Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Rayzz Script 2.0 - Local/Remote File Inclusion
CVE-2007-6230—webappsphp
Directory traversal vulnerability in common/classes/class_HeaderHandler.lib.php in Rayzz Script 2.0 allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
BigAnt Server 2.2 - Remote Overflow (SEH)
CVE-2008-1914—remotewindows
Stack-based buffer overflow in the AntServer module (AntServer.exe) in BigAnt IM Server in BigAnt Messenger 2.2 allows r
60RISK
open ↗
Referência✓ VexDay Proof
Apache 2.2.14 mod_isapi - Dangling Pointer Remote SYSTEM
CVE-2010-0425—remotewindows
modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2
60RISK
open ↗
Referência✓ VexDay Proof
creative Guestbook 1.0 - Multiple Vulnerabilities
CVE-2007-1480—webappsphp
Creative Guestbook 1.0 allows remote attackers to add an administrative account via a direct request to createadmin.php
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Fusion 7.0.2 - Blind SQL Injection
CVE-2008-1918—webappsphp
SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the
23RISK
open ↗
Referência✓ VexDay Proof
OraMon 2.0.1 - Remote Configuration File Disclosure
CVE-2008-6869—webappsphp
Oramon Oracle Database Monitoring Tool 2.0.1 stores sensitive information under the web root with insufficient access co
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Filiale 1.0.4 - 'idFiliale' SQL Injection
CVE-2008-1935—webappsphp
SQL injection vulnerability in the Filiale 1.0.4 component for Joomla! allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
EkinBoard 1.1.0 - Arbitrary File Upload / Authentication Bypass
CVE-2008-7157—webappsphp
Unrestricted file upload vulnerability in EkinBoard 1.1.0 and earlier allows remote attackers to execute arbitrary code
23RISK
open ↗
Referência✓ VexDay Proof
Pinnacle Studio 12 - '.hfz' Directory Traversal
CVE-2009-1743—localwindows
Directory traversal vulnerability in InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Syst
23RISK
open ↗
Referência✓ VexDay Proof
DivX Player 6.4.1 - DivXBrowserPlugin 'npdivx32.dll' IE Denial of Service
CVE-2007-0429—doswindows
DivXBrowserPlugin (aka DivX Web Player) npdivx32.dll, as distributed with DivX Player 6.4.1, allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Classifieds Caffe - 'cat_id' SQL Injection
CVE-2008-1936—webappsphp
SQL injection vulnerability in index.php in Classifieds Caffe allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
NewsReactor 20070220 - Article Grabbing Remote Buffer Overflow (1)
CVE-2007-1568—remotewindows
Stack-based buffer overflow in DaanSystems NewsReactor 20070220.21 allows remote attackers to execute arbitrary code via
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component jabode - 'id' SQL Injection
CVE-2008-7169—webappsphp
SQL injection vulnerability in Jabode horoscope extension (com_jabode) for Joomla! allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
MagicISO 5.4 (build239) - '.cue' Heap Overflow (PoC)
CVE-2007-2761—doslinux
Stack-based buffer overflow in MagicISO 5.4 build 239 and earlier allows remote attackers to execute arbitrary code via
23RISK
open ↗
Referência✓ VexDay Proof
dagger Web engine 23jan2007 - Remote File Inclusion
CVE-2007-3431—webappsphp
PHP remote file inclusion vulnerability in cal.func.php in Valerio Capello Dagger - The Cutting Edge r23jan2007 allows r
45RISK
open ↗
Referência✓ VexDay Proof
ModuleBuilder 1.0 - 'file' Remote File Disclosure
CVE-2007-5812—webappsphp
Directory traversal vulnerability in modules/Builder/DownloadModule.php in ModuleBuilder 1.0 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Agares phpAutoVideo 2.21 - Local/Remote File Inclusion
CVE-2007-6614—webappsphp
PHP remote file inclusion vulnerability in admin/frontpage_right.php in Agares Media phpAutoVideo 2.21 allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
W1L3D4 philboard 1.0 - 'philboard_reply.asp' SQL Injection
CVE-2008-1939—webappsasp
Multiple SQL injection vulnerabilities in W1L3D4 Philboard 1.0 allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
OTManager CMS 2.4 - Insecure Cookie Handling
CVE-2008-7179—webappsphp
OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMI
23RISK
open ↗
Referência✓ VexDay Proof
Apple CFNetwork - HTTP Response Denial of Service
CVE-2007-0464—dososx
The _CFNetConnectionWillEnqueueRequests function in CFNetwork 129.19 on Apple Mac OS X 10.4 through 10.4.10 allows remot
28RISK
open ↗
Referência✓ VexDay Proof
Inout Search Engine - Remote Code Execution
CVE-2007-2988—webappsphp
A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administra
23RISK
open ↗
Referência✓ VexDay Proof
TR News 2.1 - 'nb' SQL Injection
CVE-2008-1957—webappsphp
SQL injection vulnerability in news.php in Tr Script News 2.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Half-Life CSTRIKE Server 1.6 - 'no-steam' Denial of Service
CVE-2008-7203—dosmultiple
Valve Software Half-Life Counter-Strike 1.6 allows remote attackers to cause a denial of service (crash) via multiple cr
23RISK
open ↗
Referência✓ VexDay Proof
WebChat 0.77 - 'defines.php?WEBCHATPATH' Remote File Inclusion
CVE-2007-0485—webappsphp
PHP remote file inclusion vulnerability in defines.php in WebChat 0.77 allows remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência✓ VexDay Proof
Sami HTTP Server 2.0.1 - HTTP 404 Object not found Denial of Service
CVE-2007-0548—doswindows
KarjaSoft Sami HTTP Server 2.0.1 allows remote attackers to cause a denial of service (daemon hang) via a large number o
23RISK
open ↗
Referência✓ VexDay Proof
Acidcat CMS 3.4.1 - Multiple Vulnerabilities
CVE-2008-1991—webappsphp
Cross-site scripting (XSS) vulnerability in admin_colors_swatch.asp in Acidcat CMS 3.4.1 allows remote attackers to inje
23RISK
open ↗
Referência✓ VexDay Proof
PHPUserBase 1.3b - 'unverified.inc.php' Local File Inclusion
CVE-2008-7240—webappsphp
Directory traversal vulnerability in include/unverified.inc.php in Linux Web Shop (LWS) php User Base 1.3beta allows rem
23RISK
open ↗
Referência✓ VexDay Proof
RPW 1.0.2 - 'config.php?sql_language' Remote File Inclusion
CVE-2007-0559—webappsphp
PHP remote file inclusion vulnerability in config.php in RPW 1.0.2 allows remote attackers to execute arbitrary PHP code
23RISK
open ↗
Referência✓ VexDay Proof
MiniBB 2.2 - Cross-Site Scripting / SQL Injection / Full Path Disclosure
CVE-2008-2024—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in miniBB 2.2, and possibly earlier, when register_globals is enab
23RISK
open ↗
Referência✓ VexDay Proof
ASPThai.Net Forum 8.5 - Remote Database Disclosure
CVE-2008-6872—webappsasp
ASPThai.NET ASPThai Forums 8.5 stores sensitive information under the web root with insufficient access control, which a
23RISK
open ↗
← previouspage 740 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.