Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,149cataloged exploits
40,888CVEs with public exploitation
24,696lab-tested
AllReferência 26,559Exploit-DB 24,489GitHub PoC 18,372VulnCheck XDB 10,605Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Apache mod_dav / svn - Remote Denial of Service
CVE-2009-1955—dosmultiple
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav
35RISK
open ↗
Referência✓ VexDay Proof
Apple Mac OSX xnu 1228.3.13 - 'Profil' Kernel Memory Leak/Denial of Service (PoC)
CVE-2009-1237—dososx
Multiple memory leaks in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allow local users to cause a den
23RISK
open ↗
Referência✓ VexDay Proof
Pre Survey Poll - 'catid' SQL Injection
CVE-2008-3310—webappsasp
SQL injection vulnerability in default.asp in Pre Survey Poll allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component mosDirectory 2.3.2 - Remote File Inclusion
CVE-2007-6555—webappsphp
PHP remote file inclusion vulnerability in modules/mod_pxt_latest.php in the mosDirectory (com_directory) 2.3.2 componen
23RISK
open ↗
Referência✓ VexDay Proof
Tutti Nova 1.6 - 'TNLIB_DIR' Remote File Inclusion
CVE-2006-4276—webappsphp
PHP remote file inclusion vulnerability in Tutti Nova 1.6 and earlier allows remote attackers to execute arbitrary PHP c
23RISK
open ↗
Referência✓ VexDay Proof
Rising AntiVirus Online Scanner - Insecure Method Flaw
CVE-2008-1116—remotewindows
Insecure method vulnerability in the Web Scan Object ActiveX control (OL2005.dll) in Rising Antivirus Online Scanner all
28RISK
open ↗
Referência✓ VexDay Proof
DB Top Sites 1.0 - Remote Command Execution
CVE-2009-2111—webappsphp
Static code injection vulnerability in add_reg.php in DB Top Sites 1.0 allows remote attackers to inject arbitrary PHP c
23RISK
open ↗
Referência✓ VexDay Proof
GreenCart PHP Shopping Cart - 'id' SQL Injection
CVE-2008-3585—webappsphp
Multiple SQL injection vulnerabilities in PozScripts GreenCart PHP Shopping Cart allow remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
events Calendar 1.1 - Remote File Inclusion
CVE-2008-4673—webappsphp
PHP remote file inclusion vulnerability in panel/common/theme/default/header_setup.php in WebBiscuits Software Events Ca
23RISK
open ↗
Referência✓ VexDay Proof
SportsPHool 1.0 - 'mainnav' Remote File Inclusion
CVE-2006-4278—webappsphp
PHP remote file inclusion vulnerability in includes/layout/plain.footer.php in SportsPHool 1.0 allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
PromoteWeb MySQL - 'id' SQL Injection
CVE-2008-5069—webappsphp
SQL injection vulnerability in go.php in Panuwat PromoteWeb MySQL, when magic_quotes_gpc is disabled, allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
Simple Text-File Login script (SiTeFiLo) 1.0.6 - File Disclosure / Remote File Inclusion
CVE-2008-5762—webappsphp
Simple Text-File Login Script (SiTeFiLo) 1.0.6 stores sensitive information under the web root with insufficient access
23RISK
open ↗
Referência✓ VexDay Proof
YouTube blog 0.1 - Remote File Inclusion / SQL Injection / Cross-Site Scripting
CVE-2008-3307—webappsphp
SQL injection vulnerability in todos.php in C. Desseno YouTube Blog (ytb) 0.1 allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
Yahoo! Music JukeBox 2.2 - 'AddButton()' ActiveX Remote Buffer Overflow
CVE-2008-0624—remotewindows
Buffer overflow in the YMP Datagrid ActiveX control (datagrid.dll) in Yahoo! JukeBox 2.2.2.56 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
PHPSiteBackup 0.1 - 'pcltar.lib.php' Remote File Inclusion
CVE-2007-2199—webappsphp
