Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
WordPress Plugin fMoblog 2.1 - 'id' SQL Injection
CVE-2009-0968—webappsphp
SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
KnowledgeBuilder 2.2 - 'visEdit_root' Remote File Inclusion
CVE-2006-5919—webappsphp
PHP remote file inclusion vulnerability in admin/e_data/visEdit_control.class.php in ActiveCampaign KnowledgeBuilder 2.2
23RISK
open ↗
Referência✓ VexDay Proof
Frequency Clock 0.1b - 'securelib' Remote File Inclusion
CVE-2007-2936—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Frequency Clock 0.1b (Beta 0.1) allow remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Alstrasoft Forum - 'cat' SQL Injection
CVE-2008-3954—webappsphp
SQL injection vulnerability in index.php in AlstraSoft Forum Pay Per Post Exchange allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
Beerwin's PHPLinkAdmin 1.0 - Remote File Inclusion / SQL Injection
CVE-2009-1024—webappsphp
Multiple SQL injection vulnerabilities in Beerwin PHPLinkAdmin 1.0 allow remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
Active Trade 2 - 'catid' SQL Injection
CVE-2007-1705—webappsasp
SQL injection vulnerability in default.asp in Active Trade 2 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Kim Websites 1.0 - Authentication Bypass
CVE-2009-1026—webappsphp
Multiple SQL injection vulnerabilities in login.php in Kim Websites 1.0 allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
eZip Wizard 3.0 - Local Stack Buffer Overflow (PoC) (SEH)
CVE-2009-1028—doswindows
Stack-based buffer overflow in ediSys eZip Wizard 3.0 allows remote attackers to execute arbitrary code via a crafted .z
50RISK
open ↗
Referência✓ VexDay Proof
wanewsletter 2.1.3 - Remote File Inclusion
CVE-2007-2969—webappsphp
PHP remote file inclusion vulnerability in newsletter.php in WAnewsletter 2.1.3 and earlier allows remote attackers to e
35RISK
open ↗
Referência✓ VexDay Proof
TurnkeyForms Web Hosting Directory - Multiple Vulnerabilities
CVE-2008-6939—webappsphp
TurnkeyForms Web Hosting Directory allows remote attackers to bypass authentication and (1) gain administrative privileg
23RISK
open ↗
Referência✓ VexDay Proof
POP Peeper 3.4.0.0 - Date Remote Buffer Overflow
CVE-2009-1029—remotewindows
Stack-based buffer overflow in POP Peeper 3.4.0.0 and earlier allows remote POP3 servers to execute arbitrary code via a
50RISK
open ↗
Referência✓ VexDay Proof
WebPortal CMS 0.6-beta - Remote Password Change
CVE-2008-0141—webappsphp
actions.php in WebPortal CMS 0.6-beta generates predictable passwords containing only the time of day, which makes it ea
23RISK
open ↗
Referência✓ VexDay Proof
Kolifa.net Download Script 1.2 - 'id' SQL Injection
CVE-2008-4054—webappsphp
SQL injection vulnerability in indir.php in Kolifa.net Download Script 1.2 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
DBGuestbook 1.1 - 'dbs_base_path' Remote File Inclusion
CVE-2007-1165—webappsphp
Multiple PHP remote file inclusion vulnerabilities in DBGuestbook 1.1 allow remote attackers to execute arbitrary PHP co
23RISK
open ↗
Referência✓ VexDay Proof
Acoustica MP3 CD Burner 4.32 - Local Buffer Overflow (PoC)
CVE-2007-3006—doswindows
Buffer overflow in Acoustica MP3 CD Burner 4.32 allows user-assisted remote attackers to execute arbitrary code via a .a
23RISK
open ↗
Referência✓ VexDay Proof
OtsTurntables 1.00 - '.m3u' Local Buffer Overflow
CVE-2007-4734—localwindows
Buffer overflow in Ots Labs OTSTurntables 1.00 allows user-assisted remote attackers to execute arbitrary code via a lon
23RISK
open ↗
Referência✓ VexDay Proof
EasyNews 40tr - SQL Injection / Cross-Site Scripting / Local File Inclusion
CVE-2008-1651—webappsphp
Directory traversal vulnerability in admin/login.php in EasyNews 4.0 allows remote attackers to include and execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
gapicms 9.0.2 - 'dirDepth' Remote File Inclusion
CVE-2008-3183—webappsphp
PHP remote file inclusion vulnerability in ktmlpro/includes/ktedit/toolbar.php in gapicms 9.0.2 allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
HIOX Random Ad 1.3 - Remote File Inclusion
CVE-2008-3401—webappsphp
PHP remote file inclusion vulnerability in hioxRandomAd.php in HIOX Random Ad (HRA) 1.3 allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
FreeBSD 7.0/7.1 - 'ktimer' Local Privilege Escalation
CVE-2009-1041—localfreebsd
The ktimer feature (sys/kern/kern_time.c) in FreeBSD 7.0, 7.1, and 7.2 allows local users to overwrite arbitrary kernel
23RISK
open ↗
Referência✓ VexDay Proof
Scriptsez Easy Image Downloader - Local File Download
CVE-2008-6089—webappsphp
Directory traversal vulnerability in main.php in ScriptsEz Easy Image Downloader allows remote attackers to read arbitra
23RISK
open ↗
Referência✓ VexDay Proof
KDPics 1.11 - 'exif.php?lib_path' Remote File Inclusion
CVE-2006-6516—webappsphp
Multiple PHP remote file inclusion vulnerabilities in KDPics 1.16 and earlier allow remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
FlashFXP 3.4.0 build 1145 - Remote Buffer Overflow (Denial of Service) (PoC)
CVE-2007-0825—doswindows
FlashFXP 3.4.0 build 1145 allows remote servers to cause a denial of service (CPU consumption) via a response to a PWD c
23RISK
open ↗
Referência✓ VexDay Proof
TorrentTrader Classic 1.07 - Multiple Vulnerabilities
CVE-2007-5311—webappsphp
Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic Edition 1.07 allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
Stash 1.0.3 - Multiple SQL Injections
CVE-2008-4080—webappsphp
SQL injection vulnerability in Stash 1.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
eZip Wizard 3.0 - Local Stack Buffer Overflow (PoC) (SEH)
CVE-2009-1058—doswindows
Stack-based buffer overflow in ZipGenius might allow remote attackers to execute arbitrary code via a crafted .zip file
23RISK
open ↗
Referência✓ VexDay Proof
mUnky 0.0.1 - 'zone' Local File Inclusion
CVE-2008-2876—webappsphp
Directory traversal vulnerability in index.php in mUnky 0.0.1 allows remote attackers to include and execute arbitrary l
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module Tutoriais - 'viewcat.php' SQL Injection
CVE-2007-1816—webappsphp
SQL injection vulnerability in viewcat.php in the Tutoriais module for Xoops allows remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Server 2000 SP4 (Advanced Server) - Message Queue (MS07-065)
CVE-2007-3039—remotewindows
Stack-based buffer overflow in the Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4, Window
50RISK
open ↗
Referência✓ VexDay Proof
ExBB 0.22 - Local/Remote File Inclusion
CVE-2008-1862—webappsphp
ExBB Italia 0.22 and earlier only checks GET requests that use the QUERY_STRING for certain path manipulations, which al
23RISK
open ↗
← previouspage 677 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.