Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
WSN Guest 1.21 - 'id' SQL Injection
CVE-2007-1517—webappsphp
SQL injection vulnerability in comments.php in WSN Guest 1.02 and 1.21 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
ASP EDGE 1.2b - 'user.asp' SQL Injection
CVE-2007-0560—webappsasp
SQL injection vulnerability in user.asp in ASP EDGE 1.2b and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
impleo music Collection 2.0 - SQL Injection / Cross-Site Scripting
CVE-2009-2153—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Impleo Music Collection 2.0 allows remote attackers to inject a
23RISK
open ↗
Referência✓ VexDay Proof
Dana IRC 1.3 - Remote Buffer Overflow (PoC)
CVE-2008-2922—doswindows
Stack-based buffer overflow in artegic Dana IRC client 1.3 and earlier allows remote attackers to cause a denial of serv
23RISK
open ↗
Referência✓ VexDay Proof
ILIAS 3.7.4 - 'ref_id' Blind SQL Injection
CVE-2008-5816—webappsphp
SQL injection vulnerability in repository.php in ILIAS 3.7.4 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Visual Studio 6.0 - 'PDWizard.ocx' Remote Command Execution
CVE-2007-4891—remotewindows
A certain ActiveX control in PDWizard.ocx 6.0.0.9782 and earlier in Microsoft Visual Studio 6.0 exposes dangerous (1) St
35RISK
open ↗
Referência✓ VexDay Proof
Visual Basic Enterprise Edition SP6 - 'vb6skit.dll' Buffer Overflow (PoC)
CVE-2008-2959—doswindows
Buffer overflow in a certain ActiveX control (vb6skit.dll) in Microsoft Visual Basic Enterprise Edition 6.0 SP6 might al
28RISK
open ↗
Referência✓ VexDay Proof
AJ HYIP ACME - 'readarticle.php' SQL Injection
CVE-2008-4044—webappsphp
SQL injection vulnerability in article/readarticle.php in AJ Square aj-hyip (aka AJ HYIP Acme) allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
campus virtual-lms - Cross-Site Scripting / SQL Injection
CVE-2009-2149—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Campus Virtual-LMS allow remote attackers to inject arbitrary web
23RISK
open ↗
Referência✓ VexDay Proof
Webace-Linkscript 1.3 SE - 'start.php' SQL Injection
CVE-2007-4846—webappsphp
SQL injection vulnerability in start.php in Webace-Linkscript (wls) 1.3 Special Edition (SE) allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
WM Downloader 3.0.0.9 - '.m3u' Universal Stack Overflow
CVE-2009-1327—localwindows
Stack-based buffer overflow in Mini-stream WM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a
23RISK
open ↗
Referência✓ VexDay Proof
GlobalLink 2.7.0.8 - 'glitemflat.dll SetClientInfo()' Heap Overflow
CVE-2007-4802—remotewindows
Multiple heap-based buffer overflows in GlobalLink 2.7.0.8 allow remote attackers to execute arbitrary code via (1) a lo
23RISK
open ↗
Referência✓ VexDay Proof
Jamroom 4.0.2 - 't' Local File Inclusion
CVE-2009-1318—webappsphp
Directory traversal vulnerability in index.php in Jamroom 3.1.2, 3.2.3 through 3.2.6, 4.0.2, and possibly other versions
23RISK
open ↗
Referência✓ VexDay Proof
PHPmotion 2.0 - 'update_profile.php' Arbitrary File Upload
CVE-2008-3117—webappsphp
Unrestricted file upload vulnerability in update_profile.php in PHPmotion 2.0 and earlier allows remote authenticated us
23RISK
open ↗
Referência✓ VexDay Proof
PHPmotion 2.0 - 'update_profile.php' Arbitrary File Upload
CVE-2008-3118—webappsphp
SQL injection vulnerability in play.php in PHPmotion 2.0 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Mole Group Hotel Script 1.0 - SQL Injection
CVE-2008-3124—webappsphp
SQL injection vulnerability in index.php in Mole Group Hotel Script 1.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
PPStream - 'PowerPlayer.dll 2.0.1.3829' ActiveX Remote Overflow
CVE-2007-4748—remotewindows
Buffer overflow in the PowerPlayer.dll ActiveX control in PPStream 2.0.1.3829 allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
Pre Shopping Mall 1.0 - SQL Injection
CVE-2007-2674—webappsphp
SQL injection vulnerability in detail.php in Pre Shopping Mall 1.0 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
Estate Agent Manager 1.3 - 'default.asp' Authentication Bypass
CVE-2006-5934—webappsasp
SQL injection vulnerability in admin/default.asp in Estate Agent Manager 1.3 and earlier allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
UStore 1.0 - 'detail.asp' SQL Injection
CVE-2006-5891—webappsasp
SQL injection vulnerability in detail.asp in Superfreaker Studios UStore 1.0 allows remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Cahier de texte 2.0 - 'lire.php' SQL Injection
CVE-2006-5221—webappsphp
Multiple SQL injection vulnerabilities in Cahier de texte 2.0 allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Gravity Board X 2.0 Beta - SQL Injection / (Authenticated) Code Execution
CVE-2009-1277—webappsphp
SQL injection vulnerability in index.php in Gravity Board X (GBX) 2.0 BETA allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Fuzzylime CMS 3.01 - Remote Command Execution
CVE-2008-3165—webappsphp
Directory traversal vulnerability in rss.php in fuzzylime (cms) 3.01a and earlier, when magic_quotes_gpc is disabled, al
23RISK
open ↗
Referência✓ VexDay Proof
Weblogicnet - 'files_dir' Multiple Remote File Inclusions
CVE-2007-4715—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Weblogicnet allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗
Referência✓ VexDay Proof
LulieBlog 1.02 - SQL Injection
CVE-2008-0446—webappsphp
SQL injection vulnerability in voircom.php in LulieBlog 1.02 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Apple Mac OSX xnu 1228.x - 'hfs-fcntl' Kernel Privilege Escalation
CVE-2009-1235—localosx
XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space
23RISK
open ↗
Referência✓ VexDay Proof
ContentNow 1.4.1 - Arbitrary File Upload / Cross-Site Scripting
CVE-2008-3180—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in upload/file/language_menu.php in ContentNow CMS 1.4.1 allow remot
23RISK
open ↗
Referência✓ VexDay Proof
TWiki 4.2.0 - 'configure' Remote File Disclosure
CVE-2008-3195—webappscgi
Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide
23RISK
open ↗
Referência✓ VexDay Proof
AuraCMS 2.2.2 - '/pages_data.php' Arbitrary Edit/Add/Delete
CVE-2008-3203—webappsphp
js/pages/pages_data.php in AuraCMS 2.2 through 2.2.2 does not perform authentication, which allows remote attackers to a
23RISK
open ↗
Referência✓ VexDay Proof
Ultrastats 0.2.142 - 'players-detail.php' Blind SQL Injection
CVE-2008-3241—webappsphp
SQL injection vulnerability in players-detail.php in UltraStats 0.2.136, 0.2.140, and 0.2.142 allows remote attackers to
23RISK
open ↗
← previouspage 709 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.