Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
BusinessSpace 1.2 - 'id' SQL Injection
CVE-2009-0516—webappsphp
SQL injection vulnerability in the classified page (classified.php) in BusinessSpace 1.2 and earlier allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
Eurologon CMS - Multiple SQL Injections
CVE-2007-6164—webappsphp
Multiple SQL injection vulnerabilities in Eurologon CMS allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência✓ VexDay Proof
phpsmartcom 0.2 - Local File Inclusion / SQL Injection
CVE-2008-4351—webappsphp
Directory traversal vulnerability in index.php in phpSmartCom 0.2 allows remote attackers to include and execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
SafeNet 10.4.0.12 - 'IPSecDrv.sys' Local kernel Ring0 SYSTEM
CVE-2008-0573—localwindows
IPSecDrv.sys 10.4.0.12 in SafeNET HighAssurance Remote and SoftRemote allows local users to gain privileges via a crafte
23RISK
open ↗
Referência✓ VexDay Proof
bilboblog 2.1 - Multiple Vulnerabilities
CVE-2008-3303—webappsphp
admin/login.php in BilboBlog 0.2.1, when register_globals is enabled, allows remote attackers to bypass authentication a
23RISK
open ↗
Referência✓ VexDay Proof
The Everything Development System Pre-1.0 - SQL Injection
CVE-2008-0675—webappsphp
SQL injection vulnerability in cms/index.pl in The Everything Development Engine in The Everything Development System Pr
23RISK
open ↗
Referência✓ VexDay Proof
BlogPHP 2 - 'id' Cross-Site Scripting / SQL Injection
CVE-2008-0679—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in BlogPHP 2.0 allows remote attackers to inject arbitrary web scr
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component Ricette 1.0 - SQL Injection
CVE-2008-0841—webappsphp
SQL injection vulnerability in index.php in the Giorgio Nordo Ricette (com_ricette) 1.0 component for Joomla! and Mambo
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke Modules Okul 1.0 - 'okulid' SQL Injection
CVE-2008-0881—webappsphp
SQL injection vulnerability in modules.php in the Okul 1.0 module for PHP-Nuke allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
PHPAuctionSystem - Cross-Site Scripting / SQL Injection
CVE-2009-0106—webappsphp
SQL injection vulnerability in profile.php in PHPAuctions (aka PHPAuctionSystem) allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
EasyNews 40tr - SQL Injection / Cross-Site Scripting / Local File Inclusion
CVE-2008-1650—webappsphp
SQL injection vulnerability in dynamicpages/index.php in EasyNews 4.0 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke Platinum 7.6.b.5 - 'dynamic_titles.php' SQL Injection
CVE-2008-1680—webappsphp
PHP-Nuke Platinum 7.6.b.5 allows remote attackers to obtain configuration information via a direct request to maintenanc
23RISK
open ↗
Referência✓ VexDay Proof
Vlbook 1.21 - Cross-Site Scripting / Local File Inclusion
CVE-2008-2072—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Virtual Design Studio vlbook 1.21 allows remote attackers to in
23RISK
open ↗
Referência✓ VexDay Proof
DigiLeave 1.2 - 'book_id' Blind SQL Injection
CVE-2008-3309—webappsasp
SQL injection vulnerability in info_book.asp in DigiLeave 1.2 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
ZEELYRICS 2.0 - 'bannerclick.php' SQL Injection
CVE-2008-4717—webappsphp
SQL injection vulnerability in bannerclick.php in ZEELYRICS 2.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
Vlbook 1.21 - Cross-Site Scripting / Local File Inclusion
CVE-2008-2073—webappsphp
Directory traversal vulnerability in include/global.inc.php in Virtual Design Studio vlbook 1.21 allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Quicksilver Forums 1.2.1 - Remote File Inclusion
CVE-2006-4824—webappsphp
PHP remote file inclusion vulnerability in lib/activeutil.php in Quicksilver Forums (QSF) 1.2.1 and earlier allows remot
23RISK
open ↗
Referência✓ VexDay Proof
Project Based Calendaring System (PBCS) 0.7.1 - Multiple Vulnerabilities
CVE-2008-2216—webappsphp
Unrestricted file upload vulnerability in src/yopy_upload.php in Project-Based Calendaring System (PBCS) 0.7.1 allows re
23RISK
open ↗
Referência✓ VexDay Proof
Content Management System for Phprojekt 0.6.1 - File Disclosure
CVE-2008-2217—webappsphp
Directory traversal vulnerability in cm/graphie.php in Content Management System 0.6.1 for Phprojekt allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
WebStudio eCatalogue - Blind SQL Injection
CVE-2008-5294—webappsphp
SQL injection vulnerability in index.php in WebStudio eCatalogue allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
PG Real Estate - Authentication Bypass
CVE-2008-5306—webappsphp
SQL injection vulnerability in admin/index.php in PG Real Estate Solution allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin PictPress 0.91 - Remote File Disclosure
CVE-2007-6369—webappsphp
Multiple directory traversal vulnerabilities in resize.php in the PictPress 0.91 and earlier plugin for WordPress allow
23RISK
open ↗
Referência✓ VexDay Proof
newsmanager 2.0 - Remote File Inclusion / File Disclosure / SQL Injection
CVE-2008-2340—webappsphp
Multiple SQL injection vulnerabilities in News Manager 2.0 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
newsmanager 2.0 - Remote File Inclusion / File Disclosure / SQL Injection
CVE-2008-2342—webappsphp
Directory traversal vulnerability in attachments.php in News Manager 2.0 allows remote attackers to read arbitrary files
23RISK
open ↗
Referência✓ VexDay Proof
Web Group Communication Center (WGCC) 1.0.3 - SQL Injection
CVE-2008-2445—webappsphp
Cross-site scripting (XSS) vulnerability in profile.php in Web Group Communication Center (WGCC) 1.0.3 PreRelease 1 and
23RISK
open ↗
Referência✓ VexDay Proof
e-107 Plugin ZoGo-Shop 1.16 Beta 13 - SQL Injection
CVE-2008-2447—webappsphp
SQL injection vulnerability in products.php in the Mytipper ZoGo-shop plugin 1.15.5 and 1.16 Beta 13 for e107 allows rem
23RISK
open ↗
Referência✓ VexDay Proof
Content Injector 1.53 - 'index.php' SQL Injection
CVE-2007-6394—webappsphp
SQL injection vulnerability in index.php in Content Injector 1.53 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component SimpleShop 3.4 - SQL Injection
CVE-2008-2568—webappsphp
SQL injection vulnerability in the Simple Shop Galore (com_simpleshop) component 3.4 and earlier for Joomla! allows remo
23RISK
open ↗
Referência✓ VexDay Proof
JobSite Professional 2.0 - 'file.php' SQL Injection
CVE-2007-5785—webappsphp
SQL injection vulnerability in file.php in JobSite Professional 2.0 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
freeSSHd 1.2.1 - (Authenticated) Remote Stack Overflow (PoC)
CVE-2008-2573—doswindows
Stack-based buffer overflow in SFTP in freeSSHd 1.2.1 allows remote authenticated users to execute arbitrary code via a
23RISK
open ↗
← previouspage 747 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.