Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,640cataloged exploits

40,919CVEs with public exploitation

24,696lab-tested

All Referência 26,560Exploit-DB 24,489GitHub PoC 18,403VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

e107 Plugin alternate_profiles - 'id' SQL Injection

CVE-2008-4785—webappsphp

SQL injection vulnerability in newuser.php in the alternate_profiles plugin, possibly 0.2, for e107 allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

724CMS 4.01 Enterprise - 'index.php' SQL Injection

CVE-2008-1858—webappsphp

SQL injection vulnerability in index.php in 724Networks 724CMS 4.01 and earlier allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

VideoDB 2.2.1 - 'pdf.php' Remote File Inclusion

CVE-2006-5155—webappsphp

PHP remote file inclusion vulnerability in core/pdf.php in VideoDB 2.2.1 and earlier allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

MojoJobs - Blind SQL Injection

CVE-2008-3267—webappscgi

SQL injection vulnerability in mojoJobs.cgi in MojoJobs allows remote attackers to execute arbitrary SQL commands via th

23RISK

open ↗

Referência✓ VexDay Proof

Scout Portal Toolkit 1.4.0 - 'ParentId' SQL Injection

CVE-2005-4195—webappsphp

Multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

Pre Job Board - Authentication Bypass

CVE-2008-6329—webappsphp

SQL injection vulnerability in Employee/login.asp in Pre ASP Job Board allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

My PHP Dating - 'id' SQL Injection

CVE-2008-4705—webappsphp

SQL injection vulnerability in success_story.php in php Online Dating Software MyPHPDating allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

Free Photo Gallery Site Script - 'path' File Disclosure

CVE-2008-1730—webappsphp

Directory traversal vulnerability in download.html in ARWScripts Gallery Script Lite (aka gallery-script-lite or Free Ph

23RISK

open ↗

Referência✓ VexDay Proof

feedDemon 2.7 - OPML Outline Tag Buffer Overflow

CVE-2009-0546—localwindows

Stack-based buffer overflow in NewsGator FeedDemon 2.7 and earlier allows user-assisted remote attackers to execute arbi

50RISK

open ↗

Referência✓ VexDay Proof

Mantis Bug Tracker 1.1.3 - Remote Code Execution

CVE-2008-4687—webappsphp

manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort param

50RISK

open ↗

Referência✓ VexDay Proof

ChilkatHttp ActiveX 2.3 - Arbitrary Files Overwrite

CVE-2008-1647—remotewindows

The ChilkatHttp.ChilkatHttp.1 and ChilkatHttp.ChilkatHttpRequest.1 ActiveX controls in ChilkatHttp.dll 2.4.0.0, 2.3.0.0,

23RISK

open ↗

Referência✓ VexDay Proof

PHPWebGallery 1.7.2 - Session Hijacking / Code Execution

CVE-2008-4645—webappsphp

plugins/event_tracer/event_list.php in PhpWebGallery 1.7.2 and earlier allows remote authenticated administrators to exe

23RISK

open ↗

Referência✓ VexDay Proof

Leap CMS 0.1.4 - 'searchterm' Blind SQL Injection

CVE-2009-1613—webappsphp

Multiple SQL injection vulnerabilities in leap.php in Leap CMS 0.1.4, when magic_quotes_gpc is disabled, allow remote at

23RISK

open ↗

Referência✓ VexDay Proof

3editor CMS 0.42 - 'index.php' Local File Inclusion

CVE-2006-6877—webappsphp

Directory traversal vulnerability in index.php in Matteo Lucarelli 3editor CMS 0.42 and earlier, when register_globals i

23RISK

open ↗

Referência✓ VexDay Proof

HRS Multi - 'key' Blind SQL Injection

CVE-2008-3266—webappsasp

SQL injection vulnerability in picture_pic_bv.asp in SoftAcid Hotel Reservation System (HRS) Multi allows remote attacke

23RISK

open ↗

Referência✓ VexDay Proof

F3Site 2.1 - Remote Code Execution

CVE-2007-0764—webappsphp

Unrestricted file upload vulnerability in F3Site 2.1 and earlier allows remote authenticated administrators to upload an

23RISK

open ↗

Referência✓ VexDay Proof

Meeting Room Booking System (MRBS) < 1.4 - SQL Injection

CVE-2008-4620—webappsphp

SQL injection vulnerability in Meeting Room Booking System (MRBS) before 1.4 allows remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

RunCMS Module Photo 3.02 - 'cid' SQL Injection

CVE-2008-1551—webappsphp

SQL injection vulnerability in viewcat.php in the Photo 3.02 module for RunCMS allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Vivvo CMS 3.4 - 'index.php' Blind SQL Injection

CVE-2007-3939—webappsphp

SQL injection vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) CMS 3.4 and earlie

23RISK

open ↗

Referência✓ VexDay Proof

lustig.cms Beta 2.5 - 'forum.php?view' Remote File Inclusion

CVE-2007-5138—webappsphp

PHP remote file inclusion vulnerability in forum/forum.php in lustig.cms BETA 2.5 allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

KAPhotoservice - 'album.asp' SQL Injection

CVE-2008-1426—webappsasp

SQL injection vulnerability in album.asp in KAPhotoservice allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

ActiveBuyandSell 6.2 - 'buyersend.asp?catid' SQL Injection

CVE-2005-2062—webappsasp

Multiple SQL injection vulnerabilities in ActiveBuyAndSell 6.2 allow remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

phpFaber URLInn 2.0.5 - 'dir_ws' Remote File Inclusion

CVE-2007-5754—webappsphp

PHP remote file inclusion vulnerability in urlinn_includes/config.php in phpFaber URLInn 2.0.5 allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

Relative Real Estate Systems 3.0 - 'listing_id' SQL Injection

CVE-2008-2881—webappsphp

Relative Real Estate Systems 3.0 and earlier stores passwords in cleartext in a MySQL database, which allows context-dep

23RISK

open ↗

Referência✓ VexDay Proof

CMS Ortus 1.13 - SQL Injection

CVE-2008-6282—webappsphp

SQL injection vulnerability in engine/users/users_edit_pub.inc in CMS Ortus 1.13 and earlier allows remote authenticated

23RISK

open ↗

Referência✓ VexDay Proof

ProFTPd - 'mod_mysql' Authentication Bypass

CVE-2009-0542—remotemultiple

SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL co

45RISK

open ↗

Referência✓ VexDay Proof

blogit! - SQL Injection / File Disclosure / Cross-Site Scripting

CVE-2009-0335—webappsphp

Cross-site scripting (XSS) vulnerability in index.asp in Katy Whitton BlogIt! allows remote attackers to inject arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

Galerie 3.2 - 'pic' WBB Lite Addon Blind SQL Injection

CVE-2008-4516—webappsphp

SQL injection vulnerability in galerie.php in Galerie 3.2 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

Alt-N MDaemon IMAP server 9.6.4 - 'FETCH' Remote Buffer Overflow

CVE-2008-1358—remotewindows

Stack-based buffer overflow in the IMAP server in Alt-N Technologies MDaemon 9.6.4 allows remote authenticated users to

50RISK

open ↗

Referência✓ VexDay Proof

CMSbright - 'id_rub_page' SQL Injection

CVE-2008-6991—webappsphp

SQL injection vulnerability in public/page.php in Websens CMSbright allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.