Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
EgyPlus 7ml 1.0.1 - Authentication Bypass
CVE-2009-2168CRITICALwebappsphp
cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit whe
53RISK
open ↗
Referência✓ VexDay Proof
Discuz! 5.0.0 GBK - SQL Injection / Admin Credentials Disclosure
CVE-2006-5561—webappsphp
SQL injection vulnerability in admincp.php in Discuz! GBK 5.0.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
CA Internet Security Suite 2008 - 'SaveToFile()' File Corruption (PoC)
CVE-2008-2511—doswindows
Directory traversal vulnerability in the UmxEventCli.CachedAuditDataList.1 (aka UmxEventCliLib) ActiveX control in UmxEv
28RISK
open ↗
Referência✓ VexDay Proof
DigiRez 3.4 - 'book_id' SQL Injection
CVE-2007-0128—webappsasp
SQL injection vulnerability in info_book.asp in Digirez 3.4 and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Wordsmith 1.1b - 'config.inc.php?_path' Remote File Inclusion
CVE-2007-5102—webappsphp
PHP remote file inclusion vulnerability in config.inc.php in Wordsmith 1.0 RC1, when register_globals is enabled, allows
35RISK
open ↗
Referência✓ VexDay Proof
Dew-NewPHPLinks 2.0 - Local File Inclusion / Cross-Site Scripting
CVE-2009-1624—webappsphp
Directory traversal vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to read arbitrary files vi
23RISK
open ↗
Referência✓ VexDay Proof
ASPPortal Free Version - 'Topic_Id' SQL Injection
CVE-2008-5268—webappsasp
SQL injection vulnerability in content/forums/reply.asp in ASPPortal allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Basic PHP Events Lister 1.0 - SQL Injection
CVE-2008-6464—webappsphp
SQL injection vulnerability in event.php in Mevin Productions Basic PHP Events Lister 1.0 allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
TNT Forum 0.9.4 - Local File Inclusion
CVE-2008-5265—webappsphp
Directory traversal vulnerability in index.php in TNT Forum 0.9.4, when magic_quotes_gpc is disabled, allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component yvComment 1.16 - Blind SQL Injection
CVE-2008-2692—webappsphp
SQL injection vulnerability in the yvComment (com_yvcomment) component 1.16.0 and earlier for Joomla! allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
CaLogic Calendars 1.2.2 - 'langsel' SQL Injection
CVE-2008-2444—webappsphp
SQL injection vulnerability in userreg.php in CaLogic Calendars 1.2.2 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
BackLinkSpider 1.1 - 'cat_id' SQL Injection
CVE-2008-2096—webappsphp
SQL injection vulnerability in BackLinkSpider allows remote attackers to execute arbitrary SQL commands via the cat_id p
23RISK
open ↗
Referência✓ VexDay Proof
VideoLAN VLC Media Player 0.9.8a - Web UI 'input' Remote Denial of Service
CVE-2009-1045—doswindows
requests/status.xml in VLC 0.9.8a allows remote attackers to cause a denial of service (stack consumption and crash) via
23RISK
open ↗
Referência✓ VexDay Proof
MySpace Resource Script (MSRS) 1.21 - Remote File Inclusion
CVE-2007-5721—webappsphp
PHP remote file inclusion vulnerability in _theme/breadcrumb.php in MySpacePros MySpace Resource Script (MSRS) 1.21 allo
23RISK
open ↗
Referência✓ VexDay Proof
mebiblio 0.4.7 - SQL Injection / Arbitrary File Upload / Cross-Site Scripting
CVE-2008-2646—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in meBiblio 0.4.7 allow remote attackers to inject arbitrary web scr
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Visual Basic 6.0 - VBP_Open OLE Local CodeExec
CVE-2007-4776—localwindows
Buffer overflow in Microsoft Visual Basic 6.0 and Enterprise Edition 6.0 SP6 allows user-assisted remote attackers to ex
50RISK
open ↗
Referência✓ VexDay Proof
PHP Dir Submit - Authentication Bypass
CVE-2009-1787—webappsphp
Multiple SQL injection vulnerabilities in PHP Dir Submit (aka WebsiteSubmitter and Submitter Script) allow remote attack
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin BackUpWordPress 0.4.2b - Remote File Inclusion
CVE-2007-5800—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the BackUpWordPress 0.4.2b and earlier plugin for WordPress allow
35RISK
open ↗
Referência✓ VexDay Proof
SFS EZ HotScripts-like Site - 'cid' SQL Injection
CVE-2008-6243—webappsphp
SQL injection vulnerability in showcategory.php in Scripts For Sites (SFS) Hotscripts-like Site allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component JooBlog 0.1.1 - Blind SQL Injection
CVE-2008-2630—webappsphp
SQL injection vulnerability in the JooBlog (com_jb2) component 0.1.1 for Joomla! allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component MyContent 1.1.13 - Blind SQL Injection
CVE-2008-6430—webappsphp
SQL injection vulnerability in the MyContent (com_mycontent) component 1.1.13 for Joomla! allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
FAQEngine 4.16.03 - 'question.php?questionref' SQL Injection
CVE-2007-2749—webappsphp
SQL injection vulnerability in question.php in FAQEngine 4.16.03 and earlier allows remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
WEBBDOMAIN Webshop 1.02 - Authentication Bypass
CVE-2008-6627—webappsphp
SQL injection vulnerability in getin.php in WEBBDOMAIN WebShop 1.2, 1.1, 1.02, and earlier allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
e107 < 0.7.15 - 'extended_user_fields' Blind SQL Injection
CVE-2009-1409—webappsphp
SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and m
23RISK
open ↗
Referência✓ VexDay Proof
ASPThai.Net WebBoard 6.0 - SQL Injection
CVE-2009-0703—webappsphp
SQL injection vulnerability in bview.asp in ASPThai.Net Webboard 6.0 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Weblosninger 4 - Cross-Site Scripting / SQL Injection
CVE-2008-2505—webappsphp
Cross-site scripting (XSS) vulnerability in result.php in Simpel Side Weblosning 1 through 4 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
NVR SP2 2.0 'nvUtility.dll 1.0.14.0' - 'SaveXMLFile()' Insecure Method
CVE-2007-4583—remotewindows
Multiple absolute path traversal vulnerabilities in the nvUtility.Utility.1 ActiveX control in nvUtility.dll 1.0.14.0 in
23RISK
open ↗
Referência✓ VexDay Proof
IBM Domino Web Access 7.0 Upload Module - 'inotes6.dll' Remote Buffer Overflow
CVE-2007-4474—remotewindows
Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, in
50RISK
open ↗
Referência✓ VexDay Proof
Netartmedia Blog System - SQL Injection
CVE-2008-5311—webappsphp
SQL injection vulnerability in image.php in NetArt Media Blog System 1.5 allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Career - SQL Injection
CVE-2008-6867—webappsphp
SQL injection vulnerability in content.php in Scripts For Sites (SFS) EZ Career allows remote attackers to execute arbit
23RISK
open ↗
← previouspage 759 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.