Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Easy Webstore 1.2 - SQL Injection
CVE-2008-2853—webappsphp
SQL injection vulnerability in index.php in Easy Webstore 1.2 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Fusion Mod Classifieds - 'lid' SQL Injection
CVE-2008-5197—webappsphp
SQL injection vulnerability in classifieds.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
zeeproperty 1.0 - Arbitrary File Upload / Cross-Site Scripting
CVE-2008-6915—webappsphp
Cross-site scripting (XSS) vulnerability in view_prop_details.php in Zeeways ZEEPROPERTY 1.0 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
CoolPlayer 2.18 - '.m3u' File Local Buffer Overflow
CVE-2008-3408—localwindows
Stack-based buffer overflow in CoolPlayer 2.18, and possibly other versions, allows user-assisted remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
HIOX Browser Statistics 2.0 - Remote File Inclusion
CVE-2008-3402—webappsphp
Multiple PHP remote file inclusion vulnerabilities in HIOX Browser Statistics (HBS) 2.0 allow remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
MailEnable 3.13 SMTP Service - 'VRFY/EXPN' Denial of Service
CVE-2008-1275—doswindows
Multiple unspecified vulnerabilities in the SMTP service in MailEnable Standard Edition 1.x, Professional Edition 3.x an
23RISK
open ↗
Referência✓ VexDay Proof
Mobius 1.4.4.1 - SQL Injection
CVE-2008-3420—webappsphp
Multiple SQL injection vulnerabilities in Mobius for Mimsy XG 1 1.4.4.1 and earlier allow remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
Alstrasoft Video Share Enterprise 4.5.1 - 'UID' SQL Injection
CVE-2008-3386—webappsphp
SQL injection vulnerability in album.php in AlstraSoft Video Share Enterprise 4.51 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
TalkBack 2.3.5 - 'Language' Local File Inclusion
CVE-2008-3371—webappsphp
Directory traversal vulnerability in install/help.php in TalkBack 2.3.5, and other versions before 2.3.6.2, allows remot
23RISK
open ↗
Referência✓ VexDay Proof
Student Study Center Management System v1.0 - Stored Cross-Site Scripting (XSS)
CVE-2023-33580—webappsphp
Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the "Admin Name" f
23RISK
open ↗
Referência✓ VexDay Proof
WebCards 1.3 - SQL Injection
CVE-2008-4878—webappsphp
Unrestricted file upload vulnerability in the "Add Image Macro" feature in WebCards 1.3 allows remote authenticated admi
23RISK
open ↗
Referência✓ VexDay Proof
Viewpoint Media Player for IE 3.2 - Remote Stack Overflow (PoC)
CVE-2007-5911—doswindows
Multiple stack-based buffer overflows in the AxMetaStream ActiveX control in AxMetaStream.dll 3.3.2.26 in Viewpoint Medi
23RISK
open ↗
Referência✓ VexDay Proof
phpWebThings 1.5.2 - MD5 Hash Retrieve/File Disclosure
CVE-2009-2147—webappsphp
SQL injection vulnerability in fdown.php in phpWebThings 1.5.2 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
V3 Chat Live Support 3.0.4 - Insecure Cookie Handling
CVE-2008-5783—webappsphp
admin/index.php in V3 Chat Live Support 3.0.4 allows remote attackers to bypass authentication and gain administrative a
23RISK
open ↗
Referência✓ VexDay Proof
vBulletin Radio and TV Player AddOn - HTML Injection
CVE-2009-2172—webappsphp
Cross-site scripting (XSS) vulnerability in forum/radioandtv.php in the Radio and TV Player addon for vBulletin allows r
23RISK
open ↗
Referência✓ VexDay Proof
NmnNewsletter 1.0.7 - 'output' Remote File Inclusion
CVE-2007-6585—webappsphp
PHP remote file inclusion vulnerability in confirmUnsubscription.php in NmnNewsletter 1.0.7 allows remote attackers to e
23RISK
open ↗
Referência✓ VexDay Proof
docmint 2.0 - '/engine/require.php' Remote File Inclusion
CVE-2006-5240—webappsphp
PHP remote file inclusion vulnerability in engine/require.php in Docmint 2.0 and earlier, when register_globals is enabl
23RISK
open ↗
Referência✓ VexDay Proof
PHPQuickGallery 1.9 - 'textFile' Remote File Inclusion
CVE-2006-6044—webappsphp
PHP remote file inclusion vulnerability in gallery_top.inc.php in PHPQuickGallery 1.9 and earlier allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
Linux Kernel 2.6.x - 'sys_timer_create()' Local Denial of Service
CVE-2006-7051—doslinux
The sys_timer_create function in posix-timers.c for Linux kernel 2.6.x allows local users to cause a denial of service (
23RISK
open ↗
Referência✓ VexDay Proof
phpBB Module SupaNav 1.0.0 - 'link_main.php' Remote File Inclusion
CVE-2007-3935—webappsphp
PHP remote file inclusion vulnerability in link_main.php in the SupaNav 1.0.0 module for phpBB allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
CFAGCMS 1 - SQL Injection
CVE-2008-5781—webappsphp
SQL injection vulnerability in right.php in Cant Find A Gaming CMS (CFAGCMS) 1.0 Beta 1 allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
Easy Px 41 CMS 09.00.00B1 - 'fiche' Local File Inclusion
CVE-2009-1847—webappsphp
Directory traversal vulnerability in index.php in Easy PX 41 CMS 9.0 B1 allows remote attackers to include and execute a
23RISK
open ↗
Referência✓ VexDay Proof
GameCMS Lite 1.0 - 'systemId' SQL Injection
CVE-2008-2225—webappsphp
SQL injection vulnerability in index.php in gameCMS Lite 1.0 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
ravennuke 2.3.0 - Multiple Vulnerabilities
CVE-2009-0678—webappsphp
images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array paramet
23RISK
open ↗
Referência✓ VexDay Proof
wget 1.10.2 - Unchecked Boundary Condition Denial of Service
CVE-2006-6719—dosmultiple
The ftp_syst function in ftp-basic.c in Free Software Foundation (FSF) GNU wget 1.10.2 allows remote attackers to cause
23RISK
open ↗
Referência✓ VexDay Proof
Pre Survey Poll - 'catid' SQL Injection
CVE-2008-3310—webappsasp
SQL injection vulnerability in default.asp in Pre Survey Poll allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component mosDirectory 2.3.2 - Remote File Inclusion
CVE-2007-6555—webappsphp
PHP remote file inclusion vulnerability in modules/mod_pxt_latest.php in the mosDirectory (com_directory) 2.3.2 componen
23RISK
open ↗
Referência✓ VexDay Proof
exV2 < 2.0.4.3 - 'extract()' Remote Command Execution
CVE-2006-7079—webappsphp
Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite
28RISK
open ↗
Referência✓ VexDay Proof
IP Reg 0.3 - Multiple SQL Injections
CVE-2007-6579—webappsphp
Multiple SQL injection vulnerabilities in Ip Reg 0.3 allow remote attackers to execute arbitrary SQL commands via the vl
23RISK
open ↗
Referência✓ VexDay Proof
DB Top Sites 1.0 - Remote Command Execution
CVE-2009-2111—webappsphp
Static code injection vulnerability in add_reg.php in DB Top Sites 1.0 allows remote attackers to inject arbitrary PHP c
23RISK
open ↗
← previouspage 679 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.