid' Blind SQL Injection
CVE-2008-6653—webappsphp
SQL injection vulnerability in webhosting.php in the Webhosting Component (com_webhosting) module before 1.1 RC7 for Joo
23RISK
open ↗
Referência✓ VexDay Proof
CF_Forum - Blind SQL Injection
CVE-2008-6324—webappsasp
SQL injection vulnerability in forummessages.cfm in CF_Forum allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
e107 0.617 - Cross-Site Scripting Remote Cookie Disclosure
CVE-2005-2327—webappsphp
Cross-site scripting (XSS) vulnerability in e107 0.617 and earlier allows remote attackers to inject arbitrary web scrip
23RISK
open ↗
Referência✓ VexDay Proof
BolinTech DreamFTP Server - 'USER' Remote Buffer Overflow (PoC)
CVE-2007-0338—doswindows
Heap-based buffer overflow in Dream FTP Server allows remote attackers to execute arbitrary code via a USER command with
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Mobile 6.0 - Device Long Name Remote Reboot (Denial of Service)
CVE-2008-4295—doshardware
Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to esta
35RISK
open ↗
Referência✓ VexDay Proof
A Better Member-Based ASP Photo Gallery - 'entry' SQL Injection
CVE-2009-0531—webappsphp
SQL injection vulnerability in gallery/view.asp in A Better Member-Based ASP Photo Gallery before 1.2 allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
LoveCMS 1.6.2 Final (Download Manager 1.0) - Arbitrary File Upload
CVE-2008-7062—webappsphp
Unrestricted file upload vulnerability in admin/index.php in Download Manager module 1.0 for LoveCMS 1.6.2 Final allows
23RISK
open ↗
Referência✓ VexDay Proof
MatPo Link 1.2b - Blind SQL Injection / Cross-Site Scripting
CVE-2008-6607—webappsphp
Cross-site scripting (XSS) vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to inject arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module Tutoriais - 'viewcat.php' SQL Injection
CVE-2007-1816—webappsphp
SQL injection vulnerability in viewcat.php in the Tutoriais module for Xoops allows remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Attachmax Dolphin 2.1.0 - Multiple Vulnerabilities
CVE-2008-4207—webappsphp
Attachmax Dolphin 2.1.0 and earlier does not properly protect info.php in the main folder, which allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Server 2000 SP4 (Advanced Server) - Message Queue (MS07-065)
CVE-2007-3039—remotewindows
Stack-based buffer overflow in the Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4, Window
50RISK
open ↗
Referência✓ VexDay Proof
Talkback 2.3.6 - Multiple Local File Inclusion / PHPInfo Disclosure Vulnerabilities
CVE-2008-4346—webappsphp
Directory traversal vulnerability in TalkBack 2.3.6 and 2.3.6.4 allows remote attackers to include and execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
WebCMS Portal Edition - 'id' Blind SQL Injection
CVE-2008-4185—webappsphp
SQL injection vulnerability in index.php in webCMS Portal Edition allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
SkaLinks 1.5 - Authentication Bypass
CVE-2009-0451—webappsphp
SQL injection vulnerability in Skalfa SkaLinks 1.5 allows remote attackers to execute arbitrary SQL commands via the Adm
23RISK
open ↗
Referência✓ VexDay Proof
ExBB 0.22 - Local/Remote File Inclusion
CVE-2008-1862—webappsphp
ExBB Italia 0.22 and earlier only checks GET requests that use the QUERY_STRING for certain path manipulations, which al
23RISK
open ↗
Referência✓ VexDay Proof
Mantis Bug Tracker 1.1.1 - Code Execution / Cross-Site Scripting / Cross-Site Request Forgery
CVE-2008-2276—webappsphp
Cross-site request forgery (CSRF) vulnerability in manage_user_create.php in Mantis 1.1.1 allows remote attackers to cre
23RISK
open ↗
Referência✓ VexDay Proof
PHP-revista 1.1.2 - Remote File Inclusion / SQL Injection / Authentication Bypass / Cross-Site Scripting
CVE-2006-4607—webappsphp
admin/index.php in Longino Jacome php-Revista 1.1.2 allows remote attackers to bypass authentication controls by setting
23RISK
open ↗
← previouspage 642 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.