Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,627cataloged exploits
40,914CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,390VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
BXCP 0.2.9.9 - 'tid' SQL Injection
CVE-2006-0821—webappsphp
SQL injection vulnerability in index.php in BXCP 0.299 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência✓ VexDay Proof
Arcadem LE 2.04 - 'loadadminpage' Remote File Inclusion
CVE-2007-6542—webappsphp
PHP remote file inclusion vulnerability in admin/frontpage_right.php in Arcadem LE 2.04 and earlier allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
BlogHelper - Remote Configuration File Disclosure
CVE-2009-0826—webappsphp
BlogHelper stores common_db.inc under the web root with insufficient access control, which allows remote attackers to do
23RISK
open ↗
Referência✓ VexDay Proof
PHPizabi 0.848b C1 HFP1 - Arbitrary File Upload
CVE-2008-0805—webappsphp
Unrestricted file upload vulnerability in image.php in PHPizabi 0.848b C1 HFP1 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
SugarCRM Community Edition 4.5.1/5.0.0 - File Disclosure
CVE-2008-2045—webappsphp
Absolute path traversal vulnerability in SugarCRM Sugar Community Edition 4.5.1 and 5.0.0 allows remote attackers to rea
23RISK
open ↗
Referência✓ VexDay Proof
TYPSoft FTP Server 1.11 - 'ABORT' Remote Denial of Service
CVE-2009-1668—doswindows
TYPSoft FTP Server 1.11 allows remote attackers to cause a denial of service (CPU consumption) by sending an ABOR (abort
23RISK
open ↗
Referência✓ VexDay Proof
TEC-IT TBarCode - OCX ActiveX Arbitrary File Overwrite
CVE-2007-3233—remotewindows
The TEC-IT TBarCode OCX ActiveX control (TBarCode7.ocx) 7.0.2.3524 allows remote attackers to overwrite arbitrary files
23RISK
open ↗
Referência✓ VexDay Proof
CliServ Web Community 0.65 - 'cl_headers' Include
CVE-2006-7068—webappsphp
PHP remote file inclusion vulnerability in CliServ Web Community 0.65 and earlier allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Butterfly ORGanizer 2.0.1 - 'id' SQL Injection
CVE-2008-6328—webappsphp
SQL injection vulnerability in view.php in Butterfly Organizer 2.0.0 and 2.0.1 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
CMS NetCat 3.12 - 'password_recovery.php' Blind SQL Injection
CVE-2008-5727—webappsphp
SQL injection vulnerability in modules/auth/password_recovery.php in AIST NetCat 3.12 and earlier, when magic_quotes_gpc
23RISK
open ↗
Referência✓ VexDay Proof
muvee autoProducer 6.1 - 'TextOut.dll' ActiveX Remote Buffer Overflow
CVE-2008-2910—remotewindows
Buffer overflow in the DXTTextOutEffect ActiveX control (aka the Text-Effect DXT Filter), as distributed in TextOut.dll
23RISK
open ↗
Referência✓ VexDay Proof
Mozilla Firefox 3.0.6 - BODY onload Remote Crash
CVE-2009-0071—dosmultiple
Mozilla Firefox 3.0.5 and earlier 3.0.x versions, when designMode is enabled, allows remote attackers to cause a denial
23RISK
open ↗
Referência✓ VexDay Proof
RTS Sentry Digital Surveillance - 'CamPanel.dll 2.1.0.2' Remote Buffer Overflow
CVE-2008-4548—remotewindows
Stack-based buffer overflow in the PTZCamPanelCtrl ActiveX control (CamPanel.dll) in RTS Sentry 2.1.0.2 allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
Tours Manager 1.0 - SQL Injection
CVE-2008-6289—webappsphp
SQL injection vulnerability in cityview.php in Tours Manager 1.0 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
Forest Blog 1.3.2 - Remote Database Disclosure
CVE-2008-5780—webappsasp
Forest Blog 1.3.2 stores sensitive information under the web root with insufficient access control, which allows remote
