Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits

40,804CVEs with public exploitation

24,696lab-tested

All Referência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

E-Shop Shopping Cart Script - 'search_results.php' SQL Injection

CVE-2008-5838—webappsphp

SQL injection vulnerability in search_results.php in E-Php Scripts E-Shop (aka E-Php Shopping Cart) Shopping Cart Script

23RISK

open ↗

Referência✓ VexDay Proof

Xitami Web Server 2.5 - 'If-Modified-Since' Remote Buffer Overflow

CVE-2007-5067—remotewindows

Multiple buffer overflows in iMatix Xitami Web Server 2.5c2 allow remote attackers to execute arbitrary code via a long

60RISK

open ↗

Referência✓ VexDay Proof

PacerCMS 0.6 - 'last_module' Remote Code Execution

CVE-2007-5056—webappsphp

Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including

28RISK

open ↗

Referência✓ VexDay Proof

BloofoxCMS 0.3.4 - 'lang' Local File Inclusion

CVE-2008-5748—webappsphp

Directory traversal vulnerability in plugins/spaw2/dialogs/dialog.php in BloofoxCMS 0.3.4 allows remote attackers to rea

28RISK

open ↗

Referência✓ VexDay Proof

WordPress Plugin Wordspew - SQL Injection

CVE-2008-0682—webappsphp

SQL injection vulnerability in wordspew-rss.php in the Wordspew plugin before 3.72 for Wordpress allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

CoolPlayer 2.19 - '.Skin' Local Buffer Overflow

CVE-2008-5735—localwindows

Stack-based buffer overflow in skin.c in CoolPlayer 2.17 through 2.19 allows remote attackers to execute arbitrary code

23RISK

open ↗

Referência✓ VexDay Proof

BLOG 1.55B - 'image_upload.php' Arbitrary File Upload

CVE-2008-5732—webappsphp

Unrestricted file upload vulnerability in lib/image_upload.php in KafooeyBlog 1.55b allows remote attackers to execute a

28RISK

open ↗

Referência✓ VexDay Proof

MySpace Uploader - 'MySpaceUploader.ocx 1.0.0.4' Remote Buffer Overflow

CVE-2008-0659—remotewindows

Stack-based buffer overflow in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.5.70 and earlier, as used i

35RISK

open ↗

Referência✓ VexDay Proof

Camera Life 2.6.2 - 'id' SQL Injection

CVE-2008-3355—webappsphp

SQL injection vulnerability in sitemap.xml.php in Camera Life 2.6.2 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

QMail Mailing List Manager 1.2 - Database Disclosure

CVE-2008-5606—webappsasp

Gazatem QMail Mailing List Manager 1.2 stores sensitive information under the web root with insufficient access control,

23RISK

open ↗

Referência✓ VexDay Proof

Merlix Teamworx Server - File Disclosure/Bypass

CVE-2008-5599—webappsphp

SQL injection vulnerability in default.asp in Merlix Teamworx Server allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

PHPmyGallery Gold 1.51 - 'index.php' Directory Traversal

CVE-2008-5598—webappsphp

Directory traversal vulnerability in index.php in PHPmyGallery 1.51 gold allows remote attackers to list arbitrary direc

23RISK

open ↗

Referência✓ VexDay Proof

nightfall personal diary 1.0 - Cross-Site Scripting / File Disclosure

CVE-2008-5591—webappsphp

Cross-site scripting (XSS) vulnerability in login.asp in Nightfall Personal Diary 1.0 allows remote attackers to inject

23RISK

open ↗

Referência✓ VexDay Proof

Web Wiz Rich Text Editor 4.0 - Multiple Vulnerabilities

CVE-2008-0466—webappsasp

Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02,

23RISK

open ↗

Referência✓ VexDay Proof

Seagull 0.6.3 - 'files' Remote File Disclosure

CVE-2008-0465—webappsphp

Directory traversal vulnerability in optimizer.php in Seagull 0.6.3 allows remote attackers to read arbitrary files via

23RISK

open ↗

Referência✓ VexDay Proof

IDM-OS 1.0 - 'Filename' File Disclosure

CVE-2008-0431—webappsphp

Directory traversal vulnerability in administrator/download.php in IDMOS (aka Phoenix) 1.0 allows remote attackers to re

23RISK

open ↗

Referência✓ VexDay Proof

AuraCMS 1.5rc - Multiple SQL Injections

CVE-2007-4804—webappsphp

Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência✓ VexDay Proof

Link Request Contact Form 3.4 - Remote Code Execution

CVE-2007-3199—webappsphp

Unrestricted file upload vulnerability in Link Request Contact Form 3.4 allows remote attackers to execute arbitrary PHP

23RISK

open ↗

Referência✓ VexDay Proof

EDraw Office Viewer Component - Unsafe Method

CVE-2007-3168—remotewindows

A certain ActiveX control in the EDraw Office Viewer Component (edrawofficeviewer.ocx) 4.0.5.20, and other versions befo

23RISK

open ↗

Referência✓ VexDay Proof

SlimCMS 1.0.0 - 'edit.php' SQL Injection

CVE-2008-5491—webappsphp

SQL injection vulnerability in edit.php in SlimCMS 1.0.0 and earlier allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

yahoo answers - 'id' SQL Injection

CVE-2008-5490—webappsphp

SQL injection vulnerability in index.php in PHPStore Yahoo Answers allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

Ciberia Content Federator 1.0.1 - 'path' Remote File Inclusion

CVE-2006-6774—webappsphp

PHP remote file inclusion vulnerability in socios/maquetacion_socio.php (members/maquetacion_member.php) in Ciberia Cont

23RISK

open ↗

Referência✓ VexDay Proof

Electronics Workbench - '.ewb' Local Stack Overflow (PoC)

CVE-2008-5383—doswindows

Stack-based buffer overflow in National Instruments Electronics Workbench allows user-assisted attackers to cause a deni

23RISK

open ↗

Referência✓ VexDay Proof

EZContents CMS 2.0.0 - Multiple SQL Injections

CVE-2008-2135—webappsphp

Multiple SQL injection vulnerabilities in VisualShapers ezContents 2.0.0 allow remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

CKGold Shopping Cart 2.0 - 'category.php' Blind SQL Injection

CVE-2007-4736—webappsphp

SQL injection vulnerability in category.php in CartKeeper CKGold Shopping Cart 2.0 allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

WordPress Plugin Download Manager 0.2 - Arbitrary File Upload

CVE-2008-3362—webappsphp

Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress a

28RISK

open ↗

Referência✓ VexDay Proof

Acoustica MP3 CD Burner 4.51 Build 147 - '.asx' Local Buffer Overflow

CVE-2007-3006—localwindows

Buffer overflow in Acoustica MP3 CD Burner 4.32 allows user-assisted remote attackers to execute arbitrary code via a .a

23RISK

open ↗

Referência✓ VexDay Proof

Soritong MP3 Player 1.0 - Local Buffer Overflow (SEH)

CVE-2009-1643—localwindows

Stack-based buffer overflow in Sorinara Soritong MP3 Player 1.0 allows remote attackers to execute arbitrary code via a

23RISK

open ↗

Referência✓ VexDay Proof

FREEze Greetings 1.0 - Remote Password Retrieve

CVE-2008-5218—webappsphp

ScriptsEz FREEze Greetings 1.0 stores pwd.txt under the web root with insufficient access control, which allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Xe webtv - 'id' Blind SQL Injection

CVE-2008-5200—webappsphp

SQL injection vulnerability in the Xe webtv (com_xewebtv) component for Joomla! allows remote attackers to execute arbit

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.