Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,639cataloged exploits
40,918CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,402VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
WinPcap 4.0 - 'NPF.SYS' Local Privilege Escalation
CVE-2007-3681—localwindows
The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite
23RISK
open ↗
Referência✓ VexDay Proof
Bloginator 1a - SQL Injection / Command Injection (via Cookie Bypass )
CVE-2009-1049—webappsphp
SQL injection vulnerability in articleCall.php in Bloginator 1A allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
427bb 2.3.1 - SQL Injection / Cross-Site Scripting
CVE-2008-2561—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in 427BB 2.3.1 allow remote attackers to inject arbitrary web script
23RISK
open ↗
Referência✓ VexDay Proof
MyNews 4.2.2 - 'themefunc.php' Remote File Inclusion
CVE-2007-0633—webappsphp
PHP remote file inclusion vulnerability in include/themes/themefunc.php in MyNews 4.2.2 and earlier allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
LoudBlog 0.6.1 - 'parsedpage' Remote Code Execution
CVE-2008-0139—webappsphp
Eval injection vulnerability in loudblog/inc/parse_old.php in Loudblog 0.8.0 and earlier allows remote attackers to exec
28RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Link Directory - 'cat_id' SQL Injection
CVE-2008-6808—webappsphp
SQL injection vulnerability in links.php in Scripts for Sites (SFS) EZ Link Directory allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
ourvideo CMS 9.5 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2008-2979—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in phpi/login.php in Ourvideo CMS 9.5 allow remote attackers to inje
23RISK
open ↗
Referência✓ VexDay Proof
Merlix Teamworx Server - File Disclosure/Bypass
CVE-2008-5600—webappsphp
Merlix Teamworx Server stores sensitive information under the web root with insufficient access control, which allows re
23RISK
open ↗
Referência✓ VexDay Proof
miniPortail 2.2 - Cross-Site Scripting / Local File Inclusion
CVE-2008-6168—webappsphp
Cross-site scripting (XSS) vulnerability in search.php in miniPortail 2.2 and earlier allows remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
myPHPNuke < 1.8.8_8rc2 - Cross-Site Scripting / SQL Injection
CVE-2008-4089—webappsphp
Cross-site scripting (XSS) vulnerability in print.php in myPHPNuke (MPN) before 1.8.8_8rc2 allows remote attackers to in
23RISK
open ↗
Referência✓ VexDay Proof
ClanLite 2.x - SQL Injection / Cross-Site Scripting
CVE-2008-5214—webappsphp
Cross-site scripting (XSS) vulnerability in service/calendrier.php in ClanLite 2.2006.05.20 allows remote attackers to i
23RISK
open ↗
Referência✓ VexDay Proof
eDContainer 2.22 - Local File Inclusion
CVE-2008-5818—webappsphp
Directory traversal vulnerability in index.php in eDreamers eDContainer 2.22, when magic_quotes_gpc is disabled, allows
23RISK
open ↗
Referência✓ VexDay Proof
isweb CMS 3.0 - SQL Injection / Cross-Site Scripting
CVE-2008-5933—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in index.php in CMS ISWEB 3.0 allow remote attackers to inject arbit
23RISK
open ↗
Referência✓ VexDay Proof
WEBBDOMAIN WebShop 1.02 - SQL Injection / Cross-Site Scripting
CVE-2008-6629—webappsphp
Cross-site scripting (XSS) vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote a
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin E-Commerce 3.4 - Arbitrary File Upload
CVE-2008-6811—webappsphp
Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress al
23RISK
open ↗
Referência✓ VexDay Proof
TeamCalPro 3.1.000 - Multiple Local/Remote File Inclusions
CVE-2007-6553—webappsphp
Multiple PHP remote file inclusion vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
eZip Wizard 3.0 - Local Stack Buffer Overflow (PoC) (SEH)
CVE-2009-1057—doswindows
MicroSmarts Enterprise ZipItFast! 3.0 allows remote attackers to execute arbitrary code via a crafted .zip file that tri
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Fusion Module topliste 1.0 - 'cid' SQL Injection
CVE-2007-1980—webappsphp
SQL injection vulnerability in index.php in the Topliste 1.0 module for PHP-Fusion allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
Acidcat CMS 3.4.1 - Multiple Vulnerabilities
CVE-2008-1991—webappsphp
Cross-site scripting (XSS) vulnerability in admin_colors_swatch.asp in Acidcat CMS 3.4.1 allows remote attackers to inje
23RISK
open ↗
Referência✓ VexDay Proof
BibCiter 1.4 - Multiple SQL Injections
CVE-2009-0324—webappsphp
Multiple SQL injection vulnerabilities in BibCiter 1.4 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência✓ VexDay Proof
MKPortal 1.1.1 reviews / Gallery modules - SQL Injection
CVE-2007-3814—webappsphp
Multiple SQL injection vulnerabilities in MKPortal 1.1.1 allow remote attackers to execute arbitrary SQL commands via (1
23RISK
open ↗
Referência✓ VexDay Proof
AspPired2Poll 1.0 - 'MoreInfo.asp' SQL Injection
CVE-2006-5892—webappsasp
SQL injection vulnerability in MoreInfo.asp in The Net Guys ASPired2Poll 1.0 and earlier allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
Vigile CMS 1.4 - Multiple Vulnerabilities
CVE-2007-6085—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in index.php in VigileCMS 1.4 allow remote attackers to inject arbit
23RISK
open ↗
Referência✓ VexDay Proof
Micro CMS 0.3.5 - 'microcms_path' Remote File Inclusion
CVE-2006-3144—webappsphp
PHP remote file inclusion vulnerability in micro_cms_files/microcms-include.php in Implied By Design (IBD) Micro CMS 3.5
23RISK
open ↗
Referência✓ VexDay Proof
Pligg CMS 9.9.0 - 'story.php' SQL Injection
CVE-2008-3366—webappsphp
SQL injection vulnerability in story.php in Pligg CMS Beta 9.9.0 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
RhinoSoft Serv-U FTP Server 7.4.0.1 - 'MKD' Create Arbitrary Directories
CVE-2009-1031—remotewindows
Directory traversal vulnerability in the FTP server in Rhino Software Serv-U File Server 7.0.0.1 through 7.4.0.1 allows
28RISK
open ↗
Referência✓ VexDay Proof
Sami HTTP Server 2.0.1 - HTTP 404 Object not found Denial of Service
CVE-2007-0548—doswindows
KarjaSoft Sami HTTP Server 2.0.1 allows remote attackers to cause a denial of service (daemon hang) via a large number o
23RISK
open ↗
Referência✓ VexDay Proof
Exodus 0.10 - URI Handler Arbitrary Parameter Injection (1)
CVE-2008-6935—remotewindows
Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, over
23RISK
open ↗
Referência✓ VexDay Proof
OpenEMR 2.8.1 - 'srcdir' Multiple Remote File Inclusions
CVE-2006-5795—webappsphp
Multiple PHP remote file inclusion vulnerabilities in OpenEMR 2.8.1 and earlier, when register_globals is enabled, allow
23RISK
open ↗
Referência✓ VexDay Proof
YenerTurk Haber Script 1.0 - SQL Injection
CVE-2006-4064—webappsasp
SQL injection vulnerability in default.asp in YenerTurk Haber Script 1.0 and earlier allows remote attackers to execute
23RISK
open ↗
← previouspage 663 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.