Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Pluck CMS 4.6.2 - 'langpref' Local File Inclusion
CVE-2009-1765—webappsphp
Multiple directory traversal vulnerabilities in pluck 4.6.2, when register_globals is enabled, allow remote attackers to
28RISK
open ↗
Referência✓ VexDay Proof
LightOpenCMS 0.1 - 'id' SQL Injection
CVE-2009-1766—webappsphp
SQL injection vulnerability in index.php in LightOpenCMS 0.1 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Flyspeck CMS 6.8 - Local/Remote File Inclusion / Change Add Admin
CVE-2009-1770—webappsphp
Directory traversal vulnerability in includes/database/examples/addressbook.php in Flyspeck CMS 6.8 allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
docpile:we 0.2.2 - 'INIT_PATH' Remote File Inclusion
CVE-2006-4075—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Wim Fleischhauer docpile: wim's edition (docpile:we) 0.2.2 and ear
28RISK
open ↗
Referência✓ VexDay Proof
eLitius 1.0 - 'banner-details.php?id' SQL Injection
CVE-2009-1506—webappsphp
SQL injection vulnerability in classes/Xp.php in eLitius 1.0 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
mxBB Module kb_mods 2.0.2 - Remote File Inclusion
CVE-2006-6567—webappsphp
PHP remote file inclusion vulnerability in includes/kb_constants.php in the Knowledge Base (mx_kb) 2.0.2 module for mxBB
23RISK
open ↗
Referência✓ VexDay Proof
Crob FTP Server 3.6.1 build 263 - 'LIST/NLST' Denial of Service
CVE-2006-6558—doswindows
Crob FTP Server 3.6.1 b.263 allows remote attackers to cause a denial of service via a long series of "?A" sequences in
23RISK
open ↗
Referência✓ VexDay Proof
CuteNews aj-fork 167f - 'cutepath' Remote File Inclusion
CVE-2006-6546—webappsphp
PHP remote file inclusion vulnerability in inc/shows.inc.php in cutenews aj-fork (CN:AJ) 167f and earlier allows remote
23RISK
open ↗
Referência✓ VexDay Proof
PHP recommend 1.3 - Authentication Bypass / Remote File Inclusion / Code Injection
CVE-2009-1781—webappsphp
Static code injection vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to inj
23RISK
open ↗
Referência✓ VexDay Proof
Hitweb 4.2.1 - 'REP_INC' Remote File Inclusion
CVE-2006-4113—webappsphp
PHP remote file inclusion vulnerability in genpage-cgi.php in Brian Fraval hitweb 4.2 and possibly earlier versions allo
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_tophotelmodule 1.0 - Blind SQL Injection
CVE-2008-5864—webappsphp
SQL injection vulnerability in the Top Hotel (com_tophotelmodule) component 1.0 in the Hotel Booking Reservation System
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Bible Study 1.5.0 - 'id' SQL Injection
CVE-2008-2643—webappsphp
SQL injection vulnerability in the Bible Study (com_biblestudy) component before 6.0.7c for Joomla! allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
Booby 1.0.1 - Multiple Remote File Inclusions
CVE-2008-2645—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Brim (formerly Booby) 1.0.1 allow remote attackers to execute arbi
35RISK
open ↗
Referência✓ VexDay Proof
Integramod Portal 2.x - 'functions_portal.php' Remote File Inclusion
CVE-2006-4368—webappsphp
PHP remote file inclusion vulnerability in includes/functions_portal.php in IntegraMOD Portal 2.x and earlier allows rem
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component FlippingBook 1.0.4 - SQL Injection
CVE-2008-2095—webappsphp
SQL injection vulnerability in index.php in the FlippingBook (com_flippingbook) 1.0.4 component for Joomla! allows remot
23RISK
open ↗
Referência✓ VexDay Proof
webClassifieds 2005 - Authentication Bypass
CVE-2008-5817—webappsphp
Multiple SQL injection vulnerabilities in index.php in Web Scribble Solutions webClassifieds 2005 allow remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
FipsCMS 4.5 - 'index.asp' SQL Injection
CVE-2006-6115—webappsasp
SQL injection vulnerability in index.asp in fipsCMS 4.5 and earlier allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
LE.CMS 1.4 - Arbitrary File Upload
CVE-2008-2833—webappsphp
admin/upload.php in le.cms 1.4 and earlier allows remote attackers to bypass administrative authentication, and upload a
23RISK
open ↗
Referência✓ VexDay Proof
OpenSSL < 0.9.7l/0.9.8d - SSLv2 Client Crash
CVE-2006-4343—dosmultiple
The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier
28RISK
open ↗
Referência✓ VexDay Proof
XNova 0.8 sp1 - 'xnova_root_path' Remote File Inclusion
CVE-2008-6022—webappsphp
PHP remote file inclusion vulnerability in includes/todofleetcontrol.php in an older version of Xnova, possibly 0.8 sp1,
23RISK
open ↗
Referência✓ VexDay Proof
PHPStore Complete Classifieds Script - Arbitrary File Upload
CVE-2008-6928—webappsphp
Unrestricted file upload vulnerability in PHPStore Complete Classifieds allows remote authenticated users to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Feederator 1.0.5 - Multiple Remote File Inclusions
CVE-2008-5789—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the Recly Interactive Feederator (com_feederator) component 1.0.5
35RISK
open ↗
Referência✓ VexDay Proof
Etomite CMS 0.6.1.2 - '/manager/index.php' Local File Inclusion
CVE-2006-6047—webappsphp
Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to
23RISK
open ↗
Referência✓ VexDay Proof
unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities
CVE-2009-1947—webappsphp
SQL injection vulnerability in the UnbDbEncode function in unb_lib/database.lib.php in Unclassified NewsBoard (UNB) 1.6.
23RISK
open ↗
Referência✓ VexDay Proof
How2ASP.net WebBoard 4.1 - SQL Injection
CVE-2008-2417—webappsphp
SQL injection vulnerability in showQAnswer.asp in How2ASP.net Webboard 4.1 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Password Protector SD 1.3.1 - Insecure Cookie Handling
CVE-2009-2003—webappsphp
Ascad Networks Password Protector SD 1.3.1 allows remote attackers to bypass authentication and gain administrative acce
23RISK
open ↗
Referência✓ VexDay Proof
Advanced Webhost Billing System (AWBS) 2.7.1 - 'news.php' SQL Injection
CVE-2008-2903—webappsphp
SQL injection vulnerability in news.php in Advanced Webhost Billing System (AWBS) 2.3.3 through 2.7.1, when magic_quotes
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component MooFAQ (com_moofaq) - Local File Inclusion
CVE-2009-2015—webappsphp
Directory traversal vulnerability in includes/file_includer.php in the Ideal MooFAQ (com_moofaq) component 1.0 for Jooml
38RISK
open ↗
Referência✓ VexDay Proof
Fantastic News 2.1.3 - 'script_path' Remote File Inclusion
CVE-2006-4285—webappsphp
PHP remote file inclusion vulnerability in news.php in Fantastic News 2.1.3 and earlier allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
WebChamado 1.1 - Arbitrary Add Admin
CVE-2008-2907—webappsphp
SQL injection vulnerability in admin/index.php in WebChamado 1.1, when magic_quotes_gpc is disabled, allows remote attac
23RISK
open ↗
← previouspage 683 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.