Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,149cataloged exploits
40,888CVEs with public exploitation
24,696lab-tested
AllReferência 26,559Exploit-DB 24,489GitHub PoC 18,372VulnCheck XDB 10,605Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Cisco Router - HTTP Administration Cross-Site Request Forgery / Command Execution (1)
CVE-2008-4128HIGHunder attackremotehardware
Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the
83RISK
open ↗
Referência✓ VexDay Proof
bugmall shopping cart 2.5 - SQL Injection / Cross-Site Scripting
CVE-2007-3446—webappsphp
BugMall Shopping Cart 2.5 and earlier has a default username "demo" and password "demo," which allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
OWLLib 1.0 - 'OWLMemoryProperty.php' Remote File Inclusion
CVE-2006-6150—webappsphp
PHP remote file inclusion vulnerability in memory/OWLMemoryProperty.php in OWLLib 1.0 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Technote 7.2 - Remote File Inclusion
CVE-2009-0441—webappsphp
PHP remote file inclusion vulnerability in skin_shop/standard/2_view_body/body_default.php in TECHNOTE 7.2, when registe
23RISK
open ↗
Referência✓ VexDay Proof
BrowseDialog Class - 'ccrpbds6.dll' Multiple Denial of Service Vulnerabilities
CVE-2007-1162—doswindows
A certain ActiveX control in the Common Controls Replacement Project (CCRP) CCRP BrowseDialog Server (ccrpbds6.dll) allo
23RISK
open ↗
Referência✓ VexDay Proof
MyBulletinBoard (MyBB) 1.2.3 - Remote Code Execution
CVE-2007-1963—webappsphp
SQL injection vulnerability in the create_session function in class_session.php in MyBB (aka MyBulletinBoard) 1.2.3 and
23RISK
open ↗
Referência✓ VexDay Proof
Kartli Alisveris Sistemi 1.0 - SQL Injection
CVE-2007-3119—webappsasp
SQL injection vulnerability in news.asp in Kartli Alisveris Sistemi (aka Free-PayPal-Shopping-Cart) 1.0 allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
Pharmacy System 2.0 - 'index.php?ID' SQL Injection
CVE-2007-3433—webappsphp
SQL injection vulnerability in index.php in Pharmacy System 2 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
ACG-ScriptShop - 'cid' SQL Injection
CVE-2008-4144—webappsphp
SQL injection vulnerability in index.php in ACG-ScriptShop E-Gold Script Shop allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
addalink 4 - 'category_id' SQL Injection
CVE-2008-4145—webappsphp
SQL injection vulnerability in user_read_links.php in Addalink 1.0 beta 4 and earlier, when magic_quotes_gpc is disabled
23RISK
open ↗
Referência✓ VexDay Proof
Pluxml 0.3.1 - Remote Code Execution
CVE-2007-3432—webappsphp
Unrestricted file upload vulnerability in admin/images.php in Pluxml 0.3.1 allows remote attackers to upload and execute
23RISK
open ↗
Referência✓ VexDay Proof
Dimension of phpBB 0.2.6 - 'phpbb_root_path' Remote File Inclusions
CVE-2006-5222—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Dimension of phpBB 0.2.6 and earlier allow remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Netartmedia Car Portal 1.0 - Authentication Bypass
CVE-2009-0395—webappsphp
SQL injection vulnerability in the login feature in NetArt Media Car Portal 1.0 allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
b1gbb 2.24.0 - 'footer.inc.php?tfooter' Remote File Inclusion
CVE-2007-3401—webappsphp
PHP remote file inclusion vulnerability in footer.inc.php in B1G b1gBB 2.24 allows remote attackers to execute arbitrary
45RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module Zmagazine 1.0 - 'print.php' SQL Injection
CVE-2007-1974—webappsphp
SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as
