Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,627cataloged exploits
40,914CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,390VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Samsung DVR SHR2040 - HTTPd Remote Denial of Service Denial of Service (PoC)
CVE-2008-4380—doshardware
The web interface in Samsung DVR SHR2040 allows remote attackers to cause a denial of service (crash) via a malformed HT
23RISK
open ↗
Referência✓ VexDay Proof
AllMyGuests 0.3.0 - 'AMG_serverpath' Remote File Inclusion
CVE-2007-0172—webappsphp
Multiple PHP remote file inclusion vulnerabilities in AllMyGuests 0.3.0 and earlier allow remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
i.Scribe SMTP Client 2.00b - 'wscanf' Remote Format String (PoC)
CVE-2008-7074—doswindows
Format string vulnerability in MemeCode Software i.Scribe 1.88 through 2.00 before Beta9 allows remote SMTP servers to c
23RISK
open ↗
Referência✓ VexDay Proof
Macromedia Flash 8 (Flash8b.ocx) Internet Explorer 7 - Denial of Service
CVE-2006-6827—doswindows
Flash8b.ocx in Macromedia Flash 8 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a
23RISK
open ↗
Referência✓ VexDay Proof
Mole Group Last Minute Script 4.0 - SQL Injection
CVE-2008-3125—webappsphp
SQL injection vulnerability in index.php in Mole Group Lastminute Script 4.0 allows remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Total Video Player 1.20 - '.m3u' File Local Stack Buffer Overflow
CVE-2007-0949—localwindows
Stack-based buffer overflow in iTinySoft Studio Total Video Player 1.03, and possibly earlier, allows remote attackers t
28RISK
open ↗
Referência✓ VexDay Proof
Geeklog 2 - 'BaseView.php' Remote File Inclusion
CVE-2007-0810—webappsphp
PHP remote file inclusion vulnerability in MVCnPHP/BaseView.php in GeekLog 2 and earlier allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
BuzzyWall 1.3.1 - 'search' SQL Injection
CVE-2008-6029—webappsphp
SQL injection vulnerability in search.php in BuzzyWall 1.3.1 and earlier, when magic_quotes_gpc is disabled, allows remo
23RISK
open ↗
Referência✓ VexDay Proof
Vastal I-Tech Dating Zone - 'fage' SQL Injection
CVE-2008-4461—webappsphp
SQL injection vulnerability in advanced_search_results.php in Vastal I-Tech Dating Zone, possibly 0.9.9, allows remote a
23RISK
open ↗
Referência✓ VexDay Proof
Downline Goldmine newdownlinebuilder - SQL Injection
CVE-2008-4178—webappsphp
SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and D
23RISK
open ↗
Referência✓ VexDay Proof
cmreams CMS 1.3.1.1 beta2 - Local File Inclusion / Cross-Site Scripting
CVE-2008-2985—webappsphp
Directory traversal vulnerability in load_language.php in CMReams CMS 1.3.1.1 Beta 2, when register_globals is enabled,
23RISK
open ↗
Referência✓ VexDay Proof
RiotPix 0.61 - 'forumid' Blind SQL Injection
CVE-2009-0110—webappsphp
SQL injection vulnerability in read.php in RiotPix 0.61 and earlier allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
Realtor 747 - 'define.php?INC_DIR' Remote File Inclusion
CVE-2009-0495—webappsphp
PHP remote file inclusion vulnerability in include/define.php in REALTOR 747 4.11 allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Web Wiz Forums 9.07 - 'sub' Directory Traversal
CVE-2008-0466—webappsasp
Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02,
23RISK
open ↗
Referência✓ VexDay Proof
LimeSurvey 1.52 - 'language.php' Remote File Inclusion
CVE-2007-5573—webappsphp
PHP remote file inclusion vulnerability in classes/core/language.php in LimeSurvey 1.5.2 and earlier allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin Wp-FileManager 1.2 - Arbitrary File Upload
CVE-2008-0222—webappsphp
Unrestricted file upload vulnerability in ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for WordPress allows remo
23RISK
open ↗
Referência✓ VexDay Proof
Titan FTP Server 6.03 - 'USER/PASS' Remote Heap Overflow (PoC)
CVE-2008-0702—doswindows
Multiple heap-based buffer overflows in Titan FTP Server 6.03 and 6.0.5.549 allow remote attackers to cause a denial of
38RISK
open ↗
Referência✓ VexDay Proof
PORAR WebBoard - 'question.asp' SQL Injection
CVE-2008-1039—webappsasp
SQL injection vulnerability in question.asp in PORAR WEBBOARD allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Mini File Host 1.x - Arbitrary '.PHP' File Upload
CVE-2008-6785—webappsphp
Unrestricted file upload vulnerability in Mini File Host 1.5 allows remote attackers to execute arbitrary code by upload
23RISK
open ↗
Referência✓ VexDay Proof
SG Real Estate Portal 2.0 - Blind SQL Injection / Local File Inclusion
CVE-2008-6011—webappsphp
SQL injection vulnerability in index.php in SG Real Estate Portal 2.0 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
ESPG (Enhanced Simple PHP Gallery) 1.72 - File Disclosure
CVE-2009-0331—webappsphp
Directory traversal vulnerability in gallery/comment.php in Enhanced Simple PHP Gallery (ESPG) 1.72 allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
PHPMyDesk 1.0 Beta - 'viewticket.php' Local File Inclusion
CVE-2006-7132—webappsphp
Directory traversal vulnerability in pmd-config.php in PHPMyDesk 1.0beta allows remote attackers to include arbitrary lo
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Brightcode Weblinks - 'catid' SQL Injection
CVE-2008-3083—webappsphp
SQL injection vulnerability in Brightcode Weblinks (com_brightweblinks) component for Joomla! allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
IrfanView 4.00 - '.iff' Local Buffer Overflow
CVE-2007-2363—localwindows
Buffer overflow in IrfanView 4.00 and earlier allows user-assisted remote attackers to execute arbitrary code via a craf
23RISK
open ↗
Referência✓ VexDay Proof
GNU/Linux mbse-bbs 0.70.0 - Local Buffer Overflow
CVE-2007-0368—locallinux
Stack-based buffer overflow in mbse-bbs 0.70 and earlier allows local users to execute arbitrary code via a long string
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Module MambWeather 1.8.1 - Remote File Inclusion
CVE-2006-5519—webappsphp
PHP remote file inclusion vulnerability in Savant2/Savant2_Plugin_options.php in the MambWeather 1.8.1 and earlier compo
23RISK
open ↗
Referência✓ VexDay Proof
Social Engine 2.0 - Multiple Local File Inclusions
CVE-2007-6581—webappsphp
Multiple directory traversal vulnerabilities in Social Engine 2.0 allow remote attackers to include and execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
XChat 2.6.7 (Windows) - Remote Denial of Service
CVE-2006-4455—doswindows
Unspecified vulnerability in Xchat 2.6.7 and earlier allows remote attackers to cause a denial of service (crash) via un
23RISK
open ↗
Referência✓ VexDay Proof
Vastal I-Tech MMORPG Zone - 'game_id' SQL Injection
CVE-2008-4460—webappsphp
SQL injection vulnerability in game.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Shadowed Portal Module Character Roster - 'mod_root' Remote File Inclusion
CVE-2006-6850—webappsphp
PHP remote file inclusion vulnerability in include.php in the Roster Module (character_roster) in Shadowed Portal 5.7 al
23RISK
open ↗
← previouspage 659 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.