Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Garennes 0.6.1 - 'repertoire_config' Remote File Inclusion
CVE-2007-2298—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Garennes 0.6.1 and earlier allow remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
GoSamba 1.0.1 - 'INCLUDE_PATH' Multiple Remote File Inclusions
CVE-2007-5786—webappsphp
Multiple PHP remote file inclusion vulnerabilities in GoSamba 1.0.1 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗
Referência✓ VexDay Proof
Postfix 2.6-20080814 - 'symlink' Local Privilege Escalation
CVE-2008-2936—locallinux
Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system suppor
23RISK
open ↗
Referência✓ VexDay Proof
iyzi Forum 1.0b3 - Database Disclosure
CVE-2008-5901—webappsphp
iyzi Forum 1.0 beta 3 stores sensitive information under the web root with insufficient access control, which allows rem
23RISK
open ↗
Referência✓ VexDay Proof
AvailScript Article Script - 'view.php' SQL Injection
CVE-2008-6037—webappsphp
SQL injection vulnerability in view.php in AvailScript Article Script allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
WebBiscuits Modules Controller 1.1 - Remote File Inclusion / Remote File Disclosure
CVE-2008-6138—webappsphp
PHP remote file inclusion vulnerability in adminhead.php in WebBiscuits Modules Controller 1.1 and earlier allows remote
23RISK
open ↗
Referência✓ VexDay Proof
moziloCMS 1.11 - Local File Inclusion / Full Path Disclosure / Cross-Site Scripting
CVE-2009-1367—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in moziloCMS 1.11 allows remote attackers to inject arbitrary web
23RISK
open ↗
Referência✓ VexDay Proof
Contenido 4.8.4 - Remote File Inclusion / Cross-Site Scripting
CVE-2008-2912—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Contenido CMS 4.8.4 allow remote attackers to execute arbitrary PH
23RISK
open ↗
Referência✓ VexDay Proof
PHP Multiple Newsletters 2.7 - Local File Inclusion / Cross-Site Scripting
CVE-2008-5570—webappsphp
Directory traversal vulnerability in index.php in PHP Multiple Newsletters 2.7, when magic_quotes_gpc is disabled, allow
23RISK
open ↗
Referência✓ VexDay Proof
Noticeware E-mail Server 5.1.2.2 - 'POP3' Denial of Service
CVE-2008-6185—doswindows
NoticeWare Email Server NG 5.1.2.2 allows remote attackers to cause a denial of service (crash) via multiple POP3 reques
23RISK
open ↗
Referência✓ VexDay Proof
CRE Loaded 6.2 - 'products_id' SQL Injection
CVE-2009-1403—webappsphp
SQL injection vulnerability in product_info.php in CRE Loaded 6.2 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin wp-Table 1.43 - 'inc_dir' Remote File Inclusion
CVE-2007-2483—webappsphp
Directory traversal vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin for WordPress, when r
23RISK
open ↗
Referência✓ VexDay Proof
mBlog 1.2 - 'page' Remote File Disclosure
CVE-2007-6582—webappsphp
Directory traversal vulnerability in index.php in mBlog 1.2 allows remote attackers to read arbitrary files via a .. (do
23RISK
open ↗
Referência✓ VexDay Proof
artmedic weblog 1.0 - Multiple Local File Inclusions
CVE-2008-0798—webappsphp
Multiple directory traversal vulnerabilities in artmedic webdesign weblog 1.0, when magic_quotes_gpc is disabled, allow
23RISK
open ↗
Referência✓ VexDay Proof
moziloCMS 1.10.1 - 'download.php' Arbitrary Download File
CVE-2008-3589—webappsphp
Directory traversal vulnerability in download.php in moziloCMS 1.10.1, when magic_quotes_gpc is disabled, allows remote
23RISK
open ↗
Referência✓ VexDay Proof
TinyCMS 1.1.2 - 'templater.php' Local File Inclusion
CVE-2008-4740—webappsphp
Directory traversal vulnerability in templater.php in the ZZ_Templater module in TinyCMS 1.1.2, when register_globals is
23RISK
open ↗
Referência✓ VexDay Proof
Podcast Generator 1.1 - Remote Code Execution
CVE-2009-1226—webappsphp
core/admin/delete.php in Podcast Generator 1.1 and earlier does not properly restrict access to administrative functions
23RISK
open ↗
Referência✓ VexDay Proof
Winamp 5.34 - '.mp4' Code Execution
CVE-2007-2498—localwindows
libmp4v2.dll in Winamp 5.02 through 5.34 allows user-assisted remote attackers to execute arbitrary code via a certain .
28RISK
open ↗
Referência✓ VexDay Proof
Mutant 0.9.2 - 'mutant_functions.php' Remote File Inclusion
CVE-2007-1961—webappsphp
PHP remote file inclusion vulnerability in mutant_functions.php in the Mutant 0.9.2 portal for phpBB 2.2 allows remote a
23RISK
open ↗
Referência✓ VexDay Proof
Expow 0.8 - 'autoindex.php?cfg_file' Remote File Inclusion
CVE-2007-2302—webappsphp
PHP remote file inclusion vulnerability in autoindex.php in Expow 0.8 allows remote attackers to execute arbitrary PHP c
23RISK
open ↗
Referência✓ VexDay Proof
NewsSync for phpBB 1.5.0rc6 - Remote File Inclusion
CVE-2007-3136—webappsphp
PHP remote file inclusion vulnerability in inc/nuke_include.php in newsSync 1.5.0rc6 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
MyCMS 0.9.8 - Remote Command Execution (2)
CVE-2007-3585—webappsphp
PHP remote file inclusion vulnerability in games.php in MyCMS 0.9.8 and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
eXtremail 2.1.1 - Remote Heap Overflow (PoC)
CVE-2007-5466—doslinux
Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending
28RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Gaming Cheats - SQL Injection
CVE-2008-6244—webappsphp
SQL injection vulnerability in view_reviews.php in Scripts for Sites (SFS) EZ Gaming Cheats allows remote attackers to e
23RISK
open ↗
Referência✓ VexDay Proof
Mailist 3.0 - Insecure Backup / Local File Inclusion
CVE-2009-0571—webappsphp
admin.php in Ninja Designs Mailist 3.0 stores backup copies of maillist.php under the web root with insufficient access
23RISK
open ↗
Referência✓ VexDay Proof
CoolPlayer Portable 2.19.1 - '.m3u' Local Buffer Overflow (2)
CVE-2009-1437—localwindows
Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka CoolPlayer+ Portable) 2.19.6 and earlier allows rem
28RISK
open ↗
Referência✓ VexDay Proof
PHPtree 1.3 - 'cms2.php?s_dir' Remote File Inclusion
CVE-2007-2573—webappsphp
PHP remote file inclusion vulnerability in plugin/HP_DEV/cms2.php in PHPtree 1.3 allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
Easy Scripts Answer and Question Script - Multiple Vulnerabilities
CVE-2009-1665—webappsphp
myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to remove arbitrary user accounts via a
23RISK
open ↗
Referência✓ VexDay Proof
AV Tutorial Script 1.0 - Remote User Pass Change
CVE-2007-3630—webappsphp
changePW.php in AV Tutorial Script (avtutorial) 1.0 does not require authentication or knowledge of an old password for
23RISK
open ↗
Referência✓ VexDay Proof
CoAST 0.95 - 'sections_file' Remote File Inclusion
CVE-2008-4735—webappsphp
PHP remote file inclusion vulnerability in header.php in Concord Asset, Software, and Ticket system (CoAST) 0.95 allows
23RISK
open ↗
← previouspage 691 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.