Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,681cataloged exploits
40,948CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,433VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Mihalism Multi Host 2.0.7 - 'download.php' Remote File Disclosure
CVE-2007-6653—webappsphp
Directory traversal vulnerability in download.php in Mihalism Multi Host 2.0.7 allows remote attackers to read arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
oneSCHOOL - 'admin/login.asp' SQL Injection
CVE-2007-6665—webappsasp
SQL injection vulnerability in admin/login.asp in Netchemia oneSCHOOL allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
MyPHP Forum 3.0 (Final) - Multiple SQL Injections
CVE-2007-6667—webappsphp
SQL injection vulnerability in faq.php in MyPHP Forum 3.0 and earlier allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
PHP Webquest 2.6 - Get Database Credentials
CVE-2008-0249—webappsphp
PHP Webquest 2.6 allows remote attackers to retrieve database credentials via a direct request to admin/backup_phpwebque
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Visual InterDev 6.0 SP6 - '.sln' Local Buffer Overflow
CVE-2008-0250—localwindows
Buffer overflow in Microsoft Visual InterDev 6.0 (SP6) allows user-assisted attackers to execute arbitrary code via a St
28RISK
open ↗
Referência✓ VexDay Proof
EasyNews 40tr - SQL Injection / Cross-Site Scripting / Local File Inclusion
CVE-2008-1649—webappsphp
Cross-site scripting (XSS) vulnerability in staticpages/easypublish/index.php in EasyNews 4.0 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
TaskFreak! 0.6.1 - SQL Injection
CVE-2008-0270—webappsphp
SQL injection vulnerability in index.php in TaskFreak! 0.6.1 and earlier allows remote authenticated users to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
FaScript FaPersianHack 1.0 - SQL Injection
CVE-2008-0326—webappsphp
SQL injection vulnerability in class/show.php in FaScript FaPersianHack 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
PHPEcho CMS 2.0 - 'id' SQL Injection
CVE-2008-0355—webappsphp
SQL injection vulnerability in index.php in the forum module in PHPEcho CMS, probably 2.0-rc3 and earlier, allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Mini File Host 1.2 - 'language' Local File Inclusion
CVE-2008-0357—webappsphp
Directory traversal vulnerability in pages/upload.php in Galaxyscripts Mini File Host 1.2.1 and earlier allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
Crystal Reports XI Release 2 (Enterprise Tree Control) - ActiveX Buffer Overflow (Denial of Service) (PoC)
CVE-2008-0379—doswindows
Race condition in the Enterprise Tree ActiveX control (EnterpriseControls.dll 11.5.0.313) in Crystal Reports XI Release
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Visual Basic Enterprise 6 SP6 - '.dsr' File Handling Buffer Overflow
CVE-2008-0392—localwindows
Multiple buffer overflows in Microsoft Visual Basic Enterprise Edition 6.0 SP6 allow user-assisted remote attackers to e
35RISK
open ↗
Referência✓ VexDay Proof
Gradman 0.1.3 - 'info.php' Local File Inclusion
CVE-2008-0393—webappsphp
Directory traversal vulnerability in info.php in GradMan 0.1.3 and earlier allows remote attackers to include and execut
23RISK
open ↗
Referência✓ VexDay Proof
bloofox 0.3 - SQL Injection / File Disclosure
CVE-2008-0428—webappsphp
Multiple SQL injection vulnerabilities in the login function in system/class_permissions.php in bloofoxCMS 0.3 allow rem
23RISK
open ↗
Referência✓ VexDay Proof
Alstrasoft Forum Pay Per Post Exchange 2.0 - SQL Injection
CVE-2008-0429—webappsphp
SQL injection vulnerability in index.php in AlstraSoft Forum Pay Per Post Exchange 2.0 allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
OZJournals 2.1.1 - 'id' File Disclosure
CVE-2008-0435—webappsphp
Directory traversal vulnerability in index.php in OZJournals 2.1.1 allows remote attackers to read portions of arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Backup Exec System Recovery Manager 7.0.1 - Arbitrary File Upload
CVE-2008-0457—remotewindows
Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, a
28RISK
open ↗
Referência✓ VexDay Proof
Move Networks Upgrade Manager Control - Remote Buffer Overflow
CVE-2008-0477—remotewindows
Stack-based buffer overflow in the QMPUpgrade.Upgrade.1 ActiveX control in QMPUpgrade.dll 1.0.0.1 in Move Networks Upgra
28RISK
open ↗
Referência✓ VexDay Proof
Mambo Component EstateAgent 0.1 - SQL Injection
CVE-2008-0517—webappsphp
SQL injection vulnerability in index.php in the Darko Selesi EstateAgent (com_estateagent) 0.1 component for Mambo 4.5.x
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin WassUp 1.4.3 - 'to_date' SQL Injection
CVE-2008-0520—webappsphp
Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote att
23RISK
open ↗
Referência✓ VexDay Proof
phpIP 4.3.2 - Multiple SQL Injections
CVE-2008-0538—webappsphp
Multiple SQL injection vulnerabilities in phpIP Management 4.3.2 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component 'com_catalogshop' 1.0b1 - SQL Injection
CVE-2008-0557—webappsphp
SQL injection vulnerability in index.php in the CatalogShop (com_catalogshop) 1.0b1 componenent for Mambo and Joomla! al
23RISK
open ↗
Referência✓ VexDay Proof
RMSOFT Gallery System 2.0 - 'id' SQL Injection
CVE-2008-0611—webappsphp
SQL injection vulnerability in rmgs/images.php in the RMSOFT Gallery System 2.0 module for XOOPS allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Astanda Directory Project 1.2 - 'link_id' SQL Injection
CVE-2008-0649—webappsphp
SQL injection vulnerability in detail.php in Astanda Directory Project (ADP) 1.2 and 1.3 allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_noticias 1.0 - SQL Injection
CVE-2008-0670—webappsphp
SQL injection vulnerability in index.php in the Noticias (com_noticias) 1.0 component for Joomla! allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
sflog! 0.96 - Remote File Disclosure
CVE-2008-0703—webappsphp
Multiple directory traversal vulnerabilities in sflog! 0.96 allow remote attackers to read arbitrary files via a .. (dot
23RISK
open ↗
Referência✓ VexDay Proof
osCommerce Addon Customer Testimonials 3.1 - SQL Injection
CVE-2008-0719—webappsphp
SQL injection vulnerability in customer_testimonials.php in the Customer Testimonials 3 and 3.1 Addon for osCommerce Onl
23RISK
open ↗
Referência✓ VexDay Proof
PostNuke 0.764 - Blind SQL Injection
CVE-2008-1591—webappsphp
The pnVarPrepForStore function in PostNuke 0.764 and earlier skips input sanitization when magic_quotes_runtime is enabl
23RISK
open ↗
Referência✓ VexDay Proof
PEEL CMS 3.x - Admin Hash Extraction / Arbitrary File Upload
CVE-2008-1496—webappsphp
Multiple SQL injection vulnerabilities in PEEL, possibly 3.x and earlier, allow remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component NeoGallery 1.1 - SQL Injection
CVE-2008-0752—webappsphp
SQL injection vulnerability in index.php in the Neogallery (com_neogallery) 1.1 component for Joomla! allows remote atta
23RISK
open ↗
← previouspage 716 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.