Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,063cataloged exploits
40,808CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
WordPress Core 2.1.2 - 'xmlrpc' SQL Injection
CVE-2007-1897—webappsphp
SQL injection vulnerability in xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated
23RISK
open ↗
Referência✓ VexDay Proof
0irc-client 1345 build20060823 - Denial of Service
CVE-2007-1648—doswindows
0irc 1345 build 20060823 allows remote attackers to cause a denial of service (application crash) by operating an IRC se
23RISK
open ↗
Referência✓ VexDay Proof
Multi-Threaded TFTP 1.1 - GET Denial of Service
CVE-2006-4781—doswindows
Heap-based buffer overflow in FutureSoft TFTP Server Multithreaded (MT) 1.1 allows remote attackers to cause a denial of
23RISK
open ↗
Referência✓ VexDay Proof
TotalCalendar 2.30 - 'inc' Remote File Inclusion
CVE-2006-7055—webappsphp
PHP remote file inclusion vulnerability in index.php in TotalCalendar 2.30 and earlier allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
Pathos CMS 0.92-2 - 'warn.php' Remote File Inclusion
CVE-2007-1907—webappsphp
PHP remote file inclusion vulnerability in warn.php in Pathos Content Management System (CMS) 0.92-2 allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
EntertainmentScript 1.4.0 - 'play.php' SQL Injection
CVE-2008-2393—webappsphp
SQL injection vulnerability in play.php in EntertainmentScript 1.4.0 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Dada Mail Manager 2.6 - Remote File Inclusion
CVE-2008-6221—webappsphp
PHP remote file inclusion vulnerability in config.dadamail.php in the Dada Mail Manager (com_dadamail) component 2.6 for
35RISK
open ↗
Referência✓ VexDay Proof
MyioSoft Ajax Portal 3.0 - Authentication Bypass
CVE-2008-5653—webappsphp
SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft AjaxPortal 3.0 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
FutureSoft TFTP Server 2000 - Remote Overwrite (SEH)
CVE-2007-1645—remotewindows
Buffer overflow in FutureSoft TFTP Server 2000 on Microsoft Windows 2000 SP4 allows remote attackers to execute arbitrar
28RISK
open ↗
Referência✓ VexDay Proof
PortailPhp 2.0 - 'idnews' SQL Injection
CVE-2007-1641—webappsphp
SQL injection vulnerability in index.php in PortailPHP 2.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
cattaDoc 2.21 - 'download2.php?fn1' Remote File Disclosure
CVE-2007-1930—webappsphp
Directory traversal vulnerability in download2.php in cattaDoc 2.21, and possibly other versions including 3.0, allows r
23RISK
open ↗
Referência✓ VexDay Proof
BP Blog 6.0 - 'id' Blind SQL Injection
CVE-2008-2554—webappsasp
Multiple SQL injection vulnerabilities in BP Blog 6.0 allow remote attackers to execute arbitrary SQL commands via the (
23RISK
open ↗
Referência✓ VexDay Proof
Axigen 2.0.0b1 - Remote Denial of Service (1)
CVE-2007-0886—doslinux
Heap-based buffer underflow in axigen 1.2.6 through 2.0.0b1 allows remote attackers to cause a denial of service (applic
23RISK
open ↗
Referência✓ VexDay Proof
XAMPP 1.6.8 - Cross-Site Request Forgery (Change Administrative Password)
CVE-2008-6499—remotewindows
security/xamppsecurity.php in XAMPP 1.6.8 performs an extract operation on the SERVER superglobal array, which allows re
23RISK
open ↗
Referência✓ VexDay Proof
Really Simple PHP and Ajax (RSPA) 2007-03-23 - Remote File Inclusion
CVE-2007-1982—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Really Simple PHP and Ajax (RSPA) 2007-03-23 and earlier allow rem
28RISK
open ↗
Referência✓ VexDay Proof
CMS little 0.0.1 - 'term' SQL Injection
CVE-2008-5628—webappsphp
SQL injection vulnerability in index.php in CMS little 0.0.1 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
netForo! 0.1 - 'down.php?file_to_download' Remote File Disclosure
CVE-2007-1392—webappsphp
Directory traversal vulnerability in down.php in netForo! 0.1g allows remote attackers to read arbitrary files via a ..
23RISK
open ↗
Referência✓ VexDay Proof
Yahoo! Music Jukebox 2.2 - 'AddImage()' ActiveX Remote Buffer Overflow (PoC)
CVE-2008-0623—doswindows
Stack-based buffer overflow in the YMP Datagrid ActiveX control (datagrid.dll) in Yahoo! Music Jukebox 2.2.2.056 allows
23RISK
open ↗
Referência✓ VexDay Proof
CMS MAXSITE 1.10 - 'category' SQL Injection
CVE-2008-2487—webappsphp
SQL injection vulnerability in index.php in MAXSITE 1.10 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_pccookbook - 'recipe_id' Blind SQL Injection
CVE-2009-0329—webappsphp
SQL injection vulnerability in the PcCookBook (com_pccookbook) component for Joomla! allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
JiRo's FAQ Manager eXperience 1.0 - 'fID' SQL Injection
CVE-2008-2691—webappsasp
SQL injection vulnerability in read.asp in JiRo's FAQ Manager eXperience 1.0 allows remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Diesel Pay Script - 'area' SQL Injection
CVE-2008-6468—webappsphp
SQL injection vulnerability in index.php in Diesel Pay allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência✓ VexDay Proof
Roundcube Webmail 0.2-3 Beta - Code Execution
CVE-2008-5619—webappsphp
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail)
35RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component flash fun! 1.0 - Remote File Inclusion
CVE-2007-4955—webappsphp
PHP remote file inclusion vulnerability in admin.joomlaflashfun.php in the Flash Fun! (com_joomlaflashfun) 1.0 component
28RISK
open ↗
Referência✓ VexDay Proof
philboard 1.14 - 'philboard_forum.asp' SQL Injection
CVE-2007-0920—webappsasp
SQL injection vulnerability in philboard_forum.asp in Philboard 1.14 and earlier allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
HIOX GUEST BOOK (HGB) 4.0 - Remote Code Execution
CVE-2007-1998—webappsphp
Direct static code injection vulnerability in HIOX Guest Book (HGB) 4.0 allows remote attackers to inject arbitrary PHP
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Help Workshop 4.03.0002 - '.cnt' Local Buffer Overflow
CVE-2007-0352—localwindows
Stack-based buffer overflow in Microsoft Help Workshop 4.03.0002 allows user-assisted remote attackers to execute arbitr
35RISK
open ↗
Referência✓ VexDay Proof
Galatolo Web Manager 1.0 - Cross-Site Scripting / Local File Inclusion
CVE-2008-2699—webappsphp
Multiple directory traversal vulnerabilities in Galatolo WebManager (GWM) 1.0 allow remote attackers to include and exec
23RISK
open ↗
Referência✓ VexDay Proof
verlihub 0.9.8d-RC2 - Remote Command Execution
CVE-2008-5705—remotelinux
The cTrigger::DoIt function in src/ctrigger.cpp in the trigger mechanism in the daemon in Verlihub 0.9.8d-RC2 and earlie
23RISK
open ↗
Referência✓ VexDay Proof
blogit! - SQL Injection / File Disclosure / Cross-Site Scripting
CVE-2009-0337—webappsphp
SQL injection vulnerability in index.asp in Katy Whitton BlogIt! allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
← previouspage 651 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.