Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Phaos R4000 Version - 'file' Remote File Disclosure
CVE-2008-1755—webappsphp
Directory traversal vulnerability in the showSource function in showSource.php in World of Phaos 4.0.1 allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
GeoVision LiveAudio - ActiveX Remote Freed-Memory Access
CVE-2009-1092—remotewindows
Use-after-free vulnerability in the LIVEAUDIO.LiveAudioCtrl.1 ActiveX control in LIVEAU~1.OCX 7.0 for GeoVision DVR syst
23RISK
open ↗
Referência✓ VexDay Proof
Admidio 1.4.8 - 'getfile.php' Remote File Disclosure
CVE-2008-5209—webappsphp
Directory traversal vulnerability in modules/download/get_file.php in Admidio 1.4.8 allows remote attackers to read arbi
23RISK
open ↗
Referência✓ VexDay Proof
SG Real Estate Portal 2.0 - Blind SQL Injection / Local File Inclusion
CVE-2008-6010—webappsphp
Multiple directory traversal vulnerabilities in SG Real Estate Portal 2.0 allow remote attackers to read arbitrary files
23RISK
open ↗
Referência✓ VexDay Proof
Apple QuickTime 7.5.5 / iTunes 8.0 - Remote Off-by-One Crash
CVE-2008-4116—dosmultiple
Buffer overflow in Apple QuickTime 7.5.5 and iTunes 8.0 allows remote attackers to cause a denial of service (browser cr
28RISK
open ↗
Referência✓ VexDay Proof
ScriptsFeed (SF) Auto Classifieds Software - Arbitrary File Upload
CVE-2008-6944—webappsphp
Unrestricted file upload vulnerability in ScriptsFeed Auto Classifieds allows remote authenticated users to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
Mantis Bug Tracker 1.1.1 - Code Execution / Cross-Site Scripting / Cross-Site Request Forgery
CVE-2008-2276—webappsphp
Cross-site request forgery (CSRF) vulnerability in manage_user_create.php in Mantis 1.1.1 allows remote attackers to cre
23RISK
open ↗
Referência✓ VexDay Proof
Gretech GOM Encoder 1.0.0.11 - '.Subtitle' Buffer Overflow (PoC)
CVE-2009-1022—doswindows
Heap-based buffer overflow in the Preview/ Set Segment function in Gretech GOMlab GOM Encoder 1.0.0.11 and earlier allow
23RISK
open ↗
Referência✓ VexDay Proof
ExBB 0.22 - Local/Remote File Inclusion
CVE-2008-1862—webappsphp
ExBB Italia 0.22 and earlier only checks GET requests that use the QUERY_STRING for certain path manipulations, which al
23RISK
open ↗
Referência✓ VexDay Proof
unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities
CVE-2009-1949—webappsphp
import_wbb1.php in Unclassified NewsBoard (UNB) 1.6.4 allows remote attackers to obtain sensitive information via a dire
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Server 2000 SP4 (Advanced Server) - Message Queue (MS07-065)
CVE-2007-3039—remotewindows
Stack-based buffer overflow in the Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4, Window
50RISK
open ↗
Referência✓ VexDay Proof
WFTPD Pro Server 3.25 - Site ADMN Remote Denial of Service
CVE-2007-0311—doswindows
Texas Imperial Software WFTPD and WFTPD Pro Server 3.25 and earlier allow remote attackers to cause a denial of service
23RISK
open ↗
Referência✓ VexDay Proof
vxFtpSrv 2.0.3 - 'CWD' Remote Buffer Overflow (PoC)
CVE-2008-4452—doswindows
Buffer overflow in Cambridge Computer Corporation vxFtpSrv 2.0.3 allows remote attackers to cause a denial of service (c
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke - 'iframe.php' Remote File Inclusion
CVE-2007-1626—webappsphp
PHP remote file inclusion vulnerability in iframe.php in the iFrame Module for PHP-NUKE allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module Tutoriais - 'viewcat.php' SQL Injection
CVE-2007-1816—webappsphp
SQL injection vulnerability in viewcat.php in the Tutoriais module for Xoops allows remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Q-Shop 3.5 - 'browse.asp' SQL Injection
CVE-2006-4852—webappsasp
SQL injection vulnerability in browse.asp in QuadComm Q-Shop 3.5 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
PHP-CON 1.3 - 'include.php' Remote File Inclusion
CVE-2007-6177—webappsphp
PHP remote file inclusion vulnerability in Exchange/include.php in PHP_CON 1.3 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Shadowed Portal Module Character Roster - 'mod_root' Remote File Inclusion
CVE-2006-6850—webappsphp
PHP remote file inclusion vulnerability in include.php in the Roster Module (character_roster) in Shadowed Portal 5.7 al
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Module CBSms 1.0 - Remote File Inclusion
CVE-2006-3294—webappsphp
PHP remote file inclusion vulnerability in mod_cbsms_messages.php in CBSMS Mambo Module 1.0 and earlier, when register_g
23RISK
open ↗
Referência✓ VexDay Proof
CHILKAT ASP String - 'CkString.dll 1.1 SaveToFile()' Insecure Method
CVE-2007-4252—remotewindows
Absolute path traversal vulnerability in a certain ActiveX control in CkString.dll 1.1 and earlier in CHILKAT ASP String
23RISK
open ↗
Referência✓ VexDay Proof
PokerMax Poker League 0.13 - Insecure Cookie Handling
CVE-2008-4600—webappsphp
configure.php in PokerMax Poker League Tournament Script 0.13 allows remote attackers to bypass authentication and gain
23RISK
open ↗
Referência✓ VexDay Proof
Ad Manager Pro 2.6 - 'ipath' Remote File Inclusion
CVE-2006-3192—webappsphp
PHP remote file inclusion vulnerability in Ad Manager Pro 2.6 allows remote attackers to execute arbitrary PHP code via
23RISK
open ↗
Referência✓ VexDay Proof
mini-pub 0.3 - File Disclosure / Code Execution
CVE-2008-5579—webappsphp
Absolute path traversal vulnerability in mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to read
23RISK
open ↗
Referência✓ VexDay Proof
txtshop 1.0b (Windows) - 'Language' Local File Inclusion
CVE-2008-6083—webappsphp
Directory traversal vulnerability in header.php in TXTshop beta 1.0 allows remote attackers to include and execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module Kshop 1.17 - 'id' SQL Injection
CVE-2007-1810—webappsphp
SQL injection vulnerability in product_details.php in the Kshop 1.17 and earlier module for Xoops allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component SimpleBoard 1.0.3 - 'catid' SQL Injection
CVE-2008-1077—webappsphp
SQL injection vulnerability in index.php in the Simpleboard (com_simpleboard) 1.0.3 Stable component for Mambo and Jooml
23RISK
open ↗
Referência✓ VexDay Proof
Stash 1.0.3 - Multiple SQL Injections
CVE-2008-4080—webappsphp
SQL injection vulnerability in Stash 1.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
ravennuke 2.3.0 - Multiple Vulnerabilities
CVE-2009-0673—webappsphp
Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.3
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin Enigma 2 Bridge - 'boarddir' Remote File Inclusion
CVE-2006-6863CRITICALwebappsphp
PHP remote file inclusion vulnerability in the Enigma2 plugin (Enigma2.php) in Enigma WordPress Bridge allows remote att
53RISK
open ↗
Referência✓ VexDay Proof
TorrentTrader Classic 1.07 - Multiple Vulnerabilities
CVE-2007-5311—webappsphp
Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic Edition 1.07 allows remote att
23RISK
open ↗
← previouspage 735 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.