Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Simple HTTPd 1.38 - Multiple Vulnerabilities
CVE-2007-6405—remotewindows
Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI progra
23RISK
open ↗
Referência✓ VexDay Proof
verlihub 0.9.8d-RC2 - Remote Command Execution
CVE-2008-5706—remotelinux
The cTrigger::DoIt function in src/ctrigger.cpp in the trigger mechanism in the daemon in Verlihub 0.9.8d-RC2 and earlie
23RISK
open ↗
Referência✓ VexDay Proof
Mapbender 2.4.4 - 'gaz' SQL Injection
CVE-2008-0301—webappsphp
Multiple SQL injection vulnerabilities in Mapbender 2.4.4 allow remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Referência✓ VexDay Proof
eLineStudio Site Composer (ESC) 2.6 - Multiple Vulnerabilities
CVE-2008-2862—webappsphp
Multiple SQL injection vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
TxtBlog 1.0 Alpha - Local File Inclusion
CVE-2008-5639—webappsphp
Directory traversal vulnerability in index.php in TxtBlog 1.0 Alpha allows remote attackers to read arbitrary files via
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Fusion Mod Kroax 4.42 - 'category' SQL Injection
CVE-2008-5196—webappsphp
SQL injection vulnerability in kroax.php in the Kroax (the_kroax) 4.42 and earlier module for PHP-Fusion allows remote a
23RISK
open ↗
Referência✓ VexDay Proof
CMS Mini 0.2.2 - Multiple Local File Inclusions
CVE-2008-2961—webappsphp
Multiple directory traversal vulnerabilities in view/index.php in CMS Mini 0.2.2 allow remote attackers to read arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
PHP TV Portal 2.0 - 'mid' SQL Injection
CVE-2008-6285—webappsphp
SQL injection vulnerability in index.php in PHP TV Portal 2.0 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
ASPTicker 1.0 - Remote Database Disclosure
CVE-2008-5603—webappsasp
ASPTicker 1.0 stores sensitive information under the web root with insufficient access control, which allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
User Engine Lite ASP - 'users.mdb' Database Disclosure
CVE-2008-5601—webappsphp
User Engine Lite ASP stores sensitive information under the web root with insufficient access control, which allows remo
23RISK
open ↗
Referência✓ VexDay Proof
ScriptMagix Recipes 2.0 - 'index.php?catid' SQL Injection
CVE-2007-1617—webappsphp
SQL injection vulnerability in index.php in ScriptMagix Recipes 2.0 and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
AJ Auction Web 2.0 - 'cate_id' SQL Injection
CVE-2008-2860—webappsphp
SQL injection vulnerability in category.php in AJSquare AJ Auction Pro web 2.0 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Apple iTunes 8.1.1 - 'ITMS' Multiple Protocol Handler Buffer Overflow (Metasploit)
CVE-2009-0950—remoteosx
Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a deni
43RISK
open ↗
Referência✓ VexDay Proof
Recipes Complete Website 1.1.14 - SQL Injection
CVE-2006-6220—webappsphp
Multiple SQL injection vulnerabilities in Recipes Website (Recipes Complete Website) 1.1.14 allow remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
Pakupaku CMS 0.4 - Arbitrary File Upload / Local File Inclusion
CVE-2007-4641—webappsphp
Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and ex
23RISK
open ↗
Referência✓ VexDay Proof
MyMarket 1.72 - Blind SQL Injection
CVE-2008-2815—webappsphp
SQL injection vulnerability in shopping/index.php in MyMarket 1.72 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component VirtueMart Google Base 1.1 - Remote File Inclusion
CVE-2008-6483—webappsphp
PHP remote file inclusion vulnerability in admin.googlebase.php in the Ecom Solutions VirtueMart Google Base (aka com_go
35RISK
open ↗
Referência✓ VexDay Proof
Gforge 4.6 rc1 - 'skill_edit' SQL Injection
CVE-2008-6188—webappsphp
SQL injection vulnerability in people/editprofile.php in Gforge 4.6 rc1 and earlier allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
phpPgAdmin 4.2.1 - '_language' Local File Inclusion
CVE-2008-5587—webappsphp
Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is ena
43RISK
open ↗
Referência✓ VexDay Proof
falcon CMS 1.4.3 - Remote File Inclusion / Cross-Site Scripting
CVE-2007-6488—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
Basic-CMS - SQL Injection
CVE-2008-2789—webappsphp
SQL injection vulnerability in pages/index.php in BASIC-CMS allows remote attackers to execute arbitrary SQL commands vi
43RISK
open ↗
Referência✓ VexDay Proof
Comparison Engine Power 1.0 - Blind SQL Injection
CVE-2008-2791—webappsphp
SQL injection vulnerability in product.detail.php in Kalptaru Infotech Comparison Engine Power Script 1.0 allows remote
23RISK
open ↗
Referência✓ VexDay Proof
X7 Chat 2.0.1A1 - 'mini.php' Local File Inclusion
CVE-2008-4718—webappsphp
Directory traversal vulnerability in help/mini.php in X7 Chat 2.0.1 A1 and earlier allows remote attackers to include an
23RISK
open ↗
Referência✓ VexDay Proof
lcxbbportal 0.1 alpha 2 - Remote File Inclusion
CVE-2008-5585—webappsphp
Multiple PHP remote file inclusion vulnerabilities in lcxBBportal 0.1 Alpha 2 allow remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
RevokeBB 1.0 RC11 - 'Search' SQL Injection
CVE-2008-2778—webappsphp
SQL injection vulnerability in inc/class_search.php in the Search System in RevokeBB 1.0 RC11 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
LoCal Calendar 1.1 - 'lcUser.php' Remote File Inclusion
CVE-2006-5426—webappsphp
PHP remote file inclusion vulnerability in lib/lcUser.php in LoCal Calendar System 1.1 remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
PHP Net Tools 2.7.1 - Remote Code Execution
CVE-2006-1921—webappsphp
nettools.php in PHP Net Tools 2.7.1 allows remote attackers to execute arbitrary commands via shell metacharacters in th
23RISK
open ↗
Referência✓ VexDay Proof
ravennuke 2.3.0 - Multiple Vulnerabilities
CVE-2009-0673—webappsphp
Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.3
23RISK
open ↗
Referência✓ VexDay Proof
Drake CMS 0.4.11 - Blind SQL Injection
CVE-2008-6475—webappsphp
SQL injection vulnerability in the guestbook component (components/guestbook/guestbook.php) in Drake CMS 0.4.11 and earl
23RISK
open ↗
Referência✓ VexDay Proof
Todd Woolums ASP News Management 2.2 - SQL Injection
CVE-2008-5273—webappsasp
SQL injection vulnerability in viewnews.asp in Todd Woolums ASP News Management 2.2 allows remote attackers to execute a
23RISK
open ↗
← previouspage 749 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.