Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,642cataloged exploits

40,921CVEs with public exploitation

24,696lab-tested

All Referência 26,560Exploit-DB 24,489GitHub PoC 18,405VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

pastelcms 0.8.0 - Local File Inclusion / SQL Injection

CVE-2009-1404—webappsphp

SQL injection vulnerability in admin.php in PastelCMS 0.8.0, when magic_quotes_gpc is disabled, allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

All Club CMS 0.0.2 - 'index.php' SQL Injection

CVE-2008-0601—webappsphp

SQL injection vulnerability in index.php in All Club CMS (ACCMS) 0.0.1f and earlier allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

Google Chrome 1.0.154.53 - Null Pointer Remote Crash

CVE-2009-1514—doswindows

Google Chrome 1.0.154.53 allows remote attackers to cause a denial of service (NULL pointer dereference and application

23RISK

open ↗

Referência✓ VexDay Proof

Absolute Form Processor XE-V 1.5 - Insecure Cookie Handling

CVE-2009-1504—webappsasp

Absolute Form Processor XE 1.5 allows remote attackers to bypass authentication and gain administrative access by settin

23RISK

open ↗

Referência✓ VexDay Proof

Kmita Tellfriend 2.0 - 'file' Remote File Inclusion

CVE-2008-2198—webappsphp

PHP remote file inclusion vulnerability in kmitaadmin/kmitat/htmlcode.php in Kmita Tellfriend 2.0 and earlier, when regi

23RISK

open ↗

Referência✓ VexDay Proof

fungamez rc1 - Authentication Bypass / Local File Inclusion

CVE-2009-1489—webappsphp

includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by set

23RISK

open ↗

Referência✓ VexDay Proof

PortalApp 4.0 - SQL Injection / Cross-Site Scripting / Authentication Bypass

CVE-2008-4613—webappsasp

SQL injection vulnerability in forums.asp in PortalApp 4.0 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

FLABER 1.1 RC1 - Remote Command Execution

CVE-2008-6490—webappsphp

function/update_xml.php in FLABER 1.1 and earlier allows remote attackers to overwrite arbitrary files by specifying the

23RISK

open ↗

Referência✓ VexDay Proof

eSHOP100 - 'SUB' SQL Injection

CVE-2008-5190—webappsphp

SQL injection vulnerability in index.php in eSHOP100 allows remote attackers to execute arbitrary SQL commands via the S

23RISK

open ↗

Referência✓ VexDay Proof

Netartmedia Jobs Portal 1.3 - Multiple SQL Injections

CVE-2008-6030—webappsphp

Multiple SQL injection vulnerabilities in NetArtMedia Jobs Portal 1.3 allow remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

SunShop Shopping Cart 4.1.4 - 'id' SQL Injection

CVE-2008-3768—webappsphp

Multiple SQL injection vulnerabilities in class.ajax.php in Turnkey Web Tools SunShop Shopping Cart before 4.1.5 allow r

23RISK

open ↗

Referência✓ VexDay Proof

TopperMod 2.0 - SQL Injection

CVE-2008-1554—webappsphp

SQL injection vulnerability in account/index.php in TopperMod 2.0, when magic_quotes_gpc is disabled, allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

OpenX 2.6 - 'bannerid' Blind SQL Injection

CVE-2008-6163—webappsphp

SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

DevelopItEasy Events Calendar 1.2 - Multiple SQL Injections

CVE-2008-6608—webappsphp

Multiple SQL injection vulnerabilities in DevelopItEasy Events Calendar 1.2 allow remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Simple Forum 3.2 - File Disclosure / Cross-Site Scripting

CVE-2008-0542—webappsphp

Directory traversal vulnerability in thumbnail.php in Gerd Tentler Simple Forum 3.2 allows remote attackers to read arbi

23RISK

open ↗

Referência✓ VexDay Proof

InoutMailingListManager 3.1 - Remote Command Execution

CVE-2007-2003—webappsphp

InoutMailingListManager 3.1 and earlier sends a Location redirect header but does not exit after an authorization check

23RISK

open ↗

Referência✓ VexDay Proof

Mutant 0.9.2 - 'mutant_functions.php' Remote File Inclusion

CVE-2007-1961—webappsphp

PHP remote file inclusion vulnerability in mutant_functions.php in the Mutant 0.9.2 portal for phpBB 2.2 allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

Expow 0.8 - 'autoindex.php?cfg_file' Remote File Inclusion

CVE-2007-2302—webappsphp

PHP remote file inclusion vulnerability in autoindex.php in Expow 0.8 allows remote attackers to execute arbitrary PHP c

23RISK

open ↗

Referência✓ VexDay Proof

NewsSync for phpBB 1.5.0rc6 - Remote File Inclusion

CVE-2007-3136—webappsphp

PHP remote file inclusion vulnerability in inc/nuke_include.php in newsSync 1.5.0rc6 allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

MyCMS 0.9.8 - Remote Command Execution (2)

CVE-2007-3585—webappsphp

PHP remote file inclusion vulnerability in games.php in MyCMS 0.9.8 and earlier allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

eXtremail 2.1.1 - Remote Heap Overflow (PoC)

CVE-2007-5466—doslinux

Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending

28RISK

open ↗

Referência✓ VexDay Proof

fungamez rc1 - Authentication Bypass / Local File Inclusion

CVE-2009-1488—webappsphp

Directory traversal vulnerability in admin/load.php in FunGamez RC1 allows remote attackers to include and execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

SFS EZ Gaming Cheats - SQL Injection

CVE-2008-6244—webappsphp

SQL injection vulnerability in view_reviews.php in Scripts for Sites (SFS) EZ Gaming Cheats allows remote attackers to e

23RISK

open ↗

Referência✓ VexDay Proof

μTorrent (uTorrent) 1.6 build 474 - 'announce' Key Remote Heap Overflow

CVE-2007-0927—remotewindows

Heap-based buffer overflow in uTorrent 1.6 allows remote attackers to execute arbitrary code via a torrent file with a c

35RISK

open ↗

Referência✓ VexDay Proof

Mole Group Taxi Calc Dist Script - Authentication Bypass

CVE-2008-6484—webappsphp

SQL injection vulnerability in login.php in Mole Group Taxi Map Script (aka Taxi Calc Dist Script) allows remote attacke

23RISK

open ↗

Referência✓ VexDay Proof

6rbScript 3.3 - 'singerid' SQL Injection

CVE-2008-6454—webappsphp

SQL injection vulnerability in section.php in 6rbScript 3.3 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

Mailist 3.0 - Insecure Backup / Local File Inclusion

CVE-2009-0571—webappsphp

admin.php in Ninja Designs Mailist 3.0 stores backup copies of maillist.php under the web root with insufficient access

23RISK

open ↗

Referência✓ VexDay Proof

VMware Workstation 6.5.1 - 'hcmon.sys 6.0.0.45731' Local Denial of Service

CVE-2008-3761—doswindows

hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VM

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component 'com_glossary' 2.0 - 'catid' SQL Injection

CVE-2008-0514—webappsphp

SQL injection vulnerability in index.php in the Glossary (com_glossary) 2.0 component for Mambo and Joomla! allows remot

23RISK

open ↗

Referência✓ VexDay Proof

CoolPlayer Portable 2.19.1 - '.m3u' Local Buffer Overflow (2)

CVE-2009-1437—localwindows

Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka CoolPlayer+ Portable) 2.19.6 and earlier allows rem

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.