Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits

40,922CVEs with public exploitation

24,696lab-tested

All Referência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

Online Web Building 2.0 - 'id' SQL Injection

CVE-2007-1058—webappsasp

SQL injection vulnerability in user_pages/page.asp in Online Web Building 2.0 allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

phpBB Minerva Mod 2.0.21 build 238a - SQL Injection

CVE-2007-1555—webappsphp

SQL injection vulnerability in forum.php in the Minerva mod 2.0.21 build 238a and earlier for phpBB allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

ClanSphere 2007.4 - 'cat_id' SQL Injection

CVE-2007-5061—webappsphp

SQL injection vulnerability in mods/banners/navlist.php in Clansphere 2007.4 allows remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

fungamez rc1 - Authentication Bypass / Local File Inclusion

CVE-2009-1488—webappsphp

Directory traversal vulnerability in admin/load.php in FunGamez RC1 allows remote attackers to include and execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

Ad Management Java - Authentication Bypass

CVE-2008-6365—webappsasp

SQL injection vulnerability in logon.jsp in Ad Server Solutions Ad Management Software Java allows remote attackers to e

23RISK

open ↗

Referência✓ VexDay Proof

sk.log 0.5.3 - 'skin_url' Remote File Inclusion

CVE-2007-5089—webappsphp

PHP remote file inclusion vulnerability in php-inc/log.inc.php in sk.log 0.5.3 and earlier allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

glFusion 1.1.2 - 'COM_applyFilter()/cookies' Blind SQL Injection

CVE-2009-1283—webappsphp

glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows rem

23RISK

open ↗

Referência✓ VexDay Proof

Apple iTunes 8.1.1.10 (Windows) - 'itms/itcp' Remote Buffer Overflow

CVE-2009-0950—remotewindows

Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a deni

43RISK

open ↗

Referência✓ VexDay Proof

CoolPlayer Portable 2.19.1 - 'Skin' Local Buffer Overflow

CVE-2009-1449—localwindows

Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka CoolPlayer+ Portable) 2.19.1 allows remote attacker

23RISK

open ↗

Referência✓ VexDay Proof

webEdition CMS - 'we_objectID' Blind SQL Injection

CVE-2008-4154—webappsphp

SQL injection vulnerability in living-e webEdition CMS allows remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência✓ VexDay Proof

Girlserv ads 1.5 - 'details_news.php' SQL Injection

CVE-2007-3583—webappsphp

SQL injection vulnerability in details_news.php in Girlserv ads 1.5 and earlier allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft SQL Server - Distributed Management Objects Buffer Overflow

CVE-2007-4814—remotewindows

Buffer overflow in the SQLServer ActiveX control in the Distributed Management Objects OLE DLL (sqldmo.dll) 2000.085.200

35RISK

open ↗

Referência✓ VexDay Proof

Sinapis Forum 2.2 - 'sinapis.php?fuss' Remote File Inclusion

CVE-2007-1131—webappsphp

PHP remote file inclusion vulnerability in sinapis.php in Sinapis Forum 2.2 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

TurboFTP Server 5.30 Build 572 - 'newline/LIST' Multiple Remote Denial of Service Vulnerabilities

CVE-2007-1075—doswindows

TurboFTP 5.30 Build 572 allows remote servers to cause a denial of service (CPU consumption) via a response with a large

23RISK

open ↗

Referência✓ VexDay Proof

News Bin Pro 5.33 - '.nbi' Local Buffer Overflow

CVE-2007-1074—localwindows

Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

phpCommunityCalendar 4.0.3 - Cross-Site Scripting / SQL Injection

CVE-2006-2798—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to inject arbit

23RISK

open ↗

Referência✓ VexDay Proof

Ottoman CMS 1.1.3 - '?default_path=' Remote File Inclusion (1)

CVE-2006-2767—webappsphp

PHP remote file inclusion vulnerability in Ottoman 1.1.2, when register_globals is enabled, allows remote attackers to e

23RISK

open ↗

Referência✓ VexDay Proof

DoceboLms 2.0.5 - 'help.php' Remote File Inclusion

CVE-2006-2668—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 2.05 allow remote attackers to execute arbitrary PHP co

23RISK

open ↗

Referência✓ VexDay Proof

OPENi-CMS Site Protection Plugin - Remote File Inclusion

CVE-2007-0881—webappsphp

PHP remote file inclusion vulnerability in the Seitenschutz plugin for OPENi-CMS 1.0 allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

PHPNuke-Clan 4.2.0 - 'mvcw_conver.php' Remote File Inclusion

CVE-2007-4606—webappsphp

PHP remote file inclusion vulnerability in convert/mvcw_conver.php in the Virtual War (VWar) module for PHPNuke-Clan (PN

23RISK

open ↗

Referência✓ VexDay Proof

Epistemon 1.0 - 'common.php?inc_path' Remote File Inclusion

CVE-2007-0701—webappsphp

PHP remote file inclusion vulnerability in inc/common.inc.php in Epistemon 1.0 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

DL PayCart 1.01 - 'viewitem.php?ItemID' Blind SQL Injection

CVE-2007-4604—webappsphp

SQL injection vulnerability in viewitem.php in DL PayCart 1.01 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

Surgemail 38k - 'Search' Remote Buffer Overflow

CVE-2007-4377—remotewindows

Stack-based buffer overflow in the IMAP service in SurgeMail 38k allows remote authenticated users to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Envolution 1.1.0 - 'topic' SQL Injection

CVE-2007-4253—webappsphp

SQL injection vulnerability in the News module in modules.php in Envolution 1.1.0 and earlier allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

vp-asp shopping cart 6.09 - SQL Injection / Cross-Site Scripting

CVE-2007-0224—webappsasp

SQL injection vulnerability in shopgiftregsearch.asp in VP-ASP Shopping Cart 6.09 and earlier allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

Sony CONNECT Player 4.x - '.m3u' Local Stack Overflow

CVE-2007-5709—localwindows

Stack-based buffer overflow in Sony SonicStage CONNECT Player (CP) 4.3 allows remote attackers to execute arbitrary code

28RISK

open ↗

Referência✓ VexDay Proof

PHP-Update 2.7 - Multiple Vulnerabilities

CVE-2006-6879—webappsphp

Unrestricted file upload vulnerability in admin/uploads.php in PHP-Update 2.7 and earlier allows remote authenticated us

23RISK

open ↗

Referência✓ VexDay Proof

AIDeX Mini-WebServer 1.1 - Remote Crash (Denial of Service)

CVE-2006-6855—doswindows

AIDeX Mini-WebServer 1.1 early release 3 allows remote attackers to cause a denial of service (daemon crash) via a flood

23RISK

open ↗

Referência✓ VexDay Proof

Sugar Suite Open Source 4.2 - 'OptimisticLock' Command Execution

CVE-2006-2460—webappsphp

Sugar Suite Open Source (SugarCRM) 4.2 and earlier, when register_globals is enabled, does not protect critical variable

28RISK

open ↗

Referência✓ VexDay Proof

phpProfiles 3.1.2b - Multiple Remote File Inclusions

CVE-2006-6740—webappsphp

Multiple PHP remote file inclusion vulnerabilities in phpProfiles 3.1.2b and earlier allow remote attackers to execute a

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.