Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Flatnuke 3 - Remote Command Execution / Privilege Escalation
CVE-2007-5774—webappsphp
index.php in the File Manager module in Flatnuke 3 allows remote attackers to obtain sensitive information via an invali
23RISK
open ↗
Referência✓ VexDay Proof
MyBlog: PHP and MySQL Blog/CMS software - SQL Injection / Cross-Site Scripting
CVE-2008-2963—webappsphp
Multiple SQL injection vulnerabilities in MyBlog allow remote attackers to execute arbitrary SQL commands via the (1) vi
23RISK
open ↗
Referência✓ VexDay Proof
jaxultrabb 2.0 - Local File Inclusion / Cross-Site Scripting
CVE-2008-2965—webappsphp
Cross-site scripting (XSS) vulnerability in viewforum.php in JaxUltraBB (JUBB) 2.0 and earlier allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
jaxultrabb 2.0 - Local File Inclusion / Cross-Site Scripting
CVE-2008-2966—webappsphp
Directory traversal vulnerability in viewprofile.php in JaxUltraBB 2.0 and earlier allows remote attackers to read arbit
23RISK
open ↗
Referência✓ VexDay Proof
PHP KnowledgeBase Script 2.4 - 'cat_id' SQL Injection
CVE-2008-2972—webappsphp
SQL injection vulnerability in index.php in KbLance allows remote attackers to execute arbitrary SQL commands via the ca
23RISK
open ↗
Referência✓ VexDay Proof
mm chat 1.5 - Local File Inclusion / Cross-Site Scripting
CVE-2008-2974—webappsphp
Directory traversal vulnerability in chatconfig.php in MM Chat 1.5, when register_globals is enabled, allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
ourvideo CMS 9.5 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2008-2978—webappsphp
Directory traversal vulnerability in phpi/rss.php in Ourvideo CMS 9.5, when register_globals is enabled, allows remote a
23RISK
open ↗
Referência✓ VexDay Proof
phpDMCA 1.0.0 - Multiple Remote File Inclusions
CVE-2008-2986—webappsphp
Multiple PHP remote file inclusion vulnerabilities in phpDMCA 1.0.0 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke Module AddressBook 1.2 - Local File Inclusion
CVE-2007-1720—webappsphp
Directory traversal vulnerability in addressbook.php in the Addressbook 1.2 module for PHP-Nuke allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
CMME 1.12 - Local File Inclusion / Cross-Site Scripting / Cross-Site Request Forgery/Download Backup/Make Directory
CVE-2008-3926—webappsphp
Multiple directory traversal vulnerabilities in Content Management Made Easy (CMME) 1.12 allow remote attackers to (1) r
23RISK
open ↗
Referência✓ VexDay Proof
EsFaq 2.0 - 'idcat' SQL Injection
CVE-2008-3952—webappsphp
SQL injection vulnerability in questions.php in EsFaq 2.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
Friendly Technologies - 'fwRemoteCfg.dll' ActiveX Remote Buffer Overflow
CVE-2008-4048—remotewindows
Heap-based buffer overflow in a certain ActiveX control in fwRemoteCfg.dll 3.3.3.1 in Friendly Technologies FriendlyPPPo
23RISK
open ↗
Referência✓ VexDay Proof
Adobe Acrobat 9 - ActiveX Remote Denial of Service
CVE-2008-4071—doswindows
A certain ActiveX control in Adobe Acrobat 9, when used with Microsoft Windows Vista and Internet Explorer 7, allows rem
28RISK
open ↗
Referência✓ VexDay Proof
D-iscussion Board 3.01 - 'topic' Local File Inclusion
CVE-2008-4075—webappsphp
Directory traversal vulnerability in index.php in D-iscussion Board 3.01 allows remote attackers to read arbitrary files
23RISK
open ↗
Referência✓ VexDay Proof
Yourownbux 3.1/3.2 Beta - SQL Injection
CVE-2008-4093—webappsphp
SQL injection vulnerability in memberstats.php in YourOwnBux 3.1 and 3.2 beta, when magic_quotes_gpc is disabled, allows
