Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Gigaset SE461 WiMAX Router - Remote Denial of Service
CVE-2009-1152—doshardware
Siemens Gigaset SE461 WiMAX router 1.5-BL024.9.6401, and possibly other versions, allows remote attackers to cause a den
23RISK
open ↗
Referência✓ VexDay Proof
WebBuilder 2.0 - 'StageLoader.php' Remote File Inclusion
CVE-2007-0703—webappsphp
PHP remote file inclusion vulnerability in library/StageLoader.php in WebBuilder 2.0 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Remote Mouse GUI 3.008 - Local Privilege Escalation
CVE-2021-35448—localwindows
Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by using
23RISK
open ↗
Referência✓ VexDay Proof
db Software Laboratory VImpX - 'VImpX.ocx' Multiple Vulnerabilities
CVE-2008-4750—remotewindows
Stack-based buffer overflow in the VImpX.VImpAX ActiveX control (VImpX.ocx) 4.8.8.0 in DB Software Laboratory VImp X, po
23RISK
open ↗
Referência✓ VexDay Proof
phpYabs 0.1.2 - 'Azione' Remote File Inclusion
CVE-2009-0639—webappsphp
PHP remote file inclusion vulnerability in moduli/libri/index.php in phpyabs 0.1.2 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
doITlive CMS 2.50 - SQL Injection / Cross-Site Scripting
CVE-2008-2843—webappsasp
Multiple SQL injection vulnerabilities in doITLive CMS 2.50 and earlier allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
xKiosk 3.0.1i - 'xkurl.php?PEARPATH' Remote File Inclusion
CVE-2007-5314—webappsphp
PHP remote file inclusion vulnerability in system/funcs/xkurl.php in xKiosk WEB 3.0.1i, when register_globals is enabled
23RISK
open ↗
Referência✓ VexDay Proof
TurnkeyForms Local Classifieds - Authentication Bypass
CVE-2008-6302—webappsphp
TurnkeyForms Local Classifieds allows remote attackers to bypass authentication and gain administrative access via a dir
23RISK
open ↗
Referência✓ VexDay Proof
Enthusiast 3.1.4 - 'show_joined.php' Remote File Inclusion
CVE-2008-5792—webappsphp
PHP remote file inclusion vulnerability in show_joined.php in Indiscripts Enthusiast 3.1.4, and possibly earlier, allows
23RISK
open ↗
Referência✓ VexDay Proof
postecards - SQL Injection / File Disclosure
CVE-2008-5560—webappsasp
PostEcards stores sensitive information under the web root with insufficient access control, which allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
ZeeReviews - SQL Injection
CVE-2008-3669—webappsphp
SQL injection vulnerability in comments.php in ZeeScripts Reviews Opinions Rating Posting Engine Web-Site PHP Script (ak
23RISK
open ↗
Referência✓ VexDay Proof
Crux Gallery 1.32 - Insecure Cookie Handling
CVE-2008-4484—webappsphp
main.php in Crux Gallery 1.32 and earlier allows remote attackers to gain administrative access by setting the name para
23RISK
open ↗
Referência✓ VexDay Proof
zeeproperty - 'adid' SQL Injection
CVE-2008-4621—webappsphp
SQL injection vulnerability in bannerclick.php in ZeeScripts Zeeproperty allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
PlugSpace 0.1 - 'navi' Local File Inclusion
CVE-2008-4739—webappsphp
Directory traversal vulnerability in index.php in PlugSpace 0.1, when magic_quotes_gpc is disabled, allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
Hummingbird 13.0 - ActiveX Remote Buffer Overflow (PoC)
CVE-2008-4729—doswindows
Stack-based buffer overflow in Hummingbird.XWebHostCtrl.1 ActiveX control (hclxweb.dll) in Hummingbird Xweb ActiveX Cont
23RISK
open ↗
Referência✓ VexDay Proof
