Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,162cataloged exploits
40,894CVEs with public exploitation
24,696lab-tested
AllReferência 26,559Exploit-DB 24,489GitHub PoC 18,385VulnCheck XDB 10,605Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
tbdev 01-01-2008 - Multiple Vulnerabilities
CVE-2009-2138—webappsphp
Multiple open redirect vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to redirect users to arbitrary web s
23RISK
open ↗
Referência✓ VexDay Proof
Profense Web Application Firewall 2.6.2 - Cross-Site Request Forgery / Cross-Site Scripting
CVE-2009-0467—remotewindows
Cross-site scripting (XSS) vulnerability in proxy.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allows remot
23RISK
open ↗
Referência✓ VexDay Proof
Xcode OpenBase 10.0.0 (OSX) - Symlink Privilege Escalation
CVE-2006-5851—localosx
openexec in OpenBase SQL before 10.0.1 allows local users to create arbitrary files via a symlink attack on the /tmp/out
23RISK
open ↗
Referência✓ VexDay Proof
unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities
CVE-2009-1947—webappsphp
SQL injection vulnerability in the UnbDbEncode function in unb_lib/database.lib.php in Unclassified NewsBoard (UNB) 1.6.
23RISK
open ↗
Referência✓ VexDay Proof
How2ASP.net WebBoard 4.1 - SQL Injection
CVE-2008-2417—webappsphp
SQL injection vulnerability in showQAnswer.asp in How2ASP.net Webboard 4.1 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Password Protector SD 1.3.1 - Insecure Cookie Handling
CVE-2009-2003—webappsphp
Ascad Networks Password Protector SD 1.3.1 allows remote attackers to bypass authentication and gain administrative acce
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component prayercenter 1.4.9 - 'id' SQL Injection
CVE-2008-6429—webappsphp
SQL injection vulnerability in the PrayerCenter (com_prayercenter) component 1.4.9 and earlier for Joomla! allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Admin Phorum 3.3.1a - 'del.php?include_path' Remote File Inclusion
CVE-2007-1219—webappsphp
PHP remote file inclusion vulnerability in actions/del.php in Admin Phorum 3.3.1a allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Advanced Webhost Billing System (AWBS) 2.7.1 - 'news.php' SQL Injection
CVE-2008-2903—webappsphp
SQL injection vulnerability in news.php in Advanced Webhost Billing System (AWBS) 2.3.3 through 2.7.1, when magic_quotes
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component MooFAQ (com_moofaq) - Local File Inclusion
CVE-2009-2015—webappsphp
Directory traversal vulnerability in includes/file_includer.php in the Ideal MooFAQ (com_moofaq) component 1.0 for Jooml
38RISK
open ↗
Referência✓ VexDay Proof
virtue news - SQL Injection / Cross-Site Scripting
CVE-2009-2020—webappsphp
Cross-site scripting (XSS) vulnerability in news_detail.php in Virtue News Manager allows remote attackers to inject arb
23RISK
open ↗
Referência✓ VexDay Proof
WebChamado 1.1 - Arbitrary Add Admin
CVE-2008-2907—webappsphp
SQL injection vulnerability in admin/index.php in WebChamado 1.1, when magic_quotes_gpc is disabled, allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
Virtue Book Store - 'cid' SQL Injection
CVE-2009-2017—webappsphp
SQL injection vulnerability in products.php in Virtue Book Store allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
virtue news - SQL Injection / Cross-Site Scripting
CVE-2009-2019—webappsphp
SQL injection vulnerability in news_detail.php in Virtue News Manager allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
PHPCollegeExchange 0.1.5c - 'listing_view.php?itemnr' SQL Injection
CVE-2009-2096—webappsphp
SQL injection vulnerability in house/listing_view.php in phpCollegeExchange 0.1.5c allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
NukeSentinel 2.5.05 - 'nsbypass.php' Blind SQL Injection
CVE-2007-1171—webappsphp
SQL injection vulnerability in includes/nsbypass.php in NukeSentinel 2.5.05, 2.5.11, and other versions before 2.5.12 al
23RISK
open ↗
Referência✓ VexDay Proof
OpenRat 0.8-beta4 - 'tpl_dir' Remote File Inclusion
CVE-2008-6403—webappsphp
PHP remote file inclusion vulnerability in themes/default/include/html/insert.inc.php in OpenRat 0.8-beta4 and earlier a
23RISK
open ↗
Referência✓ VexDay Proof
Cold BBS - Remote Database Disclosure
CVE-2008-5597—webappsasp
Cold BBS stores sensitive information under the web root with insufficient access control, which allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
TurboFTP Server 5.30 Build 572 - 'newline/LIST' Multiple Remote Denial of Service Vulnerabilities
CVE-2007-1080—doswindows
Multiple heap-based buffer overflows in TurboFTP 5.30 Build 572 allow remote servers to cause a denial of service via (1
23RISK
open ↗
Referência✓ VexDay Proof
PHP Classifieds 7.1 - 'detail.php' SQL Injection
CVE-2006-5828—webappsphp
SQL injection vulnerability in detail.php in DeltaScripts PHP Classifieds 7.1 and earlier allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Discussion Forums 2k 3.3 - Multiple SQL Injections
CVE-2008-6100—webappsphp
Multiple SQL injection vulnerabilities in Discussion Forums 2k 3.3, when magic_quotes_gpc is disabled, allow remote atta
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Thyme 1.0 - SQL Injection
CVE-2008-6116—webappsphp
SQL injection vulnerability in the EXtrovert Software Thyme (com_thyme) 1.0 component for Joomla! allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
FretsWeb 1.2 - Multiple Local File Inclusions
CVE-2009-2109—webappsphp
Multiple directory traversal vulnerabilities in FretsWeb 1.2 allow remote attackers to read arbitrary files via director
23RISK
open ↗
Referência✓ VexDay Proof
Quick Tree View .NET 3.1 - Database Disclosure
CVE-2008-6387—webappsphp
Quick Tree View .NET 3.1 stores sensitive information under the web root with insufficient access control, which allows
23RISK
open ↗
Referência✓ VexDay Proof
phpBB PlusXL 2.0_272 - 'constants.php' Remote File Inclusion
CVE-2006-5387—webappsphp
PHP remote file inclusion vulnerability in mods/iai/includes/constants.php in the PlusXL 20_272 and earlier phpBB module
23RISK
open ↗
Referência✓ VexDay Proof
ASP AutoDealer - SQL Injection / File Disclosure
CVE-2008-5595—webappsasp
SQL injection vulnerability in detail.asp in ASP AutoDealer allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
FTP Voyager 14.0.0.3 - 'CWD' Remote Stack Overflow (PoC)
CVE-2007-1079—doswindows
Stack-based buffer overflow in Rhino Software, Inc. FTP Voyager 14.0.0.3 and earlier allows remote servers to cause a de
23RISK
open ↗
Referência✓ VexDay Proof
Trawler Web CMS 1.8.1 - Multiple Remote File Inclusions
CVE-2006-5495—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Trawler Web CMS 1.8.1 and earlier allow remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
campus virtual-lms - Cross-Site Scripting / SQL Injection
CVE-2009-2148—webappsphp
SQL injection vulnerability in news/index.php in Campus Virtual-LMS allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
PHPFK 7.03 - 'page_bottom.php' Local File Inclusion
CVE-2009-2112—webappsphp
Directory traversal vulnerability in include/page_bottom.php in phpFK 7.03 allows remote attackers to include and execut
23RISK
open ↗
← previouspage 658 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.