Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
MiniBB 2.2 - Cross-Site Scripting / SQL Injection / Full Path Disclosure
CVE-2008-2028—webappsphp
miniBB 2.2, and possibly earlier, when register_globals is enabled, allows remote attackers to obtain the full path via
23RISK
open ↗
Referência✓ VexDay Proof
Minerva 2.0.21 build 238a - 'phpbb_root_path' File Inclusion
CVE-2006-5077—webappsphp
PHP remote file inclusion vulnerability in admin/admin_topic_action_logging.php in Chris Smith Minerva Build 238 and ear
23RISK
open ↗
Referência✓ VexDay Proof
Connectix Boards 0.7 - 'p_skin' Multiple Vulnerabilities
CVE-2007-1254—webappsphp
SQL injection vulnerability in part.userprofile.php in Connectix Boards 0.7 and earlier allows remote authenticated user
23RISK
open ↗
Referência✓ VexDay Proof
Joovili 3.1 - 'browse.videos.php' SQL Injection
CVE-2008-2063—webappsphp
SQL injection vulnerability in browse.videos.php in Joovili 3.1 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
Siteman 2.x - Code Execution / Local File Inclusion / Cross-Site Scripting
CVE-2008-2082—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Siteman 2.0.x2 allows remote attackers to inject arbitrary web
23RISK
open ↗
Referência✓ VexDay Proof
Softbiz Web Host Directory Script - 'host_id' SQL Injection
CVE-2008-2087—webappsphp
SQL injection vulnerability in search_result.php in Softbiz Web Host Directory Script, when magic_quotes_gpc is disabled
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Community Builder 1.0.1 - Blind SQL Injection
CVE-2008-2093—webappsphp
SQL injection vulnerability in the Profiler (com_comprofiler) component in Community Builder for Mambo and Joomla! allow
23RISK
open ↗
Referência✓ VexDay Proof
Power Editor 2.0 - Remote File Disclosure / Edit
CVE-2008-2115—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in editor.php in ScriptsEZ.net Power Editor 2.0 allow remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
MyKtools 2.4 - Arbitrary Database Backup
CVE-2008-6815—webappsphp
mykdownload.php in MyKtools 2.4 does not require administrative authentication, which allows remote attackers to read a
23RISK
open ↗
Referência✓ VexDay Proof
PostcardMentor - 'cat_fldAuto' SQL Injection
CVE-2008-2132—webappsasp
SQL injection vulnerability in step1.asp in Systementor PostcardMentor allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
SmartBlog 1.3 - 'index.php' SQL Injection
CVE-2008-2183—webappsphp
SQL injection vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Miniweb 2.0 - 'historymonth' SQL Injection
CVE-2008-2197—webappsphp
SQL injection vulnerability in the blogwriter module 2.0 for Miniweb allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
asiCMS alpha 0.208 - Multiple Remote File Inclusions
CVE-2008-4529—webappsphp
Multiple PHP remote file inclusion vulnerabilities in asiCMS alpha 0.208 allow remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows - InternalOpenColorProfile Heap Overflow (PoC) (MS08-046)
CVE-2008-2245—doswindows
Heap-based buffer overflow in the InternalOpenColorProfile function in mscms.dll in Microsoft Windows Image Color Manage
35RISK
open ↗
Referência✓ VexDay Proof
Phoenix View CMS Pre Alpha2 - SQL Injection / Local File Inclusion / Cross-Site Scripting
CVE-2008-2534—webappsphp
Directory traversal vulnerability in admin/admin_frame.php in Phoenix View CMS Pre Alpha2 and earlier allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
Advanced Image Hosting (AIH) 2.1 - SQL Injection
CVE-2008-2536—webappsphp
SQL injection vulnerability in out.php in YABSoft Advanced Image Hosting (AIH) Script 2.1 and earlier allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Jotloader 1.2.1.a - Blind SQL Injection
CVE-2008-2564—webappsphp
SQL injection vulnerability in the JotLoader (com_jotloader) component 1.2.1.a and earlier for Joomla! allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Address Book 3.1.5 - SQL Injection / Cross-Site Scripting
CVE-2008-2566—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to inje
23RISK
open ↗
Referência✓ VexDay Proof
freeSSHd 1.2.1 - (Authenticated) Remote Overflow (SEH)
CVE-2008-2573—remotewindows
Stack-based buffer overflow in SFTP in freeSSHd 1.2.1 allows remote authenticated users to execute arbitrary code via a
23RISK
open ↗
Referência✓ VexDay Proof
I-Pos Internet Pay Online Store 1.3 Beta - SQL Injection
CVE-2008-2634—webappsasp
SQL injection vulnerability in index.asp in I-Pos Internet Pay Online Store 1.3 Beta and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
NoAh 0.9 pre 1.2 - 'filepath' Remote File Disclosure
CVE-2007-6187—webappsphp
Multiple directory traversal vulnerabilities in PHP Content Architect (aka NoAh) 0.9 pre 1.2 and earlier allow remote at
23RISK
open ↗
Referência✓ VexDay Proof
mebiblio 0.4.7 - SQL Injection / Arbitrary File Upload / Cross-Site Scripting
CVE-2008-2647—webappsphp
SQL injection vulnerability in admin/journal_change_mask.inc.php in meBiblio 0.4.7 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
Flux CMS 1.5.0 - 'loadsave.php' Arbitrary File Overwrite
CVE-2008-2686—webappsphp
webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overw
23RISK
open ↗
Referência✓ VexDay Proof
Black Ice Software Inc Barcode SDK - 'BITiff.ocx' Remote Buffer Overflow (1)
CVE-2008-2693—remotewindows
Stack-based buffer overflow in the BITIFF.BITiffCtrl.1 ActiveX control in BITiff.ocx 10.9.3.0 in Black Ice Barcode SDK 5
28RISK
open ↗
Referência✓ VexDay Proof
Black Ice Software Annotation Plugin - 'BiAnno.ocx' Remote Buffer Overflow
CVE-2008-2745—remotewindows
Stack-based buffer overflow in BiAnno ActiveX Control (BiAnno.ocx) in Black Ice Software Annotation Plugin 10.95 allows
28RISK
open ↗
Referência✓ VexDay Proof
SHOUTcast Admin Panel 2.0 - 'page' Local File Inclusion
CVE-2008-2813—webappsphp
Directory traversal vulnerability in index.php in WallCity-Server Shoutcast Admin Panel 2.0, when magic_quotes_gpc is di
23RISK
open ↗
Referência✓ VexDay Proof
Easy-Clanpage 3.0b1 - 'section' Local File Inclusion
CVE-2008-2818—webappsphp
Directory traversal vulnerability in Easy-Clanpage 3.0 b1 allows remote attackers to include and execute arbitrary local
23RISK
open ↗
Referência✓ VexDay Proof
eLineStudio Site Composer (ESC) 2.6 - Multiple Vulnerabilities
CVE-2008-2864—webappsphp
eLineStudio Site Composer (ESC) 2.6 and earlier allows remote attackers to obtain sensitive information via a direct req
23RISK
open ↗
Referência✓ VexDay Proof
E-topbiz ViralDX 2.07 - 'bannerid' SQL Injection
CVE-2008-2867—webappsphp
SQL injection vulnerability in adclick.php in E-topbiz Viral DX 1 2.07 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Jokes & Funny Pics Script - 'sb_jokeid' SQL Injection
CVE-2008-2874—webappsphp
SQL injection vulnerability in index.php in Softbiz Jokes & Funny Pics Script allows remote attackers to execute arbitra
23RISK
open ↗
← previouspage 707 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.