Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits

40,922CVEs with public exploitation

24,696lab-tested

All Referência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

Joomla! Component xstandard editor 1.5.8 - Local Directory Traversal

CVE-2009-0113—webappsphp

Directory traversal vulnerability in attachmentlibrary.php in the XStandard component for Joomla! 1.5.8 and earlier allo

23RISK

open ↗

Referência✓ VexDay Proof

Mini-stream Ripper 3.0.1.1 - '.RAM' Local Buffer Overflow

CVE-2009-1641—localwindows

Multiple stack-based buffer overflows in Mini-stream Ripper 3.0.1.1 allow remote attackers to execute arbitrary code via

50RISK

open ↗

Referência✓ VexDay Proof

Calendar MX Professional 2.0.0 - Blind SQL Injection

CVE-2008-6378—webappsasp

SQL injection vulnerability in calendar_Eventupdate.asp in Calendar Mx Professional 2.0.0 allows remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

Flat Chat 2.0 - 'include online.txt' Remote Code Execution

CVE-2007-1394—webappsphp

Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

Rayzz Script 2.0 - Local/Remote File Inclusion

CVE-2007-6229—webappsphp

PHP remote file inclusion vulnerability in common/classes/class_HeaderHandler.lib.php in Rayzz Script 2.0 allows remote

23RISK

open ↗

Referência✓ VexDay Proof

BrewBlogger 1.3.1 - 'printLog.php' SQL Injection

CVE-2006-5889—webappsphp

SQL injection vulnerability in printLog.php in BrewBlogger (BB) 1.3.1 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

CenterIM 4.22.3 - Remote Command Execution

CVE-2008-1467—remotelinux

CenterIM 4.22.3 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters

23RISK

open ↗

Referência✓ VexDay Proof

Technote 7 - 'shop_this_skin_path' Remote File Inclusion

CVE-2008-4138—webappsphp

PHP remote file inclusion vulnerability in skin_shop/standard/3_plugin_twindow/twindow_notice.php in TECHNOTE 7 allows r

28RISK

open ↗

Referência✓ VexDay Proof

XM Easy Personal FTP Server 5.6.0 - Remote Denial of Service

CVE-2008-5626—doswindows

XM Easy Personal FTP Server 5.6.0 allows remote authenticated users to cause a denial of service via a crafted argument

50RISK

open ↗

Referência✓ VexDay Proof

DeluxeBB 1.07 - Remote Create Admin

CVE-2006-3304—webappsphp

SQL injection vulnerability in cp.php in DeluxeBB 1.07 and earlier allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

KB-Bestellsystem - 'kb_whois.cgi' Command Execution

CVE-2007-6176—webappscgi

kb_whois.cgi in K+B-Bestellsystem (aka KB-Bestellsystem) allows remote attackers to execute arbitrary commands via shell

23RISK

open ↗

Referência✓ VexDay Proof

UPublisher 1.0 - 'viewarticle.asp' SQL Injection

CVE-2006-5888—webappsasp

SQL injection vulnerability in viewarticle.asp in Superfreaker Studios UPublisher 1.0 allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

Vastal I-Tech Visa Zone - 'news_id' SQL Injection

CVE-2008-4462—webappsphp

SQL injection vulnerability in view_news.php in Vastal I-Tech Visa Zone allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

OWLLib 1.0 - 'OWLMemoryProperty.php' Remote File Inclusion

CVE-2006-6150—webappsphp

PHP remote file inclusion vulnerability in memory/OWLMemoryProperty.php in OWLLib 1.0 allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

ScriptsFeed (SF) Auto Classifieds Software - Arbitrary File Upload

CVE-2008-6944—webappsphp

Unrestricted file upload vulnerability in ScriptsFeed Auto Classifieds allows remote authenticated users to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

HotScripts Clone Script - SQL Injection

CVE-2007-6084—webappsphp

SQL injection vulnerability in software-description.php in HotScripts Clone Script allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

BrowseDialog Class - 'ccrpbds6.dll' Multiple Denial of Service Vulnerabilities

CVE-2007-1162—doswindows

A certain ActiveX control in the Common Controls Replacement Project (CCRP) CCRP BrowseDialog Server (ccrpbds6.dll) allo

23RISK

open ↗

Referência✓ VexDay Proof

MyBulletinBoard (MyBB) 1.2.3 - Remote Code Execution

CVE-2007-1963—webappsphp

SQL injection vulnerability in the create_session function in class_session.php in MyBB (aka MyBulletinBoard) 1.2.3 and

23RISK

open ↗

Referência✓ VexDay Proof

Kartli Alisveris Sistemi 1.0 - SQL Injection

CVE-2007-3119—webappsasp

SQL injection vulnerability in news.asp in Kartli Alisveris Sistemi (aka Free-PayPal-Shopping-Cart) 1.0 allows remote at

23RISK

open ↗

Referência✓ VexDay Proof

iPrimal Forums - '/admin/index.php' Change User Password

CVE-2006-5787—webappsphp

admin/index.php in IPrimal Forums as of 20061105 allows remote attackers to bypass authentication and modify user passwo

23RISK

open ↗

Referência✓ VexDay Proof

ACG-ScriptShop - 'cid' SQL Injection

CVE-2008-4144—webappsphp

SQL injection vulnerability in index.php in ACG-ScriptShop E-Gold Script Shop allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

addalink 4 - 'category_id' SQL Injection

CVE-2008-4145—webappsphp

SQL injection vulnerability in user_read_links.php in Addalink 1.0 beta 4 and earlier, when magic_quotes_gpc is disabled

23RISK

open ↗

Referência✓ VexDay Proof

Vastal I-Tech Mag Zone - 'cat_id' SQL Injection

CVE-2008-4464—webappsphp

SQL injection vulnerability in view_mags.php in Vastal I-Tech Mag Zone allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Acoustica Mixcraft 4.2 - Universal Stack Overflow (SEH)

CVE-2008-3877—localwindows

Stack-based buffer overflow in Acoustica Mixcraft 4.1 Build 96 and 4.2 Build 98 allows user-assisted attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

Google Chrome 0.2.149.27 - Automatic File Download

CVE-2008-6996—remotewindows

Google Chrome BETA (0.2.149.27) does not prompt the user before saving an executable file, which makes it easier for rem

23RISK

open ↗

Referência✓ VexDay Proof

Soulseek 157 NS - Remote Buffer Overflow (SEH)

CVE-2009-1830—remotewindows

Stack-based buffer overflow in Soulseek 156 and 157 NS allows remote attackers to execute arbitrary code via a long sear

23RISK

open ↗

Referência✓ VexDay Proof

FreeWebShop.org script 2.2.2 - Multiple Vulnerabilities

CVE-2006-5773—webappsphp

Directory traversal vulnerability in index.php in FreeWebshop 2.2.1 and earlier allows remote attackers to read arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

Teraway FileStream 1.0 - Insecure Cookie Handling

CVE-2009-1619—webappsphp

Teraway FileStream 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the tw

23RISK

open ↗

Referência✓ VexDay Proof

JAF CMS 4.0 RC2 - Multiple Remote File Inclusions

CVE-2006-7127—webappsphp

Multiple PHP remote file inclusion vulnerabilities in JAF CMS 4.0 and 4.0 RC2 allow remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

Quick.Cart 2.2 - Local/Remote File Inclusion / Remote Code Execution

CVE-2007-3139—webappsphp

config/general.php in Quick.Cart 2.2 and earlier uses a default username and password, which allows remote attackers to

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.