Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits

40,922CVEs with public exploitation

24,696lab-tested

All Referência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

D-Link MPEG4 SHM Audio Control - 'VAPGDecoder.dll 1.7.0.5' Remote Buffer Overflow

CVE-2008-4771—remotewindows

Stack-based buffer overflow in VATDecoder.VatCtrl.1 ActiveX control in (1) 4xem VatCtrl Class (VATDecoder.dll 1.0.0.27 a

23RISK

open ↗

Referência✓ VexDay Proof

WordPress Plugin st_newsletter - SQL Injection

CVE-2008-0683—webappsphp

SQL injection vulnerability in shiftthis-preview.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress al

23RISK

open ↗

Referência✓ VexDay Proof

Hewlett Packard 1.0.0.309 - 'hpqvwocx.dll' ActiveX Magview Overflow (PoC)

CVE-2007-2656—doswindows

Stack-based buffer overflow in the Hewlett-Packard (HP) Magview ActiveX control in hpqvwocx.dll 1.0.0.309 allows remote

23RISK

open ↗

Referência✓ VexDay Proof

All Club CMS 0.0.2 - 'index.php' SQL Injection

CVE-2008-0601—webappsphp

SQL injection vulnerability in index.php in All Club CMS (ACCMS) 0.0.1f and earlier allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

Site-Assistant 0990 - 'paths[version]' Remote File Inclusion

CVE-2007-0867—webappsphp

PHP remote file inclusion vulnerability in classes/menu.php in Site-Assistant 0990 and earlier allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

MyPBS - 'seasonID' SQL Injection

CVE-2008-5851—webappsphp

SQL injection vulnerability in index.php in My PHP Baseball Stats (MyPBS) allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

AssetMan 2.4a - 'download_pdf.php' Remote File Disclosure

CVE-2007-1427—webappsphp

Directory traversal vulnerability in download_pdf.php in AssetMan 2.4a and earlier allows remote attackers to read arbit

23RISK

open ↗

Referência✓ VexDay Proof

Google Chrome 1.0.154.53 - Null Pointer Remote Crash

CVE-2009-1514—doswindows

Google Chrome 1.0.154.53 allows remote attackers to cause a denial of service (NULL pointer dereference and application

23RISK

open ↗

Referência✓ VexDay Proof

CyBoards PHP Lite 1.21 - 'script_path' Remote File Inclusion

CVE-2007-1983—webappsphp

PHP remote file inclusion vulnerability in include/default_header.php in Cyboards PHP Lite 1.21 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Sisplet CMS 05.10 - 'site_path' Remote File Inclusion

CVE-2007-2347—webappsphp

PHP remote file inclusion vulnerability in main/forum/komentar.php in OneClick CMS (aka Sisplet CMS) 05.10 and earlier a

23RISK

open ↗

Referência✓ VexDay Proof

6ALBlog - 'newsid' SQL Injection

CVE-2007-3451—webappsphp

PHP remote file inclusion vulnerability in admin/index.php in 6ALBlog allows remote authenticated administrators to exec

23RISK

open ↗

Referência✓ VexDay Proof

scWiki 1.0 Beta 2 - 'common.php?pathdot' Remote File Inclusion

CVE-2007-5843—webappsphp

PHP remote file inclusion vulnerability in includes/common.php in scWiki 1.0 Beta 2 allows remote attackers to execute a

35RISK

open ↗

Referência✓ VexDay Proof

Discuz! 6.x/7.x - Remote Code Execution

CVE-2008-6958—webappsphp

wap/index.php in Crossday Discuz! Board 6.x and 7.x allows remote authenticated users to execute arbitrary PHP code via

23RISK

open ↗

Referência✓ VexDay Proof

XOOPS 2.0.18 - Local File Inclusion / URL Redirecting

CVE-2008-0612—webappsphp

Directory traversal vulnerability in htdocs/install/index.php in XOOPS 2.0.18 allows remote attackers to include and exe

23RISK

open ↗

Referência✓ VexDay Proof

Web Slider 0.6 - Insecure Cookie/Authentication Handling

CVE-2008-2298—webappsphp

Admin.php in Web Slider 0.6 allows remote attackers to bypass authentication and gain privileges by setting the admin co

