Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,139cataloged exploits

40,879CVEs with public exploitation

24,696lab-tested

All Referência 26,555Exploit-DB 24,489GitHub PoC 18,366VulnCheck XDB 10,605Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

jPORTAL 2.3.1 - 'articles.php' SQL Injection

CVE-2007-5973—webappsphp

SQL injection vulnerability in articles.php in JPortal 2.3.1 and earlier allows remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência✓ VexDay Proof

Web Slider 0.6 - 'path' Remote File Inclusion

CVE-2007-2067—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Marco Antonio Islas Cruz Web Slider (WebSlider) 0.6 allow remote a

23RISK

open ↗

Referência✓ VexDay Proof

RKD Software BarCode ActiveX Control 'BarCodeAx.dll' 4.9 - Remote Overflow

CVE-2007-3435—remotewindows

Stack-based buffer overflow in the BeginPrint method in a certain ActiveX control in RKD Software (barcodetools.com) Bar

50RISK

open ↗

Referência✓ VexDay Proof

Site@School 2.4.02 - Arbitrary File Upload

CVE-2006-4920—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Site@School (S@S) 2.4.02 and earlier allow remote attackers to exe

28RISK

open ↗

Referência✓ VexDay Proof

Bytehoard 2.1 - 'server.php' Remote File Inclusion

CVE-2006-2849—webappsphp

PHP remote file inclusion vulnerability in includes/webdav/server.php in Bytehoard 2.1 Epsilon/Delta allows remote attac

28RISK

open ↗

Referência✓ VexDay Proof

campus virtual-lms - Cross-Site Scripting / SQL Injection

CVE-2009-2150—webappsphp

Multiple cross-site request forgery (CSRF) vulnerabilities in Campus Virtual-LMS allow (1) remote attackers to hijack th

23RISK

open ↗

Referência✓ VexDay Proof

evCal Events Calendar - Database Disclosure

CVE-2008-6356—webappsasp

evCal Events Calendar stores sensitive information under the web root with insufficient access control, which allows rem

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Internet Explorer 7 - Clickjacking

CVE-2009-0369—remotewindows

Microsoft Internet Explorer 7 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick acti

28RISK

open ↗

Referência✓ VexDay Proof

Oracle Internet Directory 10.1.4 - Remote Denial of Service

CVE-2008-2595—dosmultiple

Unspecified vulnerability in the Oracle Internet Directory component in Oracle Application Server 9.0.4.3, 10.1.2.3, and

28RISK

open ↗

Referência✓ VexDay Proof

WordPress Plugin st_newsletter - SQL Injection

CVE-2008-0683—webappsphp

SQL injection vulnerability in shiftthis-preview.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress al

23RISK

open ↗

Referência✓ VexDay Proof

Htaccess Passwort Generator 1.1 - 'ht_pfad' Remote File Inclusion

CVE-2007-1013—webappsphp

PHP remote file inclusion vulnerability in generate.php in VirtualSystem Htaccess Passwort Generator 1.1 allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

scWiki 1.0 Beta 2 - 'common.php?pathdot' Remote File Inclusion

CVE-2007-5843—webappsphp

PHP remote file inclusion vulnerability in includes/common.php in scWiki 1.0 Beta 2 allows remote attackers to execute a

35RISK

open ↗

Referência✓ VexDay Proof

elvin bts 1.2.0 - Multiple Vulnerabilities

CVE-2009-2123—webappsphp

Multiple SQL injection vulnerabilities in Elvin 1.2.0 allow remote attackers to execute arbitrary SQL commands via the (

23RISK

open ↗

Referência✓ VexDay Proof

Snircd 1.3.4 - 'send_user_mode' Denial of Service

CVE-2008-1501—dosmultiple

The send_user_mode function in s_user.c in (1) Undernet ircu 2.10.12.12 and earlier, (2) snircd 1.3.4 and earlier, and u

