Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
PHP Help Agent 1.1 - 'content' Local File Inclusion
CVE-2008-3385—webappsphp
Directory traversal vulnerability in include/head_chat.inc.php in php Help Agent 1.0 and 1.1 Full allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
Flax Article Manager 1.1 - 'cat_id' SQL Injection
CVE-2009-0284—webappsphp
SQL injection vulnerability in category.php in Flax Article Manager 1.1 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
PHPNews 0.93 - 'format_menue' Remote File Inclusion
CVE-2007-4232—webappsphp
PHP remote file inclusion vulnerability in admin/inc/change_action.php in Andreas Robertz PHPNews 0.93 allows remote att
35RISK
open ↗
Referência✓ VexDay Proof
Tribiq CMS 5.0.10a (Windows) - Local File Inclusion
CVE-2008-4894—webappsphp
Directory traversal vulnerability in templates/mytribiqsite/tribal-GPL-1066/includes/header.inc.php in Tribiq CMS 5.0.10
23RISK
open ↗
Referência✓ VexDay Proof
CMS NetCat 3.12 - Multiple Vulnerabilities
CVE-2008-5728—webappsphp
Multiple directory traversal vulnerabilities in AIST NetCat 3.12 and earlier, when magic_quotes_gpc is disabled and regi
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module XFsection 1.07 - 'articleId' Blind SQL Injection
CVE-2007-1974—webappsphp
SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as
23RISK
open ↗
Referência✓ VexDay Proof
Yet Another NOCC 0.1.0 - Local File Inclusion
CVE-2009-0515—webappsphp
Directory traversal vulnerability in check_lang.php in Yet Another NOCC (YANOCC) 0.1.0 and earlier allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
AIMP 2.51 build 330 - ID3v1/ID3v2 Tag Remote Stack Buffer Overflow (PoC) (SEH)
CVE-2009-1944—doswindows
Stack-based buffer overflow in AIMP 2.51 build 330 allows remote attackers to execute arbitrary code via an MP3 file wit
28RISK
open ↗
Referência✓ VexDay Proof
Quick TFTP Server Pro 2.1 - Remote Overflow (SEH)
CVE-2008-1610—remotewindows
Stack-based buffer overflow in TallSoft Quick TFTP Server Pro 2.1 allows remote attackers to cause a denial of service o
50RISK
open ↗
Referência✓ VexDay Proof
NVR SP2 2.0 'nvUnifiedControl.dll 1.1.45.0' - 'SetText()' Command Execution
CVE-2007-4582—remotewindows
Buffer overflow in the nvUnifiedControl.AUnifiedControl.1 ActiveX control in nvUnifiedControl.dll 1.1.45.0 in ACTi Netwo
23RISK
open ↗
Referência✓ VexDay Proof
IrfanView 4.10 - '.fpx' Memory Corruption
CVE-2008-0493—localwindows
fpx.dll 3.9.8.0 in the FlashPix plugin for IrfanView 4.10 allows remote attackers to execute arbitrary code via a crafte
23RISK
open ↗
Referência✓ VexDay Proof
PHP recommend 1.3 - Authentication Bypass / Remote File Inclusion / Code Injection
CVE-2009-1780—webappsphp
admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, wh
23RISK
open ↗
Referência✓ VexDay Proof
ComicShout 2.8 - 'news_id' SQL Injection
CVE-2008-6425—webappsphp
SQL injection vulnerability in news.php in ComicShout 2.8 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
Barracuda Spam Firewall 3.5.11.020 Model 600 - SQL Injection
CVE-2008-1094—remotehardware
SQL injection vulnerability in index.cgi in the Account View page in Barracuda Spam Firewall (BSF) before 3.5.12.007 all
23RISK
open ↗
Referência✓ VexDay Proof
Angelo-Emlak 1.0 - Multiple SQL Injections
CVE-2008-2048—webappsasp
Cross-site scripting (XSS) vulnerability in hpz/admin/Default.asp in Angelo-Emlak 1.0 allows remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
PMECMS 1.0 - config[pathMod] Remote File Inclusion
CVE-2007-2540—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PMECMS 1.0 and earlier allow remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
W1L3D4 philboard 1.2 - Blind SQL Injection / Cross-Site Scripting
CVE-2008-5193—webappsphp
Cross-site scripting (XSS) vulnerability in search.asp in W1L3D4 Philboard 1.14 and 1.2 allows remote attackers to injec
23RISK
open ↗
Referência✓ VexDay Proof
My PHP Dating - 'id' SQL Injection
CVE-2008-4705—webappsphp
SQL injection vulnerability in success_story.php in php Online Dating Software MyPHPDating allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
phpcrs 2.06 - 'importFunction' Local File Inclusion
CVE-2008-6074—webappsphp
Directory traversal vulnerability in frame.php in phpcrs 2.06 and earlier, when magic_quotes_gpc is disabled, allows rem
23RISK
open ↗
Referência✓ VexDay Proof
PHP DocWriter 0.3 - 'script' Remote File Inclusion
CVE-2006-4912—webappsphp
PHP remote file inclusion vulnerability in PHP DocWriter 0.3 and earlier allows remote attackers to execute arbitrary PH
23RISK
open ↗
Referência✓ VexDay Proof
Free Photo Gallery Site Script - 'path' File Disclosure
CVE-2008-1730—webappsphp
Directory traversal vulnerability in download.html in ARWScripts Gallery Script Lite (aka gallery-script-lite or Free Ph
23RISK
open ↗
Referência✓ VexDay Proof
TemaTres 1.0.3 - Blind SQL Injection
CVE-2009-1584—webappsphp
Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magic_quotes_gpc is disabled, allow remote atta
23RISK
open ↗
Referência✓ VexDay Proof
RunCMS 1.5.2 - 'debug_show.php' SQL Injection
CVE-2007-2539—webappsphp
The show_files function in RunCms 1.5.2 and earlier allows remote attackers to obtain sensitive information (file existe
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft GDI Plugin - '.png' Infinite Loop Denial of Service (PoC)
CVE-2009-1511—doswindows
GDI+ in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (infinite loop) via a PNG file tha
28RISK
open ↗
Referência✓ VexDay Proof
Discuz! - Remote Reset User Password
CVE-2008-6957—webappsphp
member.php in Crossday Discuz! Board allows remote attackers to reset passwords of arbitrary users via crafted (1) lostp
23RISK
open ↗
Referência✓ VexDay Proof
PollHelper - Remote Configuration File Disclosure
CVE-2009-0827—webappsphp
PollHelper stores poll.inc under the web root with insufficient access control, which allows remote attackers to downloa
23RISK
open ↗
Referência✓ VexDay Proof
feedDemon 2.7 - OPML Outline Tag Buffer Overflow
CVE-2009-0546—localwindows
Stack-based buffer overflow in NewsGator FeedDemon 2.7 and earlier allows user-assisted remote attackers to execute arbi
50RISK
open ↗
Referência✓ VexDay Proof
FlexPHPDirectory 0.0.1 - Authentication Bypass
CVE-2008-6749—webappsphp
Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPDirectory 0.0.1, when magic_quotes_gpc is disabl
23RISK
open ↗
Referência✓ VexDay Proof
Maran PHP Shop - 'prodshow.php' SQL Injection
CVE-2008-4880—webappsphp
SQL injection vulnerability in prodshow.php in Maran PHP Shop allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
aspwebalbum 3.2 - Multiple Vulnerabilities
CVE-2008-6978—webappsasp
Unrestricted file upload vulnerability in Full Revolution aspWebAlbum 3.2 allows remote attackers to execute arbitrary c
23RISK
open ↗
← previouspage 761 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.