Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits

40,961CVEs with public exploitation

24,696lab-tested

All Referência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities

CVE-2007-6494—webappsasp

Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to obtain login access via a request to hosting/a

28RISK

open ↗

Referência✓ VexDay Proof

XOOPS Module Amevents - SQL Injection

CVE-2008-5768—webappsphp

SQL injection vulnerability in print.php in the AM Events (aka Amevents) module 0.22 for XOOPS allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component MailTo - 'article' SQL Injection

CVE-2009-1499—webappsphp

SQL injection vulnerability in the MailTo (aka com_mailto) component in Joomla! allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

OneOrZero Helpdesk 1.6.5.7 - Local File Inclusion

CVE-2009-0886—webappsphp

Directory traversal vulnerability in login.php in OneOrZero Helpdesk 1.6.5.7 and earlier allows remote attackers to read

23RISK

open ↗

Referência✓ VexDay Proof

Free File Hosting 1.1 - 'forgot_pass.php' File Inclusion

CVE-2006-5762—webappsphp

PHP remote file inclusion vulnerability in forgot_pass.php in Free File Hosting 1.1 and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

PHP weather 2.2.2 - Local File Inclusion / Cross-Site Scripting

CVE-2008-5770—webappsphp

Cross-site scripting (XSS) vulnerability in config/make_config.php in PHP Weather 2.2.2 allows remote attackers to injec

23RISK

open ↗

Referência✓ VexDay Proof

Open Cubic Player 2.6.0pre6/0.1.10_rc5 - Multiple Local Buffer Overflows

CVE-2006-4046—localwindows

Multiple stack-based buffer overflows in Open Cubic Player 2.6.0pre6 and earlier for Windows, and 0.1.10_rc5 and earlier

28RISK

open ↗

Referência✓ VexDay Proof

phpAuction 2.1 - 'phpAds_path' Remote File Inclusion

CVE-2006-3984—webappsphp

PHP remote file inclusion vulnerability in phpAdsNew/view.inc.php in Albasoftware Phpauction 2.1 and possibly later vers

23RISK

open ↗

Referência✓ VexDay Proof

tbdev 01-01-2008 - Multiple Vulnerabilities

CVE-2009-2141—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to inject arbitrary web

23RISK

open ↗

Referência✓ VexDay Proof

AspWebCalendar 2008 - Arbitrary File Upload

CVE-2008-2832—webappsasp

Unrestricted file upload vulnerability in calendar_admin.asp in Full Revolution aspWebCalendar 2008 allows remote attack

28RISK

open ↗

Referência✓ VexDay Proof

Mynews 0.10 - Authentication Bypass

CVE-2009-0739—webappsphp

SQL injection vulnerability in login.php in MyNews 0.10 allows remote attackers to execute arbitrary SQL commands via th

23RISK

open ↗

Referência✓ VexDay Proof

The Real Estate Script - 'docID' SQL Injection

CVE-2008-2443—webappsphp

SQL injection vulnerability in dpage.php in The Real Estate Script allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

Logz podcast CMS 1.3.1 - 'art' SQL Injection

CVE-2008-4897—webappsphp

SQL injection vulnerability in fichiers/add_url.php in Logz podcast CMS 1.3.1, when magic_quotes_gpc is disabled, allows

23RISK

open ↗

Referência✓ VexDay Proof

WWWISIS 7.1 - 'IsisScript' Local File Disclosure / Cross-Site Scripting

CVE-2007-5455—webappscgi

Cross-site scripting (XSS) vulnerability in wxis.exe in WWWISIS 7.1 and earlier allows remote attackers to inject arbitr

23RISK

open ↗

Referência✓ VexDay Proof

RSS Simple News - SQL Injection

CVE-2008-6333—webappsphp

SQL injection vulnerability in news.php in RSS Simple News (RSSSN), when magic_quotes_gpc is disabled, allows remote att

