Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,636cataloged exploits

40,917CVEs with public exploitation

24,696lab-tested

All Referência 26,560Exploit-DB 24,489GitHub PoC 18,399VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery

CVE-2008-7056—webappsphp

BandSite CMS 1.1.4 does not perform access control for adminpanel/phpmydump.php, which allows remote attackers to obtain

23RISK

open ↗

Referência✓ VexDay Proof

Kravchuk letter script 1.0 - 'scdir' Remote File Inclusion

CVE-2007-3118—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Kravchuk letter (K-letter) 1.0 allow remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

CoD2: DreamStats 4.2 - 'index.php' Remote File Inclusion

CVE-2007-0757—webappsphp

PHP remote file inclusion vulnerability in index.php in Miguel Nunes Call of Duty 2 (CoD2) DreamStats System 4.2 and ear

23RISK

open ↗

Referência✓ VexDay Proof

BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery

CVE-2008-7057—webappsphp

Cross-site scripting (XSS) vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbi

23RISK

open ↗

Referência✓ VexDay Proof

PHPLibrary 1.5.3 - 'grid3.lib.php' Remote File Inclusion

CVE-2006-5471—webappsphp

PHP remote file inclusion vulnerability in example/lib/grid3.lib.php in Softerra PHP Developer Library 1.5.3 and earlier

23RISK

open ↗

Referência✓ VexDay Proof

nsGalPHP - '/includes/config.inc.php?racineTBS' Remote File Inclusion

CVE-2007-0573—webappsphp

PHP remote file inclusion vulnerability in includes/config.inc.php in nsGalPHP 0.41 and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

EclipseBB 0.5.0 Lite - 'phpbb_root_path' Remote File Inclusion

CVE-2007-0581—webappsphp

PHP remote file inclusion vulnerability in functions.php in EclipseBB 0.5.0 Lite allows remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

Galatolo Web Manager 1.3a - Cross-Site Scripting / SQL Injection

CVE-2008-6249—webappsphp

SQL injection vulnerability in plugins/users/index.php in Galatolo WebManager 1.3a and earlier allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

Pie Web m{a_e}sher mod rss 0.1 - Remote File Inclusion

CVE-2008-7073—webappsphp

PHP remote file inclusion vulnerability in lib/action/rss.php in RSS module 0.1 for Pie Web M{a,e}sher, when register_gl

23RISK

open ↗

Referência✓ VexDay Proof

Shop Script Pro 2.12 - SQL Injection

CVE-2009-2023—webappsphp

SQL injection vulnerability in index.php in Shop-Script Pro 2.12, when magic_quotes_gpc is disabled, allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

N/X WCMS 4.1 - 'nxheader.inc.php' Remote File Inclusion

CVE-2006-5625—webappsphp

PHP remote file inclusion vulnerability in wwwdev/nxheader.inc.php in N/X 2002 Professional Edition Web Content Manageme

23RISK

open ↗

Referência✓ VexDay Proof

Active Test 2.1 - Authentication Bypass

CVE-2008-5959—webappsasp

Multiple SQL injection vulnerabilities in start.asp in Active Test 2.1 allow remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

TFTP Server for Windows 1.4 - ST Remote BSS Overflow

CVE-2008-2161—remotewindows

Buffer overflow in TFTP Server SP 1.4 and 1.5 on Windows, and possibly other versions, allows remote attackers to execut

50RISK

open ↗

Referência✓ VexDay Proof

Mambo Component Shambo2 - 'itemID' SQL Injection

CVE-2008-0606—webappsphp

SQL injection vulnerability in index.php in the Shambo2 (com_shambo2) component for Mambo and Joomla! allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

Sponge News 2.2 - 'sndir' Remote File Inclusion

CVE-2006-4647—webappsphp

PHP remote file inclusion vulnerability in news.php in Sponge News 2.2 and earlier allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

PhpCommander 3.0 - 'upload' Remote Code Execution

CVE-2006-4636—webappsphp

Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute a

23RISK

open ↗

Referência✓ VexDay Proof

CMS Frogss 0.4 - 'podpis' SQL Injection

CVE-2006-4536—webappsphp

SQL injection vulnerability in module/rejestracja.php in CMS Frogss 0.4 and earlier allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

AsteriDex 3.0 - 'callboth.php' Remote Code Execution

CVE-2007-3621—webappsphp

Multiple CRLF injection vulnerabilities in callboth.php in AsteriDex 3.0 and earlier allow remote attackers to inject ar

23RISK

open ↗

Referência✓ VexDay Proof

Michelles L2J Dropcalc 4 - SQL Injection

CVE-2007-0687—webappsphp

SQL injection vulnerability in i-search.php in Michelle's L2J Dropcalc 4 and earlier allows remote authenticated users t

23RISK

open ↗

Referência✓ VexDay Proof

KwsPHP 1.0 Module Newsletter - SQL Injection

CVE-2007-5458—webappsphp

SQL injection vulnerability in index.php in the newsletter module 1.0 for KwsPHP, when magic_quotes_gpc is disabled, all

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Internet Explorer 6 / Provideo Camimage - 'ISSCamControl.dll 1.0.1.5' Remote Buffer Overflow

CVE-2007-3111—remotewindows

Buffer overflow in the Provideo Camimage ActiveX control in ISSCamControl.dll 1.0.1.5, when Internet Explorer 6 is used

35RISK

open ↗

Referência✓ VexDay Proof

eXtremail 2.1.1 - 'memmove()' Remote Denial of Service

CVE-2007-5467—doslinux

Integer overflow in eXtremail 2.1.1 and earlier allows remote attackers to cause a denial of service, and possibly execu

28RISK

open ↗

Referência✓ VexDay Proof

PHPEasyData Pro 2.2.2 - 'index.php' SQL Injection

CVE-2006-5707—webappsphp

SQL injection vulnerability in index.php in PHPEasyData Pro 1.4.1 and 2.2.1 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Chicken of the VNC 2.0 - 'NULL-pointer' Remote Denial of Service

CVE-2007-0756—dososx

Chicken of the VNC (cotv) 2.0 allows remote attackers to cause a denial of service (application crash) via a large compu

23RISK

open ↗

Referência✓ VexDay Proof

Professional Download Assistant 0.1 - Database Disclosure

CVE-2008-5572—webappsasp

Professional Download Assistant 0.1 stores sensitive information under the web root with insufficient access control, wh

23RISK

open ↗

Referência✓ VexDay Proof

BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery

CVE-2008-7058—webappsphp

Cross-site request forgery (CSRF) vulnerability in BandSite CMS 1.1.4 allows remote attackers to hijack the authenticati

23RISK

open ↗

Referência✓ VexDay Proof

Goople 1.8.2 - 'FrontPage.php' Blind SQL Injection

CVE-2009-0111—webappsphp

SQL injection vulnerability in frontpage.php in Goople CMS 1.8.2 and earlier allows remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

Asterisk 1.2.x - SIP channel driver / in pedantic mode Remote Crash

CVE-2008-2119—dosmultiple

Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic pa

23RISK

open ↗

Referência✓ VexDay Proof

Simple Customer 1.2 - Authentication Bypass

CVE-2008-6332—webappsphp

SQL injection vulnerability in login.php in Simple Customer 1.2 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

IceBB 1.0-rc5 - Remote Create Admin

CVE-2007-1725—webappsphp

SQL injection vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to execute arbitrary SQL com

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.