Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits

40,961CVEs with public exploitation

24,696lab-tested

All Referência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

CMScout 2.06 - SQL Injection / Local File Inclusion

CVE-2008-6726—webappsphp

Multiple directory traversal vulnerabilities in CMScout 2.06, when register_globals is enabled, allow remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

MyNewsGroups 0.6b - 'myng_root' Remote Inclusion

CVE-2006-3966—webappsphp

PHP remote file inclusion vulnerability in /lib/tree/layersmenu.inc.php in the PHP Layers Menu 2.3.5 package for MyNewsG

23RISK

open ↗

Referência✓ VexDay Proof

Simple Discussion Board 0.1.0 - Remote File Inclusion

CVE-2006-4918—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Simple Discussion Board 0.1.0 allow remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

CascadianFAQ 4.1 - 'index.php' SQL Injection

CVE-2007-0631—webappsphp

SQL injection vulnerability in index.php in Eclectic Designs CascadianFAQ 4.1 and earlier allows remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component JoomlaPack 1.0.4a2 RE - 'CAltInstaller.php' Remote File Inclusion

CVE-2007-2144—webappsphp

PHP remote file inclusion vulnerability in includes/CAltInstaller.php in the JoomlaPack (com_jpack) 1.0.4a2 RE component

23RISK

open ↗

Referência✓ VexDay Proof

MyReview 1.9.4 - 'email' SQL Injection / Code Execution

CVE-2006-4957—webappsphp

SQL injection vulnerability in the GetMember function in functions.php in MyReview 1.9.4 allows remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

Advanced Webhost Billing System (AWBS) 2.4.0 - 'cart2.php' Remote File Inclusion

CVE-2007-2272—webappsphp

PHP remote file inclusion vulnerability in docs/front-end-demo/cart2.php in Advanced Webhost Billing System (AWBS) 2.4.0

23RISK

open ↗

Referência✓ VexDay Proof

Pie Cart Pro - 'Home_Path' Remote File Inclusion

CVE-2006-4970—webappsphp

PHP remote file inclusion vulnerability in enc/content.php in WAHM E-Commerce Pie Cart Pro allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

phpMyNewsletter 0.8 (beta5) - Multiple Vulnerabilities

CVE-2007-2372—webappsphp

admin/send_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit

23RISK

open ↗

Referência✓ VexDay Proof

The Merchant 2.2.0 - 'index.php?show' Remote File Inclusion

CVE-2007-2424—webappsphp

PHP remote file inclusion vulnerability in help/index.php in The Merchant (themerchant) 2.2 allows remote attackers to e

23RISK

open ↗

Referência✓ VexDay Proof

Fuzzylime CMS 3.01 - 'commrss.php' Remote Code Execution

CVE-2008-6833—webappsphp

Directory traversal vulnerability in commsrss.php in fuzzylime (cms) before 3.01b allows remote attackers to include and

23RISK

open ↗

Referência✓ VexDay Proof

WordPress Plugin myflash 1.00 - 'wppath' Remote File Inclusion

CVE-2007-2485—webappsphp

PHP remote file inclusion vulnerability in myflash-button.php in the myflash 1.00 and earlier plugin for WordPress allow

35RISK

open ↗

Referência✓ VexDay Proof

EFS Easy Chat Server 2.2 - Remote Denial of Service

CVE-2004-2466—doswindows

chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username

60RISK

open ↗

Referência✓ VexDay Proof

SpotLight CRM 1.0 - 'login.asp' SQL Injection

CVE-2006-6543—webappsasp

Multiple SQL injection vulnerabilities in login.asp in AppIntellect SpotLight CRM 1.0 allow remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

otscms 2.1.5 - SQL Injection / Cross-Site Scripting

CVE-2007-0847—webappsphp

SQL injection vulnerability in mod/PM/reply.php in Open Tibia Server CMS (OTSCMS) 2.1.5 and earlier allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

Morovia Barcode ActiveX Professional 3.3.1304 - Arbitrary File Overwrite

CVE-2007-2644—remotewindows

A certain ActiveX control in Morovia Barcode ActiveX Professional 3.3.1304 allows remote attackers to overwrite arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

Hewlett Packard 1.0.0.309 - 'hpqvwocx.dll' ActiveX Magview Overflow (PoC)

CVE-2007-2656—doswindows

Stack-based buffer overflow in the Hewlett-Packard (HP) Magview ActiveX control in hpqvwocx.dll 1.0.0.309 allows remote

23RISK

open ↗

Referência✓ VexDay Proof

MyPBS - 'seasonID' SQL Injection

CVE-2008-5851—webappsphp

SQL injection vulnerability in index.php in My PHP Baseball Stats (MyPBS) allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

Axigen 2.0.0b1 - Remote Denial of Service (2)

CVE-2007-0887—doslinux

axigen 1.2.6 through 2.0.0b1 does not properly parse login credentials, which allows remote attackers to cause a denial

28RISK

open ↗

Referência✓ VexDay Proof

Google Chrome 0.2.149.27 - 'SaveAs' Remote Buffer Overflow

CVE-2008-6994—remotewindows

Stack-based buffer overflow in the SaveAs feature (SaveFileAsWithFilter function) in win_util.cc in Google Chrome 0.2.14

28RISK

open ↗

Referência✓ VexDay Proof

A-Blog 2.0 - 'menu.php' Remote File Inclusion

CVE-2006-5092—webappsphp

PHP remote file inclusion vulnerability in navigation/menu.php in A-Blog 2 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

TutorialCMS 1.01 - Authentication Bypass

CVE-2007-2822—webappsphp

TutorialCMS 1.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication via the

23RISK

open ↗

Referência✓ VexDay Proof

LightRO CMS 1.0 - 'index.php?projectid' SQL Injection

CVE-2007-0904—webappsphp

SQL injection vulnerability in projects.php in LightRO CMS 1.0 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

zKup CMS 2.0 < 2.3 - Arbitrary File Upload

CVE-2008-7123—webappsphp

Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

CodeAvalanche Articles - Database Disclosure

CVE-2008-5900—webappsasp

CodeAvalanche Articles stores sensitive information under the web root with insufficient access control, which allows re

23RISK

open ↗

Referência✓ VexDay Proof

PPA Gallery 1.0 - 'functions.inc.php' Remote File Inclusion

CVE-2006-5165—webappsphp

PHP remote file inclusion vulnerability in inc/functions.inc.php in Skrypty PPA Gallery 1.0 and earlier allows remote at

23RISK

open ↗

Referência✓ VexDay Proof

Yahoo! Messenger Webcam 8.1 - ActiveX Remote Buffer Overflow

CVE-2007-3147—remotewindows

Buffer overflow in the Yahoo! Webcam Upload ActiveX control in ywcupl.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows

50RISK

open ↗

Referência✓ VexDay Proof

Joovili 3.0.6 - 'joovili.images.php' Remote File Disclosure

CVE-2007-6621—webappsphp

Directory traversal vulnerability in joovili.images.php in Joovili 3.0.0 through 3.0.6 allows remote attackers to read a

23RISK

open ↗

Referência✓ VexDay Proof

ASP-DEV Internal E-Mail System - Authentication Bypass

CVE-2008-5926—webappsasp

Multiple SQL injection vulnerabilities in login.asp in ASP-DEv Internal E-Mail System allow remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

E-Uploader Pro 1.0 - Image Upload / Code Execution

CVE-2006-6694—webappsphp

Directory traversal vulnerability in include/config.php in E-Uploader Pro 1.0 and earlier allows remote attackers to exe

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.