Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits

40,922CVEs with public exploitation

24,696lab-tested

All Referência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

MOG-WebShop - 'index.php?group' SQL Injection

CVE-2007-6466—webappsphp

Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

KVIrc 3.4.2 Shiny - URI handler Remote Command Execution

CVE-2008-7070—remotewindows

Argument injection vulnerability in the URI handler in KVIrc 3.4.2 Shiny allows remote attackers to execute arbitrary co

23RISK

open ↗

Referência✓ VexDay Proof

Dream4 Koobi Pro 6.25 Poll - 'poll_id' SQL Injection

CVE-2008-2036—webappsphp

SQL injection vulnerability in index.php in dream4 Koobi Pro 6.25 allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

DreamPics Photo/Video Gallery - Blind SQL Injection

CVE-2009-0445—webappsphp

SQL injection vulnerability in index.php in Dreampics Gallery Builder allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

PassWiki 0.9.16 RC3 - 'site_id' Local File Inclusion

CVE-2008-6423—webappsphp

Directory traversal vulnerability in passwiki.php in PassWiki 0.9.16 RC3 and earlier allows remote attackers to read arb

23RISK

open ↗

Referência✓ VexDay Proof

HiveMaker Professional 1.0.2 - 'cid' SQL Injection

CVE-2008-6427—webappsphp

SQL injection vulnerability in index.php in Hivemaker Professional 1.0.2 and earlier, when magic_quotes_gpc is disabled,

23RISK

open ↗

Referência✓ VexDay Proof

WebChat 0.78 - 'login.php?rid' SQL Injection

CVE-2007-3534—webappsphp

SQL injection vulnerability in login.php in WebChat 0.78 allows remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência✓ VexDay Proof

Agares ThemeSiteScript 1.0 - 'loadadminpage' Remote File Inclusion

CVE-2008-5066—webappsphp

PHP remote file inclusion vulnerability in upload/admin/frontpage_right.php in Agares Media ThemeSiteScript 1.0 allows r

23RISK

open ↗

Referência✓ VexDay Proof

LetterIt 2 - 'Language' Local File Inclusion

CVE-2008-3446—webappsphp

Directory traversal vulnerability in inc/wysiwyg.php in LetterIt 2 allows remote attackers to include and execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

WebCalendar 1.2.4 - Remote Code Execution

CVE-2012-1495—webappsphp

install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user

60RISK

open ↗

Referência✓ VexDay Proof

Galleristic 1.0 - 'cat' SQL Injection

CVE-2008-2129—webappsphp

SQL injection vulnerability in index.php in Galleristic 1.0, when magic_quotes_gpc is disabled, allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

OpenDock Easy Gallery 1.4 - 'doc_directory' File Inclusion

CVE-2006-5241—webappsphp

Multiple PHP remote file inclusion vulnerabilities in OpenDock Easy Gallery 1.4 and earlier, when register_globals is en

23RISK

open ↗

Referência✓ VexDay Proof

Madirish Webmail 2.0 - 'addressbook.php' Remote File Inclusion

CVE-2007-2826—webappsphp

PHP remote file inclusion vulnerability in lib/addressbook.php in Madirish Webmail 2.0 allows remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

helplink 0.1.0 - 'show.php' Remote File Inclusion

CVE-2007-5099—webappsphp

PHP remote file inclusion vulnerability in show.php in David Watters Helplink 0.1.0 allows remote attackers to execute a

35RISK

open ↗

Referência✓ VexDay Proof

Advanced Login 0.7 - 'root' Remote File Inclusion

CVE-2007-1766—webappsphp

PHP remote file inclusion vulnerability in login/engine/db/profiledit.php in Advanced Login 0.76 and earlier allows remo

23RISK

open ↗

Referência✓ VexDay Proof

kawf 1.0 - 'main.php' Remote File Inclusion

CVE-2006-5522—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Johannes Erdfelt Kawf 1.0 and earlier allow remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

Ask.com/AskJeeves Toolbar Toolbar 4.0.2.53 - ActiveX Remote Buffer Overflow

CVE-2007-5107—remotewindows

Stack-based buffer overflow in the AskJeevesToolBar.SettingsPlugin.1 ActiveX control in askBar.dll in IAC Search & Media

50RISK

open ↗

Referência✓ VexDay Proof

MoviePlay 4.76 - '.lst' Local Buffer Overflow

CVE-2007-0016—localwindows

Stack-based buffer overflow in MoviePlay 4.76 allows remote attackers to execute arbitrary code via a long filename in a

23RISK

open ↗

Referência✓ VexDay Proof

WholeHogSoftware Password Protect - Insecure Cookie Handling

CVE-2009-0461—webappsphp

Whole Hog Password Protect: Enhanced 1.x allows remote attackers to bypass authentication and obtain administrative acce

23RISK

open ↗

Referência✓ VexDay Proof

Ocean12 FAQ Manager Pro - 'ID' Blind SQL Injection

CVE-2008-6372—webappsphp

SQL injection vulnerability in default.asp in Ocean12 FAQ Manager Pro 1.0 allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

TAGWORX.CMS 3.00.02 - Multiple SQL Injections

CVE-2008-2394—webappsphp

Multiple SQL injection vulnerabilities in TAGWORX.CMS 3.00.02 allow remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência✓ VexDay Proof

e107 Plugin BLOG Engine 2.2 - 'uid' SQL Injection

CVE-2008-6438—webappsphp

SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows re

23RISK

open ↗

Referência✓ VexDay Proof

6rbScript 3.3 - 'section.php' Local File Inclusion

CVE-2008-6453—webappsphp

Directory traversal vulnerability in section.php in 6rbScript 3.3, when magic_quotes_gpc is disabled, allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

Plaincart 1.1.2 - 'p' SQL Injection

CVE-2008-6469—webappsphp

SQL injection vulnerability in index.php in PlainCart 1.1.2 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

Flatnux - html/JavaScript Injection Cookie Grabber

CVE-2008-5761—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in FlatnuX CMS (aka Flatnuke3) 2008-12-11 allow remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

Opera 9.62 - 'file://' Local Heap Overflow

CVE-2008-5178—localwindows

Heap-based buffer overflow in Opera 9.62 on Windows allows remote attackers to execute arbitrary code via a long file://

35RISK

open ↗

Referência✓ VexDay Proof

VideoLAN VLC Media Player < 0.9.6 - '.rt' Local Stack Buffer Overflow

CVE-2008-5036—localwindows

Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execu

50RISK

open ↗

Referência✓ VexDay Proof

Maian Recipe 1.0 - 'path_to_folder' Remote File Inclusion

CVE-2007-0848—webappsphp

PHP remote file inclusion vulnerability in classes/class_mail.inc.php in Maian Recipe 1.0 allows remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

J-OWAMP Web Interface 2.1b - 'link' Remote File Inclusion

CVE-2006-6453—webappsphp

PHP remote file inclusion vulnerability in JOWAMP_ShowPage.php in J-OWAMP Web Interface 2.1 allows remote authenticated

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Windows Explorer - '.AVI' File Denial of Service

CVE-2007-0562—doswindows

Windows Explorer (explorer.exe) 6.0.2900.2180 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.