23RISK
open ↗
Referência✓ VexDay Proof
ASP AutoDealer - Remote Database Disclosure
CVE-2008-5608—webappsasp
ASP AutoDealer stores sensitive information under the web root with insufficient access control, which allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
cmreams CMS 1.3.1.1 beta2 - Local File Inclusion / Cross-Site Scripting
CVE-2008-2984—webappsphp
Cross-site scripting (XSS) vulnerability in backend/umleitung.php in CMReams CMS 1.3.1.1 Beta 2 allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Poppler 0.8.4 - libpoppler Uninitialized pointer Code Execution
CVE-2008-2950—locallinux
The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not
28RISK
open ↗
Referência✓ VexDay Proof
forum livre 1.0 - SQL Injection / Cross-Site Scripting
CVE-2007-0590—webappsasp
Cross-site scripting (XSS) vulnerability in busca2.asp in Forum Livre 1.0 remote attackers to inject arbitrary web scrip
23RISK
open ↗
Referência✓ VexDay Proof
Ipswitch WS_FTP Home/Professional FTP Client - Remote Format String (PoC)
CVE-2008-3734—doswindows
Format string vulnerability in Ipswitch WS_FTP Home 2007.0.0.2 and WS_FTP Professional 2007.1.0.0 allows remote FTP serv
28RISK
open ↗
Referência✓ VexDay Proof
chernobiLe Portal 1.0 - 'default.asp' SQL Injection
CVE-2007-0582—webappsasp
SQL injection vulnerability in default.asp in ChernobiLe 1.0 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Full PHP Emlak Script - 'arsaprint.php' SQL Injection
CVE-2008-6133—webappsphp
SQL injection vulnerability in arsaprint.php in Full PHP Emlak Script allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
E-topbiz Link Back Checker 1 - Insecure Cookie Handling
CVE-2008-6307—webappsphp
E-topbiz Link Back Checker 1 allows remote attackers to bypass authentication and gain administrative access by setting
23RISK
open ↗
Referência✓ VexDay Proof
MoviePlay 4.76 - '.lst' Local Buffer Overflow
CVE-2007-0016—localwindows
Stack-based buffer overflow in MoviePlay 4.76 allows remote attackers to execute arbitrary code via a long filename in a
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component VirtueMart Google Base 1.1 - Remote File Inclusion
CVE-2008-6483—webappsphp
PHP remote file inclusion vulnerability in admin.googlebase.php in the Ecom Solutions VirtueMart Google Base (aka com_go
35RISK
open ↗
Referência✓ VexDay Proof
Advanced Login 0.7 - 'root' Remote File Inclusion
CVE-2007-1766—webappsphp
PHP remote file inclusion vulnerability in login/engine/db/profiledit.php in Advanced Login 0.76 and earlier allows remo
23RISK
open ↗
Referência✓ VexDay Proof
Madirish Webmail 2.0 - 'addressbook.php' Remote File Inclusion
CVE-2007-2826—webappsphp
PHP remote file inclusion vulnerability in lib/addressbook.php in Madirish Webmail 2.0 allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
WebChat 0.78 - 'login.php?rid' SQL Injection
CVE-2007-3534—webappsphp
SQL injection vulnerability in login.php in WebChat 0.78 allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Referência✓ VexDay Proof
Gforge 4.6 rc1 - 'skill_edit' SQL Injection
CVE-2008-6188—webappsphp
SQL injection vulnerability in people/editprofile.php in Gforge 4.6 rc1 and earlier allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
Acidcat CMS 3.4.1 - Multiple Vulnerabilities
CVE-2008-1991—webappsphp
Cross-site scripting (XSS) vulnerability in admin_colors_swatch.asp in Acidcat CMS 3.4.1 allows remote attackers to inje
23RISK
open ↗
← previouspage 660 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.