Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits

40,922CVEs with public exploitation

24,696lab-tested

All Referência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

Ktools Photostore 3.5.2 - Multiple SQL Injections

CVE-2008-6648—webappsphp

SQL injection vulnerability in crumbs.php in Ktools PhotoStore 3.4.3 and 3.5.2 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

YapBB 1.2 - 'forumID' Blind SQL Injection

CVE-2009-0768—webappsphp

SQL injection vulnerability in forumhop.php in YapBB 1.2 and earlier allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

events Calendar 1.1 - Remote File Inclusion

CVE-2008-4673—webappsphp

PHP remote file inclusion vulnerability in panel/common/theme/default/header_setup.php in WebBiscuits Software Events Ca

23RISK

open ↗

Referência✓ VexDay Proof

GreenCart PHP Shopping Cart - 'id' SQL Injection

CVE-2008-3585—webappsphp

Multiple SQL injection vulnerabilities in PozScripts GreenCart PHP Shopping Cart allow remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

Rising AntiVirus Online Scanner - Insecure Method Flaw

CVE-2008-1116—remotewindows

Insecure method vulnerability in the Web Scan Object ActiveX control (OL2005.dll) in Rising Antivirus Online Scanner all

28RISK

open ↗

Referência✓ VexDay Proof

Dayfox Blog 4 - 'postpost.php' Remote Code Execution

CVE-2007-1525—webappsphp

Direct static code injection vulnerability in postpost.php in Dayfox Blog (dfblog) 4 allows remote attackers to execute

35RISK

open ↗

Referência✓ VexDay Proof

PHP Image 1.2 - Multiple Remote File Inclusions

CVE-2007-5697—webappsphp

Multiple PHP remote file inclusion vulnerabilities in PHP Image 1.2 allow remote attackers to execute arbitrary PHP code

23RISK

open ↗

Referência✓ VexDay Proof

OneCMS 2.5 - Blind SQL Injection

CVE-2008-6652—webappsphp

SQL injection vulnerability in asd.php in OneCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the s

23RISK

open ↗

Referência✓ VexDay Proof

Simple Machines Forum (SMF) 1.1.6 - Code Execution

CVE-2008-6657—webappsphp

Cross-site request forgery (CSRF) vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 be

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component SimpleFAQ 2.11 - SQL Injection

CVE-2007-4456—webappsphp

SQL injection vulnerability in index.php in the SimpleFAQ (com_simplefaq) 2.11 component for Mambo allows remote attacke

23RISK

open ↗

Referência✓ VexDay Proof

polypager 1.0rc2 - SQL Injection / Cross-Site Scripting

CVE-2008-3505—webappsphp

Cross-site scripting (XSS) vulnerability in PolyPager 1.0 rc2 and earlier allows remote attackers to inject arbitrary we

23RISK

open ↗

Referência✓ VexDay Proof

WebCreator 0.2.6-rc3 - 'moddir' Remote File Inclusion

CVE-2007-1459—webappsphp

Multiple PHP remote file inclusion vulnerabilities in WebCreator 0.2.6-rc3 and earlier allow remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

AuthPhp 1.0 - Authentication Bypass

CVE-2009-0738—webappsphp

SQL injection vulnerability in login.php in Auth Php 1.0 allows remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência✓ VexDay Proof

PHPX 3.5.16 - Cookie Poisoning / Authentication Bypass

CVE-2008-3489—webappsphp

SQL injection vulnerability in checkCookie function in includes/functions.inc.php in PHPX 3.5.16 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

SFS EZ Home Business Directory - 'cat_id' SQL Injection

CVE-2008-6783—webappsphp

SQL injection vulnerability in directory.php in Sites for Scripts (SFS) EZ Home Business Directory allows remote attacke

23RISK

open ↗

Referência✓ VexDay Proof

Axigen 5.0.2 - AXIMilter Remote Format String

CVE-2008-0434—remotelinux

Format string vulnerability in the AXIMilter module in AXIGEN Mail Server 5.0.2 allows remote attackers to execute arbit

28RISK

open ↗

Referência✓ VexDay Proof

HP Data Protector 4.00-SP1b43064 - Remote Memory Leak/Denial of Service

CVE-2009-0714—doswindows

Unspecified vulnerability in the dpwinsup module (dpwinsup.dll) for dpwingad (dpwingad.exe) in HP Data Protector Express

35RISK

open ↗

Referência✓ VexDay Proof

iLife iPhoto Photocast - XML Title Remote Format String (PoC)

CVE-2007-0051—dososx

Format string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows remote user-assisted at

23RISK

open ↗

Referência✓ VexDay Proof

Ads Pro - 'dhtml.pl' Remote Command Execution

CVE-2008-6826—webappscgi

dhtml.pl in MHF Media Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the page par

23RISK

open ↗

Referência✓ VexDay Proof

DFLabs PTK 1.0 - Local Command Execution

CVE-2008-6793—webappsphp

The get_file_type function in lib/file_content.php in DFLabs PTK 0.1, 0.2, and 1.0 allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

GC Auction Platinum - 'cate_id' SQL Injection

CVE-2008-3413—webappsphp

SQL injection vulnerability in category.php in Greatclone GC Auction Platinum allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component mosDirectory 2.3.2 - 'catid' SQL Injection

CVE-2008-0690—webappsphp

SQL injection vulnerability in index.php in the mosDirectory (com_directory) 2.3.2 component for Joomla! allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

RealPlayer 10 - '.ra' Remote Denial of Service

CVE-2007-2497—doswindows

RealNetworks RealPlayer 10 Gold allows remote attackers to cause a denial of service (memory consumption) via a certain

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Ice Gallery 0.5b2 - 'catid' Blind SQL Injection

CVE-2008-6852—webappsphp

SQL injection vulnerability in the Ice Gallery (com_ice) component 0.5 beta 2 for Joomla! allows remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

WFTPD Pro Server 3.23.1.1 - 'APPE' Remote Buffer Overflow (PoC)

CVE-2006-5826—doswindows

Buffer overflow in Texas Imperial Software WFTPD Pro Server 3.23.1.1 allows remote authenticated users to execute arbitr

28RISK

open ↗

Referência✓ VexDay Proof

Lycos FileUploader Control - ActiveX Remote Buffer Overflow

CVE-2008-0443—remotewindows

Heap-based buffer overflow in the FileUploader.FUploadCtl.1 ActiveX control in FileUploader.dll 2.0.0.2 in Lycos FileUpl

28RISK

open ↗

Referência✓ VexDay Proof

CMS NetCat 3.0/3.12 - Blind SQL Injection

CVE-2008-6853—webappsphp

SQL injection vulnerability in modules/poll/index.php in AIST NetCat 3.0 and 3.12 allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow

CVE-2008-3360—remotewindows

Stack-based buffer overflow in the HTML parser in IntelliTamper 2.0.7 allows remote attackers to execute arbitrary code

23RISK

open ↗

Referência✓ VexDay Proof

Absolute FAQ Manager 6.0 - Insecure Cookie Handling

CVE-2008-6854—webappsphp

Xigla Software Absolute FAQ Manager.NET 6.0 allows remote attackers to bypass authentication and gain administrative acc

23RISK

open ↗

Referência✓ VexDay Proof

Absolute News Feed 1.0 - Remote Insecure Cookie Handling

CVE-2008-6855—webappsphp

Xigla Software Absolute News Feed 1.0 and possibly 1.5 allows remote attackers to bypass authentication and gain adminis

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.