Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Ultra Shareware Office Control - ActiveX Control Remote Buffer Overflow
CVE-2008-3878—remotewindows
Stack-based buffer overflow in the Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 in Ultra Shareware
50RISK
open ↗
Referência✓ VexDay Proof
nuBoard 0.5 - 'site' Remote File Inclusion
CVE-2007-5841—webappsphp
PHP remote file inclusion vulnerability in admin/index.php in nuBoard 0.5 allows remote attackers to execute arbitrary P
35RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component mp3 allopass 1.0 - Remote File Inclusion
CVE-2007-5412—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the Quoc-Huy MP3 Allopass (com_mp3_allopass) 1.0 component for Joo
35RISK
open ↗
Referência✓ VexDay Proof
MySpeach 3.0.7 - Local/Remote File Inclusion
CVE-2007-1895—webappsphp
PHP remote file inclusion vulnerability in chat.php in Sky GUNNING MySpeach 3.0.7 and earlier, when used with PHP 5, all
23RISK
open ↗
Referência✓ VexDay Proof
mcGalleryPRO 2006 - 'path_to_folder' Remote File Inclusion
CVE-2006-4720—webappsphp
PHP remote file inclusion vulnerability in random2.php in mcGalleryPRO 2006 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Archangel Weblog 0.90.02 - Local File Inclusion / Authentication Bypass
CVE-2007-2574—webappsphp
Directory traversal vulnerability in index.php in Archangel Weblog 0.90.02 allows remote attackers to read arbitrary fil
23RISK
open ↗
Referência✓ VexDay Proof
Acc PHP eMail 1.1 - Insecure Cookie Handling
CVE-2008-6291—webappsphp
Acc PHP eMail 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the NEWSLET
23RISK
open ↗
Referência✓ VexDay Proof
yourplace 1.0.2 - Multiple Vulnerabilities / Remote Code Execution
CVE-2008-6772—webappsphp
login/register_form.php in YourPlace 1.0.2 and earlier does not check that a username already exists when a new account
23RISK
open ↗
Referência✓ VexDay Proof
Fire Soft Board RC 3 - 'racine' Remote File Inclusion
CVE-2006-4716—webappsphp
PHP remote file inclusion vulnerability in demarrage.php in Fire Soft Board (FSB) RC3 and earlier allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
DMXReady Registration Manager 1.1 - Database Disclosure
CVE-2009-1821—webappsasp
DMXReady Registration Manager 1.1 stores sensitive information under the web root with insufficient access control, whic
23RISK
open ↗
Referência✓ VexDay Proof
A-shop 0.70 - Remote File Deletion
CVE-2007-3936—webappsasp
Directory traversal vulnerability in admin/filebrowser.asp in A-shop 0.70 and earlier, and possibly 0.71, allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Formbankserver 1.9 - 'Name' Directory Traversal
CVE-2007-0055—remotewindows
Directory traversal vulnerability in formbankcgi.exe/AbfrageForm in Formbankserver 1.9 allows remote attackers to read a
23RISK
open ↗
Referência✓ VexDay Proof
AuraCMS 1.62 - 'stat.php' Remote Code Execution
CVE-2008-0390—webappsphp
stat.php in AuraCMS 1.62, and Mod Block Statistik for AuraCMS, allows remote attackers to inject arbitrary PHP code into
23RISK
open ↗
Referência✓ VexDay Proof
Audioactive Player 1.93b - '.m3u' Local Buffer Overflow (SEH)
CVE-2009-1815—localwindows
Stack-based buffer overflow in Sonic Spot Audioactive Player 1.93b allows remote attackers to execute arbitrary code via
23RISK
open ↗
Referência✓ VexDay Proof
Adobe Reader - 'util.printf()' JavaScript Function Stack Overflow (1)
CVE-2008-2992HIGHunder attackransomwarelocalwindows
Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary c
100RISK
open ↗
Referência✓ VexDay Proof
MDPro 1.0.76 - 'Cookie PNSVlang' Local File Inclusion
CVE-2006-7112—webappsphp
Directory traversal vulnerability in error.php in MD-Pro 1.0.76 and earlier allows remote authenticated users to read an
23RISK
open ↗
Referência✓ VexDay Proof
FreePBX 2.1.3 - 'upgrade.php' Remote File Inclusion
CVE-2006-7107—webappsphp
PHP remote file inclusion vulnerability in upgrade.php in Coalescent Systems freePBX 2.1.3 allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
Somery 0.4.6 - 'skin_dir' Remote File Inclusion
CVE-2006-4669—webappsphp
PHP remote file inclusion vulnerability in admin/system/include.php in Somery 0.4.6 and earlier, when register_globals i
23RISK
open ↗
Referência✓ VexDay Proof
Bitweaver 2.6 - 'saveFeed()' Remote Code Execution
CVE-2009-1669—webappsphp
The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers
28RISK
open ↗
Referência✓ VexDay Proof
East Wind Software - 'advdaudio.ocx 1.5.1.1' Local Buffer Overflow
CVE-2007-2576—localwindows
Buffer overflow in the East Wind Software advdaudio.ocx 1.5.1.1 ActiveX control allows user-assisted remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
fresh email script 1.0 - Multiple Vulnerabilities
CVE-2008-7042—webappsphp
PHP remote file inclusion vulnerability in url.php in FreshScripts Fresh Email Script 1.0 through 1.11 allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
WebStudio eHotel - Blind SQL Injection
CVE-2008-5293—webappsphp
SQL injection vulnerability in index.php in WebStudio eHotel allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
MyCMS 0.9.8 - Remote Command Execution (2)
CVE-2007-3586—webappsphp
Multiple direct static code injection vulnerabilities in MyCMS 0.9.8 and earlier allow remote attackers to inject arbitr
23RISK
open ↗
Referência✓ VexDay Proof
RPortal 1.1 - 'file_op' Remote File Inclusion
CVE-2008-6099—webappsphp
PHP remote file inclusion vulnerability in index.php in RPortal 1.1 and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
ASPTicker 1.0 - Authentication Bypass
CVE-2006-6848—webappsasp
SQL injection vulnerability in admin.asp in ASPTicker 1.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
Gravity Board X 2.0 Beta - SQL Injection / (Authenticated) Code Execution
CVE-2009-1278—webappsphp
Static code injection vulnerability in forms/ajax/configure.php in Gravity Board X (GBX) 2.0 BETA allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
RealPlayer 10.5 'ierpplug.dll' Internet Explorer 7 - Denial of Service
CVE-2006-6847—doswindows
An ActiveX control in ierpplug.dll for RealNetworks RealPlayer 10.5 allows remote attackers to cause a denial of service
23RISK
open ↗
Referência✓ VexDay Proof
WebPortal CMS 0.6.0 - 'index.php' SQL Injection
CVE-2007-6664—webappsphp
SQL injection vulnerability in index.php in WebPortal CMS 0.6.0 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
PHP-revista 1.1.2 - Remote File Inclusion / SQL Injection / Authentication Bypass / Cross-Site Scripting
CVE-2006-4606—webappsphp
Multiple SQL injection vulnerabilities in Longino Jacome php-Revista 1.1.2 allow remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
Harris WapChat 1 - Multiple Remote File Inclusions
CVE-2008-2074—webappsphp
Multiple PHP remote file inclusion vulnerabilities Harris Yusuf Arifin Harris Wap Chat 1.0, when register_globals is ena
23RISK
open ↗
← previouspage 688 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.