Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,673cataloged exploits

40,945CVEs with public exploitation

24,696lab-tested

All Referência 26,571Exploit-DB 24,489GitHub PoC 18,425VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

miniBloggie 1.0 - 'del.php' Blind SQL Injection

CVE-2008-4628—webappsphp

SQL injection vulnerability in del.php in myWebland miniBloggie 1.0 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

Ultimate WebBoard 3.00 - 'Category' SQL Injection

CVE-2008-4666—webappsphp

SQL injection vulnerability in webboard.php in Ultimate Webboard 3.00 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component JPad 1.0 - (Authenticated) SQL Injection

CVE-2008-4715—webappsphp

SQL injection vulnerability in the Jpad (com_jpad) 1.0 component for Joomla! allows remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

KVIrc 3.4.0 - Virgo Remote Format String (PoC)

CVE-2008-4748—doswindows

Format string vulnerability in the URI handler in KVirc 3.4.0, when set as the default application for processing IRC UR

23RISK

open ↗

Referência✓ VexDay Proof

db Software Laboratory VImpX - 'VImpX.ocx' Multiple Vulnerabilities

CVE-2008-4749—remotewindows

Multiple insecure method vulnerabilities in the VImpX.VImpAX ActiveX control (VImpX.ocx) 4.8.8.0 in DB Software Laborato

23RISK

open ↗

Referência✓ VexDay Proof

freeSSHd 1.2.1 - (Authenticated) SFTP 'realpath' Remote Buffer Overflow (PoC)

CVE-2008-4762—doswindows

Stack-based buffer overflow in freeSSHd 1.2.1 allows remote authenticated users to cause a denial of service (service cr

28RISK

open ↗

Referência✓ VexDay Proof

Microsoft Internet Explorer (Windows Vista) - XML Parsing Buffer Overflow

CVE-2008-4844—remotewindows

Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet

50RISK

open ↗

Referência✓ VexDay Proof

Philips VOIP841 Firmware 1.0.4.800 - Multiple Vulnerabilities

CVE-2008-4874—remotehardware

The web component in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and 1.0.4.80 has a back door "service

23RISK

open ↗

Referência✓ VexDay Proof

Philips VOIP841 Firmware 1.0.4.800 - Multiple Vulnerabilities

CVE-2008-4875—remotehardware

Directory traversal vulnerability in the web server in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and

23RISK

open ↗

Referência✓ VexDay Proof

Philips VOIP841 Firmware 1.0.4.800 - Multiple Vulnerabilities

CVE-2008-4876—remotehardware

Cross-site scripting (XSS) vulnerability in the web server component in Philips Electronics VOIP841 DECT Phone with firm

23RISK

open ↗

Referência✓ VexDay Proof

YourFreeWorld Blog Blaster - 'tr.php' SQL Injection

CVE-2008-4883—webappsphp

SQL injection vulnerability in tr.php in YourFreeWorld Blog Blaster Script allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

YourFreeWorld Classifieds Hosting - SQL Injection

CVE-2008-4884—webappsphp

SQL injection vulnerability in tr.php in YourFreeWorld Classifieds Hosting Script allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

Visagesoft eXPert PDF ViewerX - 'VSPDFViewerX.ocx' File Overwrite

CVE-2008-4919—remotewindows

Insecure method vulnerability in VISAGESOFT eXPert PDF Viewer X ActiveX control (VSPDFViewerX.ocx) 3.0.990.0 allows remo

23RISK

open ↗

Referência✓ VexDay Proof

ModernBill 4.4.x - Cross-Site Scripting / Remote File Inclusion

CVE-2008-5060—webappsphp

Multiple PHP remote file inclusion vulnerabilities in ModernBill 4.4 and earlier allow remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

Yoxel 1.23beta - 'itpm_estimate.php' Remote Code Execution

CVE-2008-5071—webappsphp

Multiple eval injection vulnerabilities in itpm_estimate.php in Yoxel 1.23beta and earlier allow remote authenticated us

23RISK

open ↗

Referência✓ VexDay Proof

K-Lite Mega Codec Pack 3.5.7.0 - Local Windows Explorer Denial of Service (PoC)

CVE-2008-5072—doswindows

vsfilter.dll in K-Lite Mega Codec Pack 3.5.7.0 allows remote attackers to cause a denial of service (application crash)

23RISK

open ↗

Referência✓ VexDay Proof

Deterministic Network Enhancer - 'dne2000.sys' Kernel Ring0 SYSTEM

CVE-2008-5121—localwindows

dne2000.sys in Citrix Deterministic Network Enhancer (DNE) 2.21.7.233 through 3.21.7.17464, as used in (1) Cisco VPN Cli

23RISK

open ↗

Referência✓ VexDay Proof

TinyWebGallery 1.5 - 'image' Remote File Inclusion

CVE-2006-4166—webappsphp

PHP remote file inclusion vulnerability in TinyWebGallery 1.5 and earlier allows remote attackers to execute arbitrary P

23RISK

open ↗

Referência✓ VexDay Proof

Clean CMS 1.5 - Blind SQL Injection / Cross-Site Scripting

CVE-2008-5289—webappsphp

SQL injection vulnerability in full_txt.php in Werner Hilversum Clean CMS 1.5 allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

VWar 1.50 R14 - 'online.php' SQL Injection

CVE-2006-4142—webappsphp

SQL injection vulnerability in extra/online.php in Virtual War (VWar) 1.5.0 R14 and earlier allows remote attackers to e

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component MiniBB 1.5a - Remote File Inclusion

CVE-2006-3690—webappsphp

Multiple PHP remote file inclusion vulnerabilities in MiniBB Forum 1.5a and earlier allow remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

PHPstore Wholesale - 'id' SQL Injection

CVE-2008-5493—webappsphp

SQL injection vulnerability in track.php in PHPStore Wholesales (aka Wholesale) allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

PozScripts Business Directory Script - 'cid' SQL Injection

CVE-2008-5496—webappsphp

SQL injection vulnerability in showcategory.php in PozScripts Business Directory Script allows remote attackers to execu

23RISK

open ↗

Referência✓ VexDay Proof

BandSite CMS 1.1.4 - Insecure Cookie Handling

CVE-2008-5497—webappsphp

BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the login_

23RISK

open ↗

Referência✓ VexDay Proof

Poll Pro 2.0 - Authentication Bypass

CVE-2008-5573—webappsasp

SQL injection vulnerability in the login feature in Poll Pro 2.0 allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

Nukedit 4.9.x - Remote Create Admin

CVE-2008-5582—webappsphp

SQL injection vulnerability in utilities/login.asp in Nukedit 4.9.x, and possibly earlier, allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

Fez 1.3/2.0 RC1 - 'list.php' SQL Injection

CVE-2008-6028—webappsphp

SQL injection vulnerability in list.php in University of Queensland Library Fez 1.3 and 2.0 RC1 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Iamma Simple Gallery 1.0/2.0 - Arbitrary File Upload

CVE-2008-6084—webappsphp

Unrestricted file upload vulnerability in pages/download.php in Iamma Simple Gallery 1.0 and 2.0 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Scriptsez Mini Hosting Panel - 'members.php' Local File Inclusion

CVE-2008-6090—webappsphp

Directory traversal vulnerability in members.php in ScriptsEz Mini Hosting Panel allows remote attackers to read arbitra

23RISK

open ↗

Referência✓ VexDay Proof

Goople CMS 1.7 - Insecure Cookie Handling

CVE-2008-6118—webappsphp

win/content/upload.php in Goople CMS 1.7 allows remote attackers to bypass authentication and gain administrative access

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.