23RISK
open ↗
Referência✓ VexDay Proof
Invision Gallery 2.0.7 - 'readfile()' / SQL Injection
CVE-2006-5206—webappsphp
SQL injection vulnerability in Invision Gallery 2.0.7 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência✓ VexDay Proof
SineCMS 2.3.4 - Calendar SQL Injection
CVE-2007-6367—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in the guestbook in SineCMS 2.3.4 and earlier allow remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin Photo album - SQL Injection
CVE-2008-0939—webappsphp
Multiple SQL injection vulnerabilities in wppa.php in the WP Photo Album (WPPA) before 1.1 plugin for WordPress allow re
23RISK
open ↗
Referência✓ VexDay Proof
MemHT Portal 3.9.0 - Remote Create Shell
CVE-2008-4164—webappsphp
cron.php in MemHT Portal 3.9.0 and earlier allows remote attackers to obtain sensitive information via a direct request,
23RISK
open ↗
Referência✓ VexDay Proof
PrecisionID Datamatrix - ActiveX Arbitrary File Overwrite
CVE-2009-1212—remotewindows
Multiple insecure method vulnerabilities in PRECIS~2.DLL in the PrecisionID Datamatrix ActiveX control (DMATRIXLib.Datam
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Office - MSODataSourceControl COM-object Buffer Overflow (PoC)
CVE-2007-3282—doswindows
Buffer overflow in the Microsoft Office MSODataSourceControl ActiveX object allows remote attackers to cause a denial of
35RISK
open ↗
Referência✓ VexDay Proof
Mambo Module Weather - 'absolute_path' Remote File Inclusion
CVE-2007-2044—webappsphp
PHP remote file inclusion vulnerability in mod_weather.php in the Antonis Ventouris Weather module for Mambo and Joomla!
23RISK
open ↗
Referência✓ VexDay Proof
Eudora 7.1.0.9 - IMAP FLAGS Remote Overwrite (SEH)
CVE-2007-3166—remotewindows
Buffer overflow in Qualcomm Eudora 7.1.0.9 allows user-assisted, remote IMAP servers to execute arbitrary code via a lon
23RISK
open ↗
Referência✓ VexDay Proof
Jupiter CMS 1.1.5 - Arbitrary File Upload
CVE-2007-0972—webappsphp
Unrestricted file upload vulnerability in modules/emoticons.php in Jupiter CMS 1.1.5 allows remote attackers to upload a
23RISK
open ↗
Referência✓ VexDay Proof
E-Uploader Pro 1.0 - Image Upload / Code Execution
CVE-2006-6694—webappsphp
Directory traversal vulnerability in include/config.php in E-Uploader Pro 1.0 and earlier allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Vivotek Motion Jpeg Control - 'MjpegDecoder.dll 2.0.0.13' Remote Overflow
CVE-2007-3167—remotewindows
Stack-based buffer overflow in the Vivotek Motion Jpeg ActiveX control (aka MjpegControl) in MjpegDecoder.dll 2.0.0.13 a
23RISK
open ↗
Referência✓ VexDay Proof
Hotel Reservation System - 'city.asp' Blind SQL Injection
CVE-2008-4204—webappsasp
SQL injection vulnerability in city.asp in SoftAcid Hotel Reservation System (HRS) allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Server - Code Execution (MS08-067)
CVE-2008-4250CRITICALunder attackremotewindows
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 20
100RISK
open ↗
Referência✓ VexDay Proof
Apple Mac OSX xnu 1228.3.13 - 'macfsstat' Local Kernel Memory Leak/Denial of Service
CVE-2009-1237—dososx
Multiple memory leaks in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allow local users to cause a den
23RISK
open ↗
Referência✓ VexDay Proof
ASP-DEV Internal E-Mail System - Authentication Bypass
CVE-2008-5926—webappsasp
Multiple SQL injection vulnerabilities in login.asp in ASP-DEv Internal E-Mail System allow remote attackers to execute
23RISK
open ↗
← previouspage 655 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.