23RISK

open ↗

Referência✓ VexDay Proof

SFS EZ Gaming Directory - 'directory.php' SQL Injection

CVE-2008-6781—webappsphp

SQL injection vulnerability in directory.php in Sites for Scripts (SFS) Gaming Directory allows remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

Pollbooth 2.0 - 'pollID' SQL Injection

CVE-2008-4765—webappsphp

SQL injection vulnerability in pollBooth.php in osCommerce Poll Booth Add-On 2.0 allows remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_phocadocumentation - 'id' SQL Injection

CVE-2009-0702—webappsphp

SQL injection vulnerability in the Phoca Documentation (com_phocadocumentation) component for Joomla! allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

xeCMS 1.x - 'view.php' Remote File Disclosure

CVE-2007-6508—webappsphp

Directory traversal vulnerability in view.php in xeCMS 1.0 allows remote attackers to read arbitrary files via a ..%2F (

23RISK

open ↗

Referência✓ VexDay Proof

OTSCMS 2.1.3 - Multiple Remote File Inclusions

CVE-2006-5547—webappsphp

PHP remote file inclusion vulnerability in OTSCMS/OTSCMS.php in Open Tibia Server Content Management System (OTSCMS) 1.0

23RISK

open ↗

Referência✓ VexDay Proof

Emefa Guestbook 3.0 - Remote Database Disclosure

CVE-2008-5852—webappsasp

Emefa Guestbook 3.0 stores sensitive information under the web root with insufficient access control, which allows remot

23RISK

open ↗

Referência✓ VexDay Proof

Ol BookMarks Manager 0.7.4 - 'root' Remote File Inclusion

CVE-2007-2816—webappsphp

Multiple PHP remote file inclusion vulnerabilities in ol'bookmarks 0.7.4 allow remote attackers to execute arbitrary PHP

28RISK

open ↗

Referência✓ VexDay Proof

Torbstoff News 4 - 'pfad' Remote File Inclusion

CVE-2006-4045—webappsphp

PHP remote file inclusion vulnerability in news.php in Torbstoff News 4 allows remote attackers to execute arbitrary PHP

23RISK

open ↗

Referência✓ VexDay Proof

PHP Live! 3.2.1 - 'help.php' Remote File Inclusion

CVE-2006-3911—webappsphp

PHP remote file inclusion vulnerability in OSI Codes PHP Live! 3.2.1 and earlier allows remote attackers to execute arbi

28RISK

open ↗

Referência✓ VexDay Proof

Etomite CMS 0.6.1 - 'Username' SQL Injection (mq = off)

CVE-2006-3904—webappsphp

SQL injection vulnerability in manager/index.php in Etomite CMS 0.6.1 and earlier, with magic_quotes_gpc disabled, allow

23RISK

open ↗

Referência✓ VexDay Proof

Java SE Runtime Environment JRE 6 Update 13 - Multiple Vulnerabilities

CVE-2009-1672—doswindows

The Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 1

23RISK

open ↗

Referência✓ VexDay Proof

32bit FTP - 'PASV' Reply Client Remote Overflow (Metasploit)

CVE-2009-1675—remotewindows_x86

Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a

43RISK

open ↗

Referência✓ VexDay Proof

Microsoft Works 7 - 'WkImgSrv.dll' ActiveX Remote Buffer Overflow

CVE-2008-1898—remotewindows

A certain ActiveX control in WkImgSrv.dll 7.03.0616.0, as distributed in Microsoft Works 7 and Microsoft Office 2003 and

50RISK

open ↗

Referência✓ VexDay Proof

Kayako eSupport 2.3.1 - 'subd' Remote File Inclusion

CVE-2006-4011—webappsphp

PHP remote file inclusion vulnerability in esupport/admin/autoclose.php in Kayako eSupport 2.3.1 and earlier, when regis

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_gsticketsystem - 'catid' Blind SQL Injection

CVE-2009-1736—webappsphp

SQL injection vulnerability in the GridSupport (GS) Ticket System (com_gsticketsystem) component for Joomla! allows remo

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.