Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,046cataloged exploits

39,533CVEs with public exploitation

24,695lab-tested

All Referência 25,557Exploit-DB 24,485GitHub PoC 16,313VulnCheck XDB 9,678Nuclei 4,488Metasploit 3,525✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

WordPress Plugin myflash 1.00 - 'wppath' Remote File Inclusion

CVE-2007-2485—webappsphp

PHP remote file inclusion vulnerability in myflash-button.php in the myflash 1.00 and earlier plugin for WordPress allow

35RISK

open ↗

Referência✓ VexDay Proof

FTPShell Server 4.3 - Licence Key Remote Buffer Overflow (PoC)

CVE-2009-0349—doswindows

Stack-based buffer overflow in FTPShell Server 4.3 allows user-assisted remote attackers to cause a denial of service (p

23RISK

open ↗

Referência✓ VexDay Proof

WinFTP Server 2.3.0 - 'LIST' (Authenticated) Remote Buffer Overflow

CVE-2009-0351—remotewindows

Stack-based buffer overflow in WFTPSRV.exe in WinFTP 2.3.0 allows remote authenticated users to execute arbitrary code v

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Windows Message Queuing Service - RPC Buffer Overflow (MS07-065) (1)

CVE-2007-3039—remotewindows

Stack-based buffer overflow in the Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4, Window

50RISK

open ↗

Referência✓ VexDay Proof

AuraCMS 2.2.1 - 'X-Forwarded-For' HTTP Header Blind SQL Injection

CVE-2008-1398—webappsphp

SQL injection vulnerability in online.php in AuraCMS 2.0 through 2.2.1 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

SiteXS CMS 0.1.1 - Local File Inclusion

CVE-2009-0371—webappsphp

Directory traversal vulnerability in post.php in SiteXS CMS 0.1.1 and earlier allows remote attackers to include and exe

23RISK

open ↗

Referência✓ VexDay Proof

AllMyGuests 0.4.1 - 'AMG_id' SQL Injection

CVE-2008-1961—webappsphp

SQL injection vulnerability in index.php in Voice Of Web AllMyGuests 0.4.1 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Hedgehog-CMS 1.21 - 'header.php' Local File Inclusion

CVE-2008-2898—webappsphp

Directory traversal vulnerability in includes/header.php in Hedgehog-CMS 1.21 allows remote attackers to include and exe

23RISK

open ↗

Referência✓ VexDay Proof

iGaming CMS 2.0 Alpha 1 - 'search.php' SQL Injection

CVE-2008-4603—webappsphp

SQL injection vulnerability in search.php in iGaming CMS 2.0 Alpha 1 allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

CafeEngine - Multiple SQL Injections

CVE-2008-4604—webappsphp

SQL injection vulnerability in index.php in Easy CafeEngine 1.1 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

Google Chrome 1.0.154.43 - Clickjacking

CVE-2009-0374—remotewindows

Google Chrome 1.0.154.43 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action th

23RISK

open ↗

Referência✓ VexDay Proof

OwnRS Blog 1.2 - 'autor.php' SQL Injection

CVE-2009-0384—webappsphp

SQL injection vulnerability in autor.php in OwnRS CMS 1.2 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

WOW Web On Windows ActiveX Control 2 - Remote Code Execution

CVE-2009-0389—remotewindows

Multiple insecure method vulnerabilities in the Web On Windows (WOW) ActiveX control in WOW ActiveX 2 allow remote attac

23RISK

open ↗

Referência✓ VexDay Proof

Motorola Wimax modem CPEi300 - File Disclosure / Cross-Site Scripting

CVE-2009-0392—remotehardware

Directory traversal vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated users to re

23RISK

open ↗

Referência✓ VexDay Proof

Motorola Wimax modem CPEi300 - File Disclosure / Cross-Site Scripting

CVE-2009-0393—remotehardware

Cross-site scripting (XSS) vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated user

23RISK

open ↗

Referência✓ VexDay Proof

PLE CMS 1.0 Beta 4.2 - Blind SQL Injection

CVE-2009-0394—webappsphp

SQL injection vulnerability in login.php in Pre Lecture Exercises (PLEs) CMS 1.0 beta 4.2 allows remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

AstroSPACES 1.1.1 - 'id' SQL Injection

CVE-2008-4642—webappsphp

SQL injection vulnerability in profile.php in AstroSPACES 1.1.1 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

Max.Blog 1.0.6 - 'offline_auth.php' Offline Authentication Bypass

CVE-2009-0409—webappsphp

SQL injection vulnerability in offline_auth.php in Max.Blog 1.0.6 and earlier, when magic_quotes_gpc is disabled, allows

23RISK

open ↗

Referência✓ VexDay Proof

Mantis Bug Tracker 1.1.3 - Remote Code Execution

CVE-2008-4687—webappsphp

manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort param

50RISK

open ↗

Referência✓ VexDay Proof

XOOPS Module XT-Conteudo - 'spaw_root' Remote File Inclusion

CVE-2007-3221—webappsphp

PHP remote file inclusion vulnerability in admin/spaw/spaw_control.class.php in the XT-Conteudo module for XOOPS allows

35RISK

open ↗

Referência✓ VexDay Proof

Wireshark 1.0.x - '.ncf' Packet Capture Local Denial of Service

CVE-2008-4682—dosmultiple

wtap.c in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application abort) via a

23RISK

open ↗

Referência✓ VexDay Proof

TurnkeyForms Local Classifieds - Cross-Site Scripting / SQL Injection

CVE-2008-6350—webappsphp

SQL injection vulnerability in listtest.php in TurnkeyForms Local Classifieds allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

MindDezign Photo Gallery 2.2 - Arbitrary Add Admin

CVE-2008-6790—webappsphp

The admin module in MindDezign Photo Gallery 2.2 allows remote attackers to add administrative users and gain privileges

23RISK

open ↗

Referência✓ VexDay Proof

PumpKIN TFTP Server 2.7.2.0 - Denial of Service (Metasploit)

CVE-2008-6791—doswindows

PumpKIN TFTP Server 2.7.2.0 allows remote attackers to cause a denial of service via a write request with a long mode fi

23RISK

open ↗

Referência✓ VexDay Proof

BitchX 1.1-final - 'EXEC' Remote Command Execution

CVE-2007-3360—remotelinux

hook.c in BitchX 1.1-final allows remote IRC servers to execute arbitrary commands by sending a client certain data cont

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_Eventing 1.6.x - Blind SQL Injection

CVE-2009-0421—webappsphp

SQL injection vulnerability in the Eventing (com_eventing) 1.6.x component for Joomla! allows remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

DMXReady Member Directory Manager 1.1 - SQL Injection

CVE-2009-0427—webappsasp

SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Member Directory Manager 1.1 and ea

23RISK

open ↗

Referência✓ VexDay Proof

DreamPics Photo/Video Gallery - Blind SQL Injection

CVE-2009-0445—webappsphp

SQL injection vulnerability in index.php in Dreampics Gallery Builder allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

AJA Portal 1.2 (Windows) - Local File Inclusion

CVE-2009-0457—webappsphp

Multiple directory traversal vulnerabilities in AJA Portal 1.2 allow remote attackers to include and execute arbitrary l

23RISK

open ↗

Referência✓ VexDay Proof

Pluxml 0.3.1 - Remote Code Execution

CVE-2007-3432—webappsphp

Unrestricted file upload vulnerability in admin/images.php in Pluxml 0.3.1 allows remote attackers to upload and execute

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.