PHP remote file inclusion vulnerability in lib/pcltar.lib.php (aka pcltar.php) in the PclTar module 1.3 and 1.3.1 for Vi
35RISK
open ↗
Referência✓ VexDay Proof
TorrentVolve 1.4 - 'deleteTorrent' Delete Arbitrary File
CVE-2009-2101—webappsphp
Directory traversal vulnerability in archive.php in TorrentVolve 1.4, when register_globals is enabled, allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
forum livre 1.0 - SQL Injection / Cross-Site Scripting
CVE-2007-0589—webappsasp
SQL injection vulnerability in Forum Livre 1.0 allows remote attackers to execute arbitrary SQL commands via the user pa
23RISK
open ↗
Referência✓ VexDay Proof
my-colex 1.4.2 - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2009-1825—webappsphp
modules/admuser.php in myColex 1.4.2 does not require administrative authentication, which allows remote authenticated u
23RISK
open ↗
Referência✓ VexDay Proof
Newxooper-PHP 0.9.1 - 'mapage.php' Remote File Inclusion
CVE-2006-6711—webappsphp
PHP remote file inclusion vulnerability in compteur/mapage.php in Newxooper 0.9.1 allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
GuestCal 2.1 - 'index.php?lang' Local File Inclusion
CVE-2009-1319—webappsphp
Directory traversal vulnerability in includes/ini.inc.php in GuestCal 2.1 allows remote attackers to include and execute
23RISK
open ↗
Referência✓ VexDay Proof
SysInfo 1.21 - 'sysinfo.cgi' Remote Command Execution
CVE-2006-1831—webappscgi
Direct static code injection vulnerability in sysinfo.cgi in sysinfo 1.21 and possibly other versions before 2.25 allows
23RISK
open ↗
Referência✓ VexDay Proof
Original 0.11 - 'config.inc.php?x[1]' Remote File Inclusion
CVE-2007-2620—webappsphp
PHP remote file inclusion vulnerability in inc/config.inc.php in Jakub Steiner (aka jimmac) original 0.11 allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Fantastic News 2.1.3 - 'script_path' Remote File Inclusion
CVE-2006-4285—webappsphp
PHP remote file inclusion vulnerability in news.php in Fantastic News 2.1.3 and earlier allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
Active Web Mail 4 - Blind SQL Injection
CVE-2008-6873—webappsasp
SQL injection vulnerability in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL commands via the Tab
23RISK
open ↗
Referência✓ VexDay Proof
FaceBook PhotoUploader 5.0.14.0 - Remote Buffer Overflow
CVE-2008-5711—remotewindows
Heap-based buffer overflow in the Facebook PhotoUploader ActiveX control 5.0.14.0 and earlier allows remote attackers to
50RISK
open ↗
Referência✓ VexDay Proof
bilboblog 2.1 - Multiple Vulnerabilities
CVE-2008-3304—webappsphp
BilboBlog 0.2.1 allows remote attackers to obtain sensitive information via (1) an enable_cache=false query string to fo
23RISK
open ↗
Referência✓ VexDay Proof
Quicksilver Forums 1.4.1 - SQL Injection
CVE-2008-3601—webappsphp
SQL injection vulnerability in index.php in Quicksilver Forums 1.4.1 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
WEBBDOMAIN Petition 1.02/2.0/3.0 - Authentication Bypass
CVE-2008-6624—webappsphp
SQL injection vulnerability in getin.php in WEBBDOMAIN Petition 1.02, 2.0, and 3.0 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
eXV2 Module MyAnnonces - 'lid' SQL Injection
CVE-2008-1406—webappsphp
SQL injection vulnerability in annonces-p-f.php in the MyAnnonces 1.8 module for eXV2 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
fresh email script 1.0 - Multiple Vulnerabilities
CVE-2008-7043—webappsphp
Cross-site scripting (XSS) vulnerability in register.php in FreshScripts Fresh Email Script 1.0 through 1.11 allows remo
23RISK
open ↗
← previouspage 654 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.