AJ Auction - Authentication Bypass
CVE-2008-6965—webappsphp
AJ Square AJ Auction OOPD, Pro Platinum Skin #1, Pro Platinum Skin #2, and Web 2.0 send a redirect but do not exit when
23RISK
open ↗
Referência✓ VexDay Proof
Online Booking Manager 2.2 - 'id' SQL Injection
CVE-2008-5194—webappsphp
SQL injection vulnerability in checkavail.php in SoftVisions Software Online Booking Manager (obm) 2.2 allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
Joovili 3.1.4 - Insecure Cookie Handling
CVE-2008-6269—webappsphp
Joovili 3.1.4 allows remote attackers to bypass authentication and gain privileges as other users, including the adminis
23RISK
open ↗
Referência✓ VexDay Proof
Domain Seller Pro 1.5 - 'id' SQL Injection
CVE-2008-5788—webappsphp
SQL injection vulnerability in index.php in Domain Seller Pro 1.5 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
aspwebalbum 3.2 - Arbitrary File Upload / SQL Injection / Cross-Site Scripting
CVE-2004-1553—webappsphp
SQL injection vulnerability in aspWebAlbum allows remote attackers to execute arbitrary SQL statements via (1) the usern
23RISK
open ↗
Referência✓ VexDay Proof
DELTAScripts PHP Classifieds 7.5 - Authentication Bypass
CVE-2008-5806—webappsphp
SQL injection vulnerability in login.php in DeltaScripts PHP Classifieds 7.5 and earlier allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
Web//News 1.4 - 'parser.php' Remote File Inclusion (1)
CVE-2006-5100—webappsphp
PHP remote file inclusion vulnerability in parse/parser.php in WEB//NEWS (aka webnews) 1.4 and earlier allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
Hummingbird Deployment Wizard 2008 - ActiveX Command Execution
CVE-2008-4728—remotewindows
Multiple insecure method vulnerabilities in the DeployRun.DeploymentSetup.1 (DeployRun.dll) ActiveX control 10.0.0.44 in
35RISK
open ↗
Referência✓ VexDay Proof
X7 Chat 2.0.1A1 - Local File Inclusion
CVE-2008-4718—webappsphp
Directory traversal vulnerability in help/mini.php in X7 Chat 2.0.1 A1 and earlier allows remote attackers to include an
23RISK
open ↗
Referência✓ VexDay Proof
MaxCMS 2.0 - '/inc/ajax.asp' SQL Injection
CVE-2009-1764—webappsasp
SQL injection vulnerability in inc/ajax.asp in MaxCMS 2.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
SezHoo 0.1 - Remote File Inclusion
CVE-2008-4704—webappsphp
PHP remote file inclusion vulnerability in SezHooTabsAndActions.php in SezHoo 0.1 allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Eserv 3.x - FTP Server (ABOR) Remote Stack Overflow (PoC)
CVE-2008-4588—doswindows
Stack-based buffer overflow in the FTP server in Etype Eserv 3.x, possibly 3.26, allows remote attackers to cause a deni
23RISK
open ↗
Referência✓ VexDay Proof
Chipmunk Blog - (Authentication Bypass) Add Admin
CVE-2009-0403—webappsphp
SQL injection vulnerability in admin/authenticate.php in Chipmunk Blogger Script allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
Free PHP VX Guestbook 1.06 - Insecure Cookie Handling
CVE-2008-7007—webappsphp
Free PHP VX Guestbook 1.06 allows remote attackers to bypass authentication and gain administrative access by setting th
23RISK
open ↗
Referência✓ VexDay Proof
eLineStudio Site Composer (ESC) 2.6 - Multiple Vulnerabilities
CVE-2008-2863—webappsphp
Multiple absolute path traversal vulnerabilities in eLineStudio Site Composer (ESC) 2.6 allow remote attackers to create
23RISK
open ↗
← previouspage 731 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.