Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,861cataloged exploits
40,956CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,436VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Web Content System 2.7.1 - Remote File Inclusion
CVE-2007-1771—webappsphp
PHP remote file inclusion vulnerability in manage/javascript/formjavascript.php in Ay System Solutions Web Content Syste
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke Module Eve-Nuke 0.1 - 'mysql.php' Remote File Inclusion
CVE-2007-1778—webappsphp
PHP remote file inclusion vulnerability in db/mysql.php in the Eve-Nuke 0.1 (EN-Forums) module for PHP-Nuke allows remot
23RISK
open ↗
Referência✓ VexDay Proof
PHPMyphorum 1.5a - '/mep/frame.php' Remote File Inclusion
CVE-2007-0361—webappsphp
PHP remote file inclusion vulnerability in mep/frame.php in PHPMyphorum 1.5a allows remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Persism CMS 0.9.2 - system[path] Remote File Inclusion
CVE-2007-2545—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Persism CMS 0.9.2 and earlier allow remote attackers to execute ar
35RISK
open ↗
Referência✓ VexDay Proof
DreamAccount 3.1 - 'da_path' Remote File Inclusion
CVE-2006-2881—webappsphp
Multiple PHP remote file inclusion vulnerabilities in DreamAccount 3.1 and earlier, when register_globals is enabled, al
28RISK
open ↗
Referência✓ VexDay Proof
phpMyPortal 3.0.0 RC3 - GLOBALS[CHEMINMODULES] Remote File Inclusion
CVE-2007-2594—webappsphp
PHP remote file inclusion vulnerability in inc/articles.inc.php in phpMyPortal 3.0.0 RC3 allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
aForum 1.32 - 'CommonAbsDir' Remote File Inclusion
CVE-2007-2596—webappsphp
PHP remote file inclusion vulnerability in common/func.php in aForum 1.32 and earlier allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
TutorialCMS 1.00 - 'search.php?search' SQL Injection
CVE-2007-2600—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in TutorialCMS (aka Photoshop Tutorials) 1.00 and earlier allow remo
23RISK
open ↗
Referência✓ VexDay Proof
Thyme Calendar 1.3 - SQL Injection
CVE-2007-2621—webappsphp
SQL injection vulnerability in event_view.php in Thyme Calendar 1.3 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
BlogMe 3.0 - 'archshow.asp?var' SQL Injection
CVE-2007-2661—webappsasp
SQL injection vulnerability in archshow.asp in BlogMe 3.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
BitsCast 0.13.0 - invalid string Remote Denial of Service
CVE-2007-2726—doswindows
BitsCast 0.13.0 allows remote attackers to cause a denial of service (application crash) via an RSS 2.0 feed item with c
23RISK
open ↗
Referência✓ VexDay Proof
PrecisionID Barcode ActiveX 1.9 - Arbitrary File Overwrite
CVE-2007-2755—remotewindows
The PrecisionID Barcode 1.9 ActiveX control in PrecisionID_Barcode.dll, when Internet Explorer 6 is used, allows remote
23RISK
open ↗
Referência✓ VexDay Proof
IntelliTamper 2.07 - HTTP Header Remote Code Execution
CVE-2008-3361—remotewindows
Stack-based buffer overflow in IntelliTamper 2.07 allows remote web sites to execute arbitrary code via a long HTTP Serv
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Internet Explorer - 'MDAC' Remote Code Execution (MS06-014) (Metasploit) (2)
CVE-2006-0003—remotewindows
Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and dis
60RISK
open ↗
Referência✓ VexDay Proof
Eudora 7.1 - SMTP ResponseRemote Remote Buffer Overflow
CVE-2007-2770—remotewindows
Stack-based buffer overflow in Eudora 7.1 allows user-assisted, remote SMTP servers to execute arbitrary code via a long
23RISK
open ↗
Referência✓ VexDay Proof
Alstrasoft Template Seller Pro 3.25 - Remote Code Execution
CVE-2007-2777—webappsphp
Unrestricted file upload vulnerability in admin/addsptemplate.php in AlstraSoft Template Seller Pro 3.25 and earlier all
23RISK
open ↗
Referência✓ VexDay Proof
MolyX BOARD 2.5.0 - 'index.php?lang' Local File Inclusion
CVE-2007-2778—webappsphp
Multiple directory traversal vulnerabilities in MolyX BOARD 2.5.0 allow remote attackers to read arbitrary files via a .