23RISK

open ↗

Referência✓ VexDay Proof

Vortex Portal 1.0.42 - Remote File Inclusion

CVE-2007-5842—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Vortex Portal 1.0.42 allow remote attackers to execute arbitrary P

35RISK

open ↗

Referência✓ VexDay Proof

SolarCMS 0.53.8 - 'Forum' Remote Cookies Disclosure

CVE-2008-6345—webappsphp

SQL injection vulnerability in Forum.php in SolarCMS 0.53.8 and 1.0 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component EasyBook 1.1 - 'gbid' SQL Injection

CVE-2008-2569—webappsphp

SQL injection vulnerability in the EasyBook (com_easybook) component 1.1 for Joomla! allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

Socketmail 2.2.8 - 'fnc-readmail3.php' Remote File Inclusion

CVE-2007-5627—webappsphp

PHP remote file inclusion vulnerability in content/fnc-readmail3.php in SocketMail 2.2.8 allows remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

Cisco Phone 7940 - Remote Denial of Service

CVE-2007-5583—doshardware

Cisco IP Phone 7940 with firmware P0S3-08-7-00 allows remote attackers to cause a denial of service ("486 Busy" response

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component beamospetition 1.0.12 - SQL Injection / Cross-Site Scripting

CVE-2009-0377—webappsphp

SQL injection vulnerability in the beamospetition (com_beamospetition) 1.0.12 component for Joomla! allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

NewsReactor 20070220 - Article Grabbing Remote Buffer Overflow (2)

CVE-2007-1568—remotewindows

Stack-based buffer overflow in DaanSystems NewsReactor 20070220.21 allows remote attackers to execute arbitrary code via

23RISK

open ↗

Referência✓ VexDay Proof

PLog 1.0.6 - 'albumID' SQL Injection

CVE-2008-2629—webappsphp

SQL injection vulnerability in the LifeType (formerly pLog) module for Drupal allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

RSS Simple News - SQL Injection

CVE-2008-6333—webappsphp

SQL injection vulnerability in news.php in RSS Simple News (RSSSN), when magic_quotes_gpc is disabled, allows remote att

23RISK

open ↗

Referência✓ VexDay Proof

TightVNC - Authentication Failure Integer Overflow (PoC)

CVE-2009-0388—doswindows

Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to ca

28RISK

open ↗

Referência✓ VexDay Proof

ezusermanager 1.6 - Remote File Inclusion

CVE-2006-2424—webappsphp

PHP remote file inclusion vulnerability in ezUserManager 1.6 and earlier, when register_globals is enabled, allows remot

23RISK

open ↗

Referência✓ VexDay Proof

WWWISIS 7.1 - 'IsisScript' Local File Disclosure / Cross-Site Scripting

CVE-2007-5455—webappscgi

Cross-site scripting (XSS) vulnerability in wxis.exe in WWWISIS 7.1 and earlier allows remote attackers to inject arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_colorlab 1.0 - Remote File Inclusion

CVE-2007-5451—webappsphp

PHP remote file inclusion vulnerability in admin.color.php in the com_colorlab (aka com_color) 1.0 component for Joomla!

35RISK

open ↗

Referência✓ VexDay Proof

WEBInsta FM 0.1.4 - 'login.php' absolute_path Remote File Inclusion

CVE-2007-2181—webappsphp

PHP remote file inclusion vulnerability in admin/login.php in Webinsta FM Manager 0.1.4 and earlier allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Ynews 1.0.0 - 'id' SQL Injection

CVE-2008-0653—webappsphp

SQL injection vulnerability in index.php in the Ynews (com_ynews) 1.0.0 component for Joomla! allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

PicoFlat CMS 0.4.14 - 'index.php' Remote File Inclusion

CVE-2007-5390—webappsphp

PHP remote file inclusion vulnerability in index.php in PicoFlat CMS 0.4.14 and earlier allows remote attackers to execu

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.