23RISK
open ↗
Referência✓ VexDay Proof
Talkback 2.3.6 - Multiple Local File Inclusion / PHPInfo Disclosure Vulnerabilities
CVE-2008-4115—webappsphp
TalkBack 2.3.6 allows remote attackers to obtain configuration information via a direct request to install/info.php, whi
23RISK
open ↗
Referência✓ VexDay Proof
phpRealty 0.3 - 'INC' Remote File Inclusion
CVE-2008-4134—webappsphp
PHP remote file inclusion vulnerability in manager/static/view.php in phpRealty 0.03 and earlier, and possibly other ver
23RISK
open ↗
Referência✓ VexDay Proof
Nokia e90/n82 (s60v3) - Remote Denial of Service
CVE-2008-4135—doshardware
Symbian OS S60 3rd edition on the Nokia E90 Communicator 07.40.1.2 Ra-6 and Nseries N82 allows remote attackers to cause
23RISK
open ↗
Referência✓ VexDay Proof
The Personal FTP Server 6.0f - RETR Denial of Service
CVE-2008-4136—doswindows
Michael Roth Software Personal FTP Server (PFT) 6.0f allows remote attackers to cause a denial of service (service crash
23RISK
open ↗
Referência✓ VexDay Proof
addalink 4 Beta - Write Approved Links
CVE-2008-4146—webappsphp
Addalink 1.0 beta 4 and earlier allows remote attackers to (1) approve web-site additions via a modified approved field
23RISK
open ↗
Referência✓ VexDay Proof
easysite 2.3 - Multiple Vulnerabilities
CVE-2008-4155—webappsphp
Multiple directory traversal vulnerabilities in EasySite 2.3 allow remote attackers to read arbitrary files or list dire
23RISK
open ↗
Referência✓ VexDay Proof
cPanel 11.x - 'Fantastico' Local File Inclusion
CVE-2008-4181—webappsphp
Directory traversal vulnerability in includes/xml.php in the Netenberg Fantastico De Luxe module before 2.10.4 r19 for c
23RISK
open ↗
Referência✓ VexDay Proof
Bandwebsite 1.5 - SQL Injection / Cross-Site Scripting
CVE-2008-5337—webappsphp
SQL injection vulnerability in lyrics.php in Bandwebsite (aka Bandsite portal system) 1.5 allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
1024 CMS 1.4.2 - Local File Inclusion / Blind SQL Injection
CVE-2008-1911—webappsphp
SQL injection vulnerability in includes/system.php in 1024 CMS 1.4.2 beta and earlier, when magic_quotes_gpc is disabled
23RISK
open ↗
Referência✓ VexDay Proof
RunCMS 1.6 - Get Admin Cookie Blind SQL Injection
CVE-2007-6544—webappsphp
Multiple SQL injection vulnerabilities in RunCMS before 1.6.1 allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Limbo CMS 1.0.4.2 - 'sql.php' Remote File Inclusion
CVE-2006-2142—webappsphp
PHP remote file inclusion vulnerability in classes/adodbt/sql.php in Limbo CMS 1.04 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
eSyndiCat Link Exchange Script 2005-2006 - SQL Injection
CVE-2007-6543—webappsphp
SQL injection vulnerability in suggest-link.php in eSyndiCat Link Exchange Script allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Web-MeetMe 3.0.3 - 'play.php' Remote File Disclosure
CVE-2007-6215—webappsphp
Multiple directory traversal vulnerabilities in play.php in Web-MeetMe 3.0.3 allow remote attackers to read arbitrary fi
23RISK
open ↗
Referência✓ VexDay Proof
mini-pub 0.3 - Local Directory Traversal / File Disclosure
CVE-2008-5936—webappsphp
front-end/edit.php in mini-pub 0.3 and earlier allows remote attackers to read files and obtain PHP source code via a fi
23RISK
open ↗
Referência✓ VexDay Proof
LearnLoop 2.0beta7 - 'sFilePath' Remote File Disclosure
CVE-2007-6214—webappsphp
Directory traversal vulnerability in include/file_download.php in LearnLoop 2.0 beta7 allows remote attackers to read ar
23RISK
open ↗
← previouspage 748 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.