Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
TikiWiki 1.9 Sirius - 'jhot.php' Remote Command Execution
CVE-2006-4602—webappsphp
Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execu
50RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_Eventing 1.6.x - Blind SQL Injection
CVE-2009-0421—webappsphp
SQL injection vulnerability in the Eventing (com_eventing) 1.6.x component for Joomla! allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
AuraCMS 1.5rc - Multiple SQL Injections
CVE-2007-4804—webappsphp
Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência✓ VexDay Proof
IDM-OS 1.0 - 'Filename' File Disclosure
CVE-2008-0431—webappsphp
Directory traversal vulnerability in administrator/download.php in IDMOS (aka Phoenix) 1.0 allows remote attackers to re
23RISK
open ↗
Referência✓ VexDay Proof
Seagull 0.6.3 - 'files' Remote File Disclosure
CVE-2008-0465—webappsphp
Directory traversal vulnerability in optimizer.php in Seagull 0.6.3 allows remote attackers to read arbitrary files via
23RISK
open ↗
Referência✓ VexDay Proof
Web Wiz Rich Text Editor 4.0 - Multiple Vulnerabilities
CVE-2008-0466—webappsasp
Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02,
23RISK
open ↗
Referência✓ VexDay Proof
nightfall personal diary 1.0 - Cross-Site Scripting / File Disclosure
CVE-2008-5591—webappsphp
Cross-site scripting (XSS) vulnerability in login.asp in Nightfall Personal Diary 1.0 allows remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
PHPmyGallery Gold 1.51 - 'index.php' Directory Traversal
CVE-2008-5598—webappsphp
Directory traversal vulnerability in index.php in PHPmyGallery 1.51 gold allows remote attackers to list arbitrary direc
23RISK
open ↗
Referência✓ VexDay Proof
Merlix Teamworx Server - File Disclosure/Bypass
CVE-2008-5599—webappsphp
SQL injection vulnerability in default.asp in Merlix Teamworx Server allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
QMail Mailing List Manager 1.2 - Database Disclosure
CVE-2008-5606—webappsasp
Gazatem QMail Mailing List Manager 1.2 stores sensitive information under the web root with insufficient access control,
23RISK
open ↗
Referência✓ VexDay Proof
Pre Real Estate Listings - 'search.php' SQL Injection
CVE-2008-4177—webappsphp
SQL injection vulnerability in search.php in Pre Real Estate Listings allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
MySpace Uploader - 'MySpaceUploader.ocx 1.0.0.4' Remote Buffer Overflow
CVE-2008-0659—remotewindows
Stack-based buffer overflow in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.5.70 and earlier, as used i
35RISK
open ↗
Referência✓ VexDay Proof
PHPOCS 0.1-beta3 - 'act' Local File Inclusion
CVE-2008-4331—webappsphp
Directory traversal vulnerability in library/pagefunctions.inc.php in phpOCS 0.1 beta3 and earlier allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
Phoenician Casino FlashAX - ActiveX Remote Code Execution
CVE-2008-5691—remotewindows
Heap-based buffer overflow in the Phoenician Casino FlashAX ActiveX control 1.0.0.7 allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
Wireshark 1.0.x - '.ncf' Packet Capture Local Denial of Service
CVE-2008-4682—dosmultiple
wtap.c in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application abort) via a
23RISK
open ↗
Referência✓ VexDay Proof
Active NewsLetter 4.3 - 'ViewNewspapers.asp' SQL Injection
CVE-2007-1696—webappsasp
SQL injection vulnerability in ViewNewspapers.asp in Active Newsletter 4.3 and earlier allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
BLOG 1.55B - 'image_upload.php' Arbitrary File Upload
CVE-2008-5732—webappsphp
Unrestricted file upload vulnerability in lib/image_upload.php in KafooeyBlog 1.55b allows remote attackers to execute a
28RISK
open ↗
Referência✓ VexDay Proof
Smoothflash - 'cid' SQL Injection
CVE-2008-1623—webappsphp
SQL injection vulnerability in admin_view_image.php in Smoothflash allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
Acc Real Estate 4.0 - Insecure Cookie Handling
CVE-2008-6293—webappsphp
admin/Index.php in Acc Real Estate 4.0 allows remote attackers to bypass authentication and gain administrative access b
23RISK
open ↗
Referência✓ VexDay Proof
CoolPlayer 2.19 - '.Skin' Local Buffer Overflow
CVE-2008-5735—localwindows
Stack-based buffer overflow in skin.c in CoolPlayer 2.17 through 2.19 allows remote attackers to execute arbitrary code
23RISK
open ↗
Referência✓ VexDay Proof
BloofoxCMS 0.3.4 - 'lang' Local File Inclusion
CVE-2008-5748—webappsphp
Directory traversal vulnerability in plugins/spaw2/dialogs/dialog.php in BloofoxCMS 0.3.4 allows remote attackers to rea
28RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module XT-Conteudo - 'spaw_root' Remote File Inclusion
CVE-2007-3221—webappsphp
PHP remote file inclusion vulnerability in admin/spaw/spaw_control.class.php in the XT-Conteudo module for XOOPS allows
35RISK
open ↗
Referência✓ VexDay Proof
PacerCMS 0.6 - 'last_module' Remote Code Execution
CVE-2007-5056—webappsphp
Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including
28RISK
open ↗
Referência✓ VexDay Proof
Xitami Web Server 2.5 - 'If-Modified-Since' Remote Buffer Overflow
CVE-2007-5067—remotewindows
Multiple buffer overflows in iMatix Xitami Web Server 2.5c2 allow remote attackers to execute arbitrary code via a long
60RISK
open ↗
Referência✓ VexDay Proof
WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting
CVE-2020-29233—webappsphp
WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This vulnerability can allo
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module xhresim - SQL Injection
CVE-2008-5665—webappsphp
SQL injection vulnerability in index.php in the xhresim module in XOOPS allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
E-Shop Shopping Cart Script - 'search_results.php' SQL Injection
CVE-2008-5838—webappsphp
SQL injection vulnerability in search_results.php in E-Php Scripts E-Shop (aka E-Php Shopping Cart) Shopping Cart Script
23RISK
open ↗
Referência✓ VexDay Proof
Constructr CMS 3.02.5 stable - Multiple Vulnerabilities
CVE-2008-5859—webappsphp
SQL injection vulnerability in index.php in Constructr CMS 3.02.5 and earlier, when register_globals is enabled and magi
23RISK
open ↗
Referência✓ VexDay Proof
FreeLyrics 1.0 - Remote File Disclosure
CVE-2008-5861—webappsphp
Directory traversal vulnerability in source.php in FreeLyrics 1.0 allows remote attackers to read arbitrary files via di
23RISK
open ↗
Referência✓ VexDay Proof
fipsForum 2.6 - 'default2.asp' SQL Injection
CVE-2006-6116—webappsasp
SQL injection vulnerability in default2.asp in fipsForum 2.6 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗
← previouspage 648 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.