Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits

40,961CVEs with public exploitation

24,696lab-tested

All Referência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

YourFreeWorld Viral Marketing - SQL Injection

CVE-2008-3756—webappsphp

SQL injection vulnerability in tr.php in YourFreeWorld Viral Marketing Script allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Module HTMLArea3 1.5 - Remote File Inclusion

CVE-2006-3751—webappsphp

PHP remote file inclusion vulnerability in popups/ImageManager/config.inc.php in the HTMLArea3 Addon Component (com_html

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component com_hashcash 1.2.1 - Remote File Inclusion

CVE-2006-3750—webappsphp

PHP remote file inclusion vulnerability in server.php in the Hashcash Component (com_hashcash) 1.2.1 for Joomla! allows

23RISK

open ↗

Referência✓ VexDay Proof

Acc Autos 4.0 - Insecure Cookie Handling

CVE-2008-6292—webappsphp

Acc Autos 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the (1) usernam

23RISK

open ↗

Referência✓ VexDay Proof

Apoll 0.7b - Authentication Bypass

CVE-2008-6272—webappsphp

SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execu

23RISK

open ↗

Referência✓ VexDay Proof

Pluck CMS 4.5.3 - 'g_pcltar_lib_dir' Local File Inclusion

CVE-2008-6253—webappsphp

Directory traversal vulnerability in data/inc/lib/pcltar.lib.php in Pluck 4.5.3, when register_globals is enabled, allow

23RISK

open ↗

Referência✓ VexDay Proof

aspwebalbum 3.2 - Arbitrary File Upload / SQL Injection / Cross-Site Scripting

CVE-2008-6977—webappsphp

Cross-site scripting (XSS) vulnerability in album.asp in Full Revolution aspWebAlbum 3.2 allows remote attackers to inje

23RISK

open ↗

Referência✓ VexDay Proof

Pre Podcast Portal - SQL Injection

CVE-2008-6230—webappsphp

SQL injection vulnerability in Tour.php in Pre Projects Pre Podcast Portal allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

S-CMS 1.1 Stable - Insecure Cookie Handling / Mass Page Delete

CVE-2009-0863—webappsphp

SQL injection vulnerability in admin/delete_page.php in S-Cms 1.1 Stable allows remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência✓ VexDay Proof

Fast Click 1.1.3/2.3.8 - 'show.php' Remote File Inclusion

CVE-2006-2175—webappsphp

PHP remote file inclusion vulnerability in FtrainSoft Fast Click 2.3.8 and earlier allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component ProDesk 1.0/1.2 - Local File Inclusion

CVE-2008-6222—webappsphp

Directory traversal vulnerability in the Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 for Joomla! allows

43RISK

open ↗

Referência✓ VexDay Proof

I-Rater Basic - SQL Injection

CVE-2008-6017—webappsphp

SQL injection vulnerability in messages.php in I-Rater Basic allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência✓ VexDay Proof

ABG Blocking Script 1.0a - 'abg_path' Remote File Inclusion

CVE-2008-3570—webappsphp

PHP remote file inclusion vulnerability in index.php in Africa Be Gone (ABG) 1.0a allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

phpBG 0.9.1 - 'rootdir' Remote File Inclusion

CVE-2007-4636—webappsphp

Multiple PHP remote file inclusion vulnerabilities in phpBG 0.9.1 allow remote attackers to execute arbitrary PHP code v

45RISK

open ↗

Referência✓ VexDay Proof

Powl 0.94 - 'htmledit.php' Remote File Inclusion

CVE-2007-3371—webappsphp

PHP remote file inclusion vulnerability in plugins/widgets/htmledit/htmledit.php in Powl 0.94 allows remote attackers to

45RISK

open ↗

Referência✓ VexDay Proof

Vastal I-Tech Software Zone - 'cat_id' SQL Injection

CVE-2008-6209—webappsphp

SQL injection vulnerability in view_product.php in Vastal I-Tech Software Zone allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Cisco WebEx Meeting Manager UCF - 'atucfobj.dll' ActiveX Remote Buffer Overflow

CVE-2008-3558—remotewindows

Stack-based buffer overflow in the WebexUCFObject ActiveX control in atucfobj.dll in Cisco WebEx Meeting Manager before

50RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component BibTeX 1.3 - Blind SQL Injection

CVE-2007-4502—webappsphp

SQL injection vulnerability in index.php in the BibTeX component (com_jombib) 1.3 and earlier for Joomla! allows remote

23RISK

open ↗

Referência✓ VexDay Proof

Simplog 0.9.2 - 's' Remote Command Execution

CVE-2006-1777—webappsphp

Directory traversal vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Alstrasoft e-Friends 4.98 - 'seid' Multiple SQL Injections

CVE-2007-6106—webappsphp

SQL injection vulnerability in index.php in AlstraSoft E-Friends 4.98 and earlier allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Restaurante 1.0 - 'id' SQL Injection

CVE-2008-1465—webappsphp

SQL injection vulnerability in the Detodas Restaurante (com_restaurante) 1.0 component for Mambo and Joomla! allows remo

23RISK

open ↗

Referência✓ VexDay Proof

Sepcity Classified - 'ID' SQL Injection

CVE-2008-6150—webappsasp

SQL injection vulnerability in classdis.asp in SepCity Classified Ads allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

aePartner 0.8.3 - 'dir[data]' Remote File Inclusion

CVE-2006-2996—webappsphp

PHP remote file inclusion vulnerability in inc/design.inc.php in LoveCompass aePartner 0.8.3 and earlier allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

blogme 3.0 - Cross-Site Scripting / Authentication Bypass

CVE-2006-5976—webappsasp

Multiple SQL injection vulnerabilities in admin_login.asp in BlogMe 3.0 allow remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Enterprise Payroll Systems 1.1 - 'footer' Remote File Inclusion

CVE-2006-2982—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Enterprise Timesheet and Payroll Systems (EPS) 1.1 and earlier all

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component NeoRecruit 1.4 - 'id' SQL Injection

CVE-2007-4506—webappsphp

SQL injection vulnerability in index.php in the NeoRecruit component (com_neorecruit) 1.4 and earlier for Joomla! allows

23RISK

open ↗

Referência✓ VexDay Proof

Python 2.4.2 - 'realpath()' Local Stack Overflow

CVE-2006-1542—locallinux

Stack-based buffer overflow in Python 2.4.2 and earlier, running on Linux 2.6.12.5 under gcc 4.0.3 with libc 2.3.5, allo

23RISK

open ↗

Referência✓ VexDay Proof

phpLinkat 0.1 - Insecure Cookie Handling / SQL Injection

CVE-2008-3406—webappsphp

SQL injection vulnerability in showcat.php in phpLinkat 0.1 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

metajour 2.1 - 'system_path' Remote File Inclusion

CVE-2006-2768—webappsphp

PHP remote file inclusion vulnerability in METAjour 2.1, when register_globals is enabled, allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

BASE 1.2.4 - melissa Snort Frontend Remote File Inclusion

CVE-2006-2685—webappsphp

PHP remote file inclusion vulnerability in Basic Analysis and Security Engine (BASE) 1.2.4 and earlier, with register_gl

50RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.