Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
YapBB 1.2 - 'forumID' Blind SQL Injection
CVE-2009-0768—webappsphp
SQL injection vulnerability in forumhop.php in YapBB 1.2 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
webSPELL 4.2.0e - 'page' Blind SQL Injection
CVE-2009-1912—webappsphp
Directory traversal vulnerability in src/func/language.php in webSPELL 4.2.0e and earlier allows remote attackers to inc
23RISK
open ↗
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6500—webappsasp
Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to delete
23RISK
open ↗
Referência✓ VexDay Proof
Dyncms Release 6 - 'x_admindir' Remote File Inclusion
CVE-2006-4589—webappsphp
PHP remote file inclusion vulnerability in 0_admin/modules/Wochenkarte/frontend/index.php in DynCMS 6 and earlier allows
23RISK
open ↗
Referência✓ VexDay Proof
PHPBasket - 'pro_id' SQL Injection
CVE-2008-3713—webappsphp
SQL injection vulnerability in product.php in PHPBasket allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
News Bin Pro 4.32 - Article Grabbing Remote Unicode Buffer Overflow
CVE-2007-1569—doswindows
Stack-based buffer overflow in NewsBin Pro 4.32 allows remote attackers to cause a denial of service or execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Imera ImeraIEPlugin - ActiveX Control Remote Code Execution
CVE-2009-0813—remotewindows
Insecure method vulnerability in the ImeraIEPlugin ActiveX control (ImeraIEPlugin.dll 1.0.2.54) in Imera TeamLinks Clien
23RISK
open ↗
Referência✓ VexDay Proof
NVR SP2 2.0 'nvUnifiedControl.dll 1.1.45.0' - 'SetText()' Command Execution
CVE-2007-4582—remotewindows
Buffer overflow in the nvUnifiedControl.AUnifiedControl.1 ActiveX control in nvUnifiedControl.dll 1.1.45.0 in ACTi Netwo
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component CopperminePhotoGalery - Remote File Inclusion
CVE-2006-4321—webappsphp
PHP remote file inclusion vulnerability in cpg.php in the Coppermine Photo Gallery component (com_cpg) 1.0 and earlier f
23RISK
open ↗
Referência✓ VexDay Proof
SFS Ez Forum - SQL Injection
CVE-2008-4754—webappsphp
SQL injection vulnerability in forum.php in Scripts for Sites (SFS) Ez Forum allows remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
PollHelper - Remote Configuration File Disclosure
CVE-2009-0827—webappsphp
PollHelper stores poll.inc under the web root with insufficient access control, which allows remote attackers to downloa
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Fusion Mod Members CV (job) 1.0 - SQL Injection
CVE-2009-0831—webappsphp
SQL injection vulnerability in members.php in the Members CV (job) module 1.0 for PHP-Fusion, when magic_quotes_gpc is d
23RISK
open ↗
Referência✓ VexDay Proof
Mercur IMAPD 5.00.14 (Windows x86) - Remote Denial of Service
CVE-2007-1578—doswindows_x86
Multiple integer signedness errors in the NTLM implementation in Atrium MERCUR IMAPD (mcrimap4.exe) 5.00.14, with SP4, a
28RISK
open ↗
Referência✓ VexDay Proof
PHP 5.2.0 (OSX) - 'header()' Space Trimming Buffer Underflow
CVE-2007-1584—localosx
Buffer underflow in the header function in PHP 5.2.0 allows context-dependent attackers to execute arbitrary code by pas
23RISK
open ↗
Referência✓ VexDay Proof
K&S Shopsysteme - Arbitrary File Upload
CVE-2008-6768—webappsphp
Unrestricted file upload vulnerability in admin/editor/images.php in K&S Shopsoftware allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Alstrasoft Live Support 1.21 - Admin Credential Retrieve
CVE-2007-2775—webappsphp
AlstraSoft Live Support 1.21 sends a redirect to the web browser but does not exit when administrative credentials are m
23RISK
open ↗
Referência✓ VexDay Proof
S-CMS 1.1 Stable - Insecure Cookie Handling / Mass Page Delete
CVE-2009-0864—webappsphp
S-Cms 1.1 Stable allows remote attackers to bypass authentication and obtain administrative access via an OK value for t
23RISK
open ↗
Referência✓ VexDay Proof
ID Automation Linear Barcode - ActiveX Denial of Service
CVE-2007-2658—doswindows
Unspecified vulnerability in the ID Automation Linear Barcode 1.6.0.5 ActiveX control in IDAutomationLinear6.dll allows
23RISK
open ↗
Referência✓ VexDay Proof
PHP DB Designer 1.02 - Remote File Inclusion
CVE-2007-1620—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PHP DB Designer 1.02 and earlier allow remote attackers to execute
28RISK
open ↗
Referência✓ VexDay Proof
NEPT Image Uploader 1.0 - Arbitrary File Upload
CVE-2008-6822—webappsphp
Unrestricted file upload vulnerability in uploadp.php in New Earth Programming Team (NEPT) imgupload (aka Image Uploader
23RISK
open ↗
Referência✓ VexDay Proof
PHP recommend 1.3 - Authentication Bypass / Remote File Inclusion / Code Injection
CVE-2009-1781—webappsphp
Static code injection vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to inj
23RISK
open ↗
Referência✓ VexDay Proof
Active Photo Gallery - 'catid' SQL Injection
CVE-2007-1629—webappsasp
SQL injection vulnerability in default.asp in ActiveWebSoftwares Active Photo Gallery allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin Spreadsheet 0.6 - SQL Injection
CVE-2008-1982—webappsphp
SQL injection vulnerability in ss_load.php in the Spreadsheet (wpSS) 0.6 and earlier plugin for WordPress allows remote
23RISK
open ↗
Referência✓ VexDay Proof
RSS-aggregator - 'path' Remote File Inclusion
CVE-2008-2884—webappsphp
PHP remote file inclusion vulnerability in display.php in RSS-aggregator allows remote attackers to execute arbitrary PH
23RISK
open ↗
Referência✓ VexDay Proof
Cisco Router - HTTP Administration Cross-Site Request Forgery / Command Execution (1)
CVE-2008-4128HIGHunder attackremotehardware
Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the
83RISK
open ↗
Referência✓ VexDay Proof
Media Commands - '.m3u' / '.m3l' / '.TXT' / '.LRC' Local Heap Overflow (PoC)
CVE-2009-0885—doswindows
Multiple heap-based buffer overflows in Media Commands 1.0 allow remote attackers to execute arbitrary code or cause a d
23RISK
open ↗
Referência✓ VexDay Proof
Ocean FTP Server 1.00 - Denial of Service
CVE-2005-0847—doswindows
Code Ocean FTP server 1.0 allows remote attackers to cause a denial of service via a large number of connections.
23RISK
open ↗
Referência✓ VexDay Proof
phpCC 4.2 Beta - 'base_dir' Remote File Inclusion
CVE-2006-4073—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Fabian Hainz phpCC Beta 4.2 allow remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
MyPHPcommander 2.0 - 'package.php' Remote File Inclusion
CVE-2007-0568—webappsphp
PHP remote file inclusion vulnerability in system/lib/package.php in MyPHPCommander 2.0 allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
Versado CMS 1.07 - 'ajax_listado.php?urlModulo' Remote File Inclusion
CVE-2007-2541—webappsphp
PHP remote file inclusion vulnerability in includes/ajax_listado.php in Versado CMS 1.07 allows remote attackers to exec
23RISK
open ↗
← previouspage 76 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.