Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Pakupaku CMS 0.4 - Arbitrary File Upload / Local File Inclusion
CVE-2007-4641—webappsphp
Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and ex
23RISK
open ↗
Referência✓ VexDay Proof
EasyClassifields 3.0 - 'go' SQL Injection
CVE-2008-4084—webappsphp
SQL injection vulnerability in staticpages/easyclassifields/index.php in MyioSoft EasyClassifields 3.0 allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
Simple Document Management System 1.1.4 - Authentication Bypass
CVE-2008-6220—webappsphp
SQL injection vulnerability in login.php in Simple Document Management System (SDMS) 1.1.5 and 1.1.4, and possibly earli
23RISK
open ↗
Referência✓ VexDay Proof
falcon CMS 1.4.3 - Remote File Inclusion / Cross-Site Scripting
CVE-2007-6488—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
Basic-CMS - SQL Injection
CVE-2008-2789—webappsphp
SQL injection vulnerability in pages/index.php in BASIC-CMS allows remote attackers to execute arbitrary SQL commands vi
43RISK
open ↗
Referência✓ VexDay Proof
Comparison Engine Power 1.0 - Blind SQL Injection
CVE-2008-2791—webappsphp
SQL injection vulnerability in product.detail.php in Kalptaru Infotech Comparison Engine Power Script 1.0 allows remote
23RISK
open ↗
Referência✓ VexDay Proof
X7 Chat 2.0.1A1 - 'mini.php' Local File Inclusion
CVE-2008-4718—webappsphp
Directory traversal vulnerability in help/mini.php in X7 Chat 2.0.1 A1 and earlier allows remote attackers to include an
23RISK
open ↗
Referência✓ VexDay Proof
Mini-stream Ripper 3.0.1.1 - '.m3u' Universal Stack Overflow
CVE-2009-1325—localwindows
Stack-based buffer overflow in Mini-stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long U
23RISK
open ↗
Referência✓ VexDay Proof
ICQ Toolbar 2.3 - ActiveX Remote Denial of Service
CVE-2008-7136—doswindows
toolbaru.dll in ICQ Toolbar (ICQToolbar) 2.3 allows remote attackers to cause a denial of service (toolbar crash) via a
23RISK
open ↗
Referência✓ VexDay Proof
Oceandir 2.9 - 'show_vote.php' SQL Injection
CVE-2008-6452—webappsphp
SQL injection vulnerability in show_vote.php in Oceandir 2.9 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
QuickTalk forum 1.3 - 'lang' Local File Inclusion
CVE-2007-3505—webappsphp
Multiple directory traversal vulnerabilities in QuickTalk forum 1.3 allow remote attackers to include and execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
ravennuke 2.3.0 - Multiple Vulnerabilities
CVE-2009-0673—webappsphp
Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.3
23RISK
open ↗
Referência✓ VexDay Proof
CodeAvalanche FreeForAll - Database Disclosure
CVE-2008-5899—webappsasp
CodeAvalanche FreeForAll stores sensitive information under the web root with insufficient access control, which allows
23RISK
open ↗
Referência✓ VexDay Proof
CodeAvalanche Directory - Database Disclosure
CVE-2008-5898—webappsasp
CodeAvalanche Directory stores sensitive information under the web root with insufficient access control, which allows r
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component EZ Store Remote - Blind SQL Injection
CVE-2008-3586—webappsphp
SQL injection vulnerability in the EZ Store (com_ezstore) component for Joomla! allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
k-links directory - SQL Injection / Cross-Site Scripting
CVE-2008-3580—webappsphp
Multiple SQL injection vulnerabilities in Qsoft K-Links allow remote attackers to execute arbitrary SQL commands via (1)
23RISK
open ↗
Referência✓ VexDay Proof
EZ Publish < 3.9.5/3.10.1/4.0.1 - Privilege Escalation
CVE-2008-6844—webappsphp
The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other versions before 3.9.5, 3.10.1
23RISK
open ↗
Referência✓ VexDay Proof
Easy Webstore 1.2 - SQL Injection
CVE-2008-2853—webappsphp
SQL injection vulnerability in index.php in Easy Webstore 1.2 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
SpeedStream 5200 - Authentication Bypass Configuration Download
CVE-2008-6916—remotehardware
Siemens SpeedStream 5200 with NetPort Software 1.1 allows remote attackers to bypass authentication via an invalid Host
23RISK
open ↗
Referência✓ VexDay Proof
CcMail 1.0.1 - 'functions_dir' Remote File Inclusion
CVE-2007-1516—webappsphp
PHP remote file inclusion vulnerability in functions/update.php in Cicoandcico CcMail 1.0 allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
study planner (studiewijzer) 0.15 - Remote File Inclusion
CVE-2007-1628—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Study planner (Studiewijzer) 0.15 and earlier, when register_globa
23RISK
open ↗
Referência✓ VexDay Proof
Hot Links SQL-PHP 3 - 'report.php' Multiple Vulnerabilities
CVE-2008-4379—webappsphp
Cross-site scripting (XSS) vulnerability in report.php in Mr. CGI Guy Hot Links SQL-PHP 3.0 and earlier allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
FreeCMS.us 0.2 - 'index.php' SQL Injection
CVE-2008-2796—webappsphp
SQL injection vulnerability in index.php in FreeCMS 0.2 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
mystats - 'hits.php' Multiple Vulnerabilities
CVE-2008-4644—webappsphp
hits.php in myWebland myStats allows remote attackers to bypass IP address restrictions via a modified X-Forwarded-For H
23RISK
open ↗
Referência✓ VexDay Proof
ClanLite 2.x - SQL Injection / Cross-Site Scripting
CVE-2008-5215—webappsphp
SQL injection vulnerability in service/profil.php in ClanLite 2.2006.05.20 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
CJG EXPLORER PRO 3.2 - 'g_pcltar_lib_dir' Remote File Inclusion
CVE-2007-2199—webappsphp
PHP remote file inclusion vulnerability in lib/pcltar.lib.php (aka pcltar.php) in the PclTar module 1.3 and 1.3.1 for Vi
35RISK
open ↗
Referência✓ VexDay Proof
CYASK 3.x - 'neturl' Local File Disclosure
CVE-2008-4151—webappsphp
Directory traversal vulnerability in collect.php in CYASK 3.x allows remote attackers to read arbitrary files via a .. (
23RISK
open ↗
Referência✓ VexDay Proof
registroTL - 'main.php' Remote File Inclusion
CVE-2006-5316—webappsphp
registroTL stores sensitive information under the web root with insufficient access control, which allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
smcFanControl 2.1.2 (OSX) - Multiple Buffer Overflow Vulnerabilities (PoC)
CVE-2008-6252—dososx
Stack-based buffer overflow in the smc program in smcFanControl 2.1.2 allows local users to execute arbitrary code and g
23RISK
open ↗
Referência✓ VexDay Proof
Mosaic Commerce - 'cid' SQL Injection
CVE-2008-4599—webappsphp
SQL injection vulnerability in category.php in Mosaic Commerce allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
← previouspage 696 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.