Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Shop-Script FREE 2.0 - Remote Command Execution
CVE-2007-4932—webappsphp
admin.php in Shop-Script FREE 2.0 and earlier sends a redirect to the web browser but does not exit when administrative
23RISK
open ↗
Referência✓ VexDay Proof
Acunetix WVS 4.0 20060717 - HTTP Sniffer Component Remote Denial of Service
CVE-2007-0120—doswindows
Acunetix Web Vulnerability Scanner (WVS) 4.0 Build 20060717 and earlier allows remote attackers to cause a denial of ser
23RISK
open ↗
Referência✓ VexDay Proof
kubix 0.7 - Multiple Vulnerabilities
CVE-2006-7117—webappsphp
Multiple directory traversal vulnerabilities in Kubix 0.7 and earlier allow remote attackers to (1) include and execute
23RISK
open ↗
Referência✓ VexDay Proof
Jupiter CMS 1.1.5 - 'Client-IP' SQL Injection
CVE-2007-0971—webappsphp
Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
Sphider 1.3 - 'configset.php' Remote File Inclusion
CVE-2006-1784—webappsphp
PHP remote file inclusion vulnerability in admin/configset.php in Sphider 1.3 and earlier, when register_globals is disa
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Fusion Module topliste 1.0 - 'cid' SQL Injection
CVE-2007-1980—webappsphp
SQL injection vulnerability in index.php in the Topliste 1.0 module for PHP-Fusion allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
Monster Top List 1.4.2 - 'functions.php?root_path' Remote File Inclusion
CVE-2006-1781—webappsphp
PHP remote file inclusion vulnerability in functions.php in Circle R Monster Top List (MTL) 1.4 allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Small Axe 0.3.1 - 'cfile' Remote File Inclusion
CVE-2008-0376—webappsphp
PHP remote file inclusion vulnerability in inc/linkbar.php in Small Axe Weblog 0.3.1 allows remote attackers to execute
35RISK
open ↗
Referência✓ VexDay Proof
CodeAvalanche FreeForum - Database Disclosure
CVE-2008-5932—webappsasp
CodeAvalanche FreeForum stores sensitive information under the web root with insufficient access control, which allows r
23RISK
open ↗
Referência✓ VexDay Proof
FlashGameScript 1.7 - 'user' SQL Injection
CVE-2007-3646—webappsphp
SQL injection vulnerability in index.php in FlashGameScript 1.7 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Simplog 0.9.2 - 's' Remote Command Execution
CVE-2006-1778—webappsphp
Multiple SQL injection vulnerabilities in Jeremy Ashcraft Simplog 0.9.2 and earlier allow remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
ACG News 1.0 - 'aid'/'catid' SQL Injection
CVE-2007-4603—webappsphp
Multiple SQL injection vulnerabilities in index.php in ACG News 1.0 allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit)
CVE-2019-15107CRITICALunder attackransomwareremotelinux
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RISK
open ↗
Referência✓ VexDay Proof
DataLife Engine 4.1 - SQL Injection
CVE-2006-3221—webappsphp
SQL injection vulnerability in index.php in DataLife Engine 4.1 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
CPCommerce 1.2.8 - 'id_document' Blind SQL Injection
CVE-2009-1345—webappsphp
SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
Md-Pro 1.0.8x - Topics topicid SQL Injection
CVE-2007-3938—webappsphp
SQL injection vulnerability in index.php in MAXdev MDPro (MD-Pro) 1.0.8x and earlier before 20070720 allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
PHP::HTML 0.6.4 - 'PHPhtml.php' Remote File Inclusion
CVE-2007-3230—webappsphp
PHP remote file inclusion vulnerability in phphtml.php in Idan Sofer PHP::HTML 0.6.4 allows remote attackers to execute
35RISK
open ↗
Referência✓ VexDay Proof
MailMachine Pro 2.2.4 - SQL Injection
CVE-2007-6551—webappsphp
SQL injection vulnerability in showMsg.php in MailMachine Pro 2.2.4, and other versions before 2.2.6, allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
MyioSoft EasyBookMarker 4.0 - Authentication Bypass
CVE-2008-5652—webappsphp
SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyBookMarker 4.0 allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Stats 0.1.9.1b - 'ip' SQL Injection
CVE-2006-7172—webappsphp
Multiple SQL injection vulnerabilities in php-stats.recphp.php in PHP-Stats 0.1.9.1b and earlier allow remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Web-News 1.6.3 - 'template.php' Remote File Inclusion
CVE-2006-5053—webappsphp
PHP remote file inclusion vulnerability in webnews/template.php in Web-News 1.6.3 and earlier allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Frogss CMS 0.7 - SQL Injection
CVE-2007-2299—webappsphp
Multiple SQL injection vulnerabilities in Frogss CMS 0.7 and earlier allow remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
team 1.x - File Disclosure / Cross-Site Scripting
CVE-2009-0761—webappsasp
Cross-site scripting (XSS) vulnerability in online.asp in Team Board 1.x allows remote attackers to inject arbitrary web
23RISK
open ↗
Referência✓ VexDay Proof
KwsPHP 1.0 Member_Space Module - SQL Injection
CVE-2007-4956—webappsphp
Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via (1) th
23RISK
open ↗
Referência✓ VexDay Proof
MonGoose 2.4 (Windows) - WebServer Directory Traversal
CVE-2009-1354—remotewindows
Directory traversal vulnerability in Mongoose 2.4 allows remote attackers to read arbitrary files via a .. (dot dot) in
23RISK
open ↗
Referência✓ VexDay Proof
eXV2 Module bamaGalerie 3.03 - SQL Injection
CVE-2008-1349—webappsphp
SQL injection vulnerability in viewcat.php in the bamaGalerie (Bama Galerie) 3.03 and 3.041 module for eXV2 2.0.6 allows
23RISK
open ↗
Referência✓ VexDay Proof
aspwebalbum 3.2 - Multiple Vulnerabilities
CVE-2008-6978—webappsasp
Unrestricted file upload vulnerability in Full Revolution aspWebAlbum 3.2 allows remote attackers to execute arbitrary c
23RISK
open ↗
Referência✓ VexDay Proof
the net guys aspired2blog - SQL Injection / File Disclosure
CVE-2008-5931—webappsasp
The Net Guys ASPired2Blog stores sensitive information under the web root with insufficient access control, which allows
23RISK
open ↗
Referência✓ VexDay Proof
VP-ASP Shopping Cart 6.50 - Database Disclosure
CVE-2008-5929—webappsasp
VP-ASP Shopping Cart 6.50 stores sensitive information under the web root with insufficient access control, which allows
23RISK
open ↗
Referência✓ VexDay Proof
FlexPHPDirectory 0.0.1 - Authentication Bypass
CVE-2008-6749—webappsphp
Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPDirectory 0.0.1, when magic_quotes_gpc is disabl
23RISK
open ↗
← previouspage 757 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.