23RISK

open ↗

Referência✓ VexDay Proof

elvin bts 1.2.0 - Multiple Vulnerabilities

CVE-2009-2123—webappsphp

Multiple SQL injection vulnerabilities in Elvin 1.2.0 allow remote attackers to execute arbitrary SQL commands via the (

23RISK

open ↗

Referência✓ VexDay Proof

txtSQL 2.2 Final - 'startup.php' Remote File Inclusion

CVE-2008-3595—webappsphp

PHP remote file inclusion vulnerability in examples/txtSQLAdmin/startup.php in txtSQL 2.2 Final allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Vortex Portal 1.0.42 - Remote File Inclusion

CVE-2007-5842—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Vortex Portal 1.0.42 allow remote attackers to execute arbitrary P

35RISK

open ↗

Referência✓ VexDay Proof

TurnkeyForms Business Survey Pro 1.0 - 'id' SQL Injection

CVE-2008-6349—webappsphp

SQL injection vulnerability in survey_results_text.php in TurnkeyForms Business Survey Pro 1.0 allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

Absolute Form Processor XE-V 1.5 - Insecure Cookie Handling

CVE-2009-1504—webappsasp

Absolute Form Processor XE 1.5 allows remote attackers to bypass authentication and gain administrative access by settin

23RISK

open ↗

Referência✓ VexDay Proof

WinFTP Server 2.0.2 - 'PASV' Remote Denial of Service

CVE-2006-6673—doswindows

WinFtp Server 2.0.2 allows remote attackers to cause a denial of service (crash) via long (1) PASV, (2) LIST, (3) USER,

23RISK

open ↗

Referência✓ VexDay Proof

fungamez rc1 - Authentication Bypass / Local File Inclusion

CVE-2009-1489—webappsphp

includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by set

23RISK

open ↗

Referência✓ VexDay Proof

FLABER 1.1 RC1 - Remote Command Execution

CVE-2008-6490—webappsphp

function/update_xml.php in FLABER 1.1 and earlier allows remote attackers to overwrite arbitrary files by specifying the

23RISK

open ↗

Referência✓ VexDay Proof

Quick 'n Easy Mail Server 3.3 (Demo) - Remote Denial of Service (PoC)

CVE-2009-1602—doswindows

Pablo Software Solutions Quick 'n Easy Mail Server 3.3 allows remote attackers to cause a denial of service (daemon outa

23RISK

open ↗

Referência✓ VexDay Proof

TLM CMS 1.1 - 'i-accueil.php?chemin' Remote File Inclusion

CVE-2007-0300—webappsphp

PHP remote file inclusion vulnerability in i-accueil.php in TLM CMS 1.1 and earlier allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

creative Guestbook 1.0 - Multiple Vulnerabilities

CVE-2007-1479—webappsphp

Cross-site scripting (XSS) vulnerability in Guestbook.php in Creative Guestbook 1.0 allows remote attackers to inject ar

23RISK

open ↗

Referência✓ VexDay Proof

Netartmedia Jobs Portal 1.3 - Multiple SQL Injections

CVE-2008-6030—webappsphp

Multiple SQL injection vulnerabilities in NetArtMedia Jobs Portal 1.3 allow remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

SunShop Shopping Cart 4.1.4 - 'id' SQL Injection

CVE-2008-3768—webappsphp

Multiple SQL injection vulnerabilities in class.ajax.php in Turnkey Web Tools SunShop Shopping Cart before 4.1.5 allow r

23RISK

open ↗

Referência✓ VexDay Proof

MiniWeb HTTP Server 0.8.x - Remote Denial of Service

CVE-2007-3159—doswindows

http.c in MiniWeb Http Server 0.8.x allows remote attackers to cause a denial of service (application crash) via a negat

23RISK

open ↗

Referência✓ VexDay Proof

Picturesolution 2.1 - 'config.php?path' Remote File Inclusion

CVE-2007-5313—webappsphp

PHP remote file inclusion vulnerability in install/config.php in Picturesolution 2.1 and earlier allows remote attackers

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.