23RISK
open ↗
Referência✓ VexDay Proof
LeadTools Raster Thumbnail Object Library - 'LTRTM14e.dll' Remote Buffer Overflow
CVE-2007-2787—remotewindows
Stack-based buffer overflow in the BrowseDir function in the (1) lttmb14E.ocx or (2) LTRTM14e.DLL ActiveX control in Lea
23RISK
open ↗
Referência✓ VexDay Proof
Mini-stream RM-MP3 Converter 3.0.0.7 - '.m3u' Local Stack Overflow (PoC)
CVE-2009-1328—doswindows
Stack-based buffer overflow in Mini-stream RM-MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary code vi
23RISK
open ↗
Referência✓ VexDay Proof
Achievo 1.3.2 - 'FCKeditor' Arbitrary File Upload
CVE-2008-2742—webappsphp
Unrestricted file upload in the mcpuk file editor (atk/attributes/fck/editor/filemanager/browser/mcpuk/connectors/php/co
23RISK
open ↗
Referência✓ VexDay Proof
minimal ablog 0.4 - SQL Injection / Arbitrary File Upload / Authentication Bypass
CVE-2008-6613—webappsphp
uploader.php in minimal-ablog 0.4 does not properly restrict access, which allows remote attackers to gain administrativ
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Visual Basic 6.0 Project - Company Name Stack Overflow (PoC)
CVE-2007-2884—doswindows
Multiple stack-based buffer overflows in Microsoft Visual Basic 6 allow user-assisted remote attackers to cause a denial
35RISK
open ↗
Referência✓ VexDay Proof
NavBoard 2.6.0 - Remote Code Execution
CVE-2007-2899—webappsphp
Direct static code injection vulnerability in admin_config.php in NavBoard 2.6.0 allows remote attackers to inject arbit
23RISK
open ↗
Referência✓ VexDay Proof
ADN Forum 1.0b - Insecure Cookie Handling
CVE-2008-6001—webappsphp
index.php in ADN Forum 1.0b and earlier allows remote attackers to bypass authentication and gain sysop access via a fpu
23RISK
open ↗
Referência✓ VexDay Proof
Click&Rank - SQL Injection / Cross-Site Scripting
CVE-2008-5888—webappsasp
Multiple SQL injection vulnerabilities in Click&Rank allow remote attackers to execute arbitrary SQL commands via the id
23RISK
open ↗
Referência✓ VexDay Proof
Fundanemt 2.2.0 - 'spellcheck.php' Remote Code Execution
CVE-2007-2935—webappsphp
core/spellcheck/spellcheck.php in Fundanemt before 2.2.0.1 allows remote attackers to execute arbitrary commands via she
23RISK
open ↗
Referência✓ VexDay Proof
vBulletin vBGSiteMap 2.41 - 'root' Remote File Inclusion
CVE-2007-2941—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the creator in vBulletin Google Yahoo Site Map (vBGSiteMap) 2.41 f
23RISK
open ↗
Referência✓ VexDay Proof
Exjune Officer Message System 1 - Multiple Vulnerabilities
CVE-2009-1752—webappsphp
exJune Office Message System 1 does not properly restrict access to (1) configure.asp and (2) addmessage2.asp, which all
23RISK
open ↗
Referência✓ VexDay Proof
RantX 1.0 - Insecure Admin Authentication
CVE-2008-2297—webappsphp
The admin.php file in Rantx allows remote attackers to bypass authentication and gain privileges by setting the logininf
23RISK
open ↗
Referência✓ VexDay Proof
Zomplog 3.8 - 'force_download.php' Remote File Disclosure
CVE-2007-2157—webappsphp
Directory traversal vulnerability in upload/force_download.php in Zomplog 3.8 allows remote attackers to read arbitrary
23RISK
open ↗
← previouspage 719 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.