Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits

40,961CVEs with public exploitation

24,696lab-tested

All Referência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

Alt-N MDaemon IMAP server 9.6.4 - 'FETCH' Remote Buffer Overflow

CVE-2008-1358—remotewindows

Stack-based buffer overflow in the IMAP server in Alt-N Technologies MDaemon 9.6.4 allows remote authenticated users to

50RISK

open ↗

Referência✓ VexDay Proof

Built2Go PHP Realestate 1.5 - 'event_detail.php' SQL Injection

CVE-2008-4497—webappsphp

SQL injection vulnerability in event_detail.php in Built2Go Real Estate Listings 1.5 allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

Telephone Directory 2008 - SQL Injection / Cross-Site Scripting

CVE-2008-2678—webappsphp

Multiple SQL injection vulnerabilities in Telephone Directory 2008, when magic_quotes_gpc is disabled, allow remote atta

23RISK

open ↗

Referência✓ VexDay Proof

mystats - 'hits.php' Multiple Vulnerabilities

CVE-2008-4643—webappsphp

SQL injection vulnerability in hits.php in myWebland myStats allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft PicturePusher - ActiveX Cross-Site Arbitrary File Upload

CVE-2008-4493—remotewindows

Microsoft PicturePusher ActiveX control (PipPPush.DLL 7.00.0709), as used in Microsoft Digital Image 2006 Starter Editio

28RISK

open ↗

Referência✓ VexDay Proof

ArabCMS - 'rss.php' Local File Inclusion

CVE-2008-4667—webappsphp

Directory traversal vulnerability in rss.php in ArabCMS 2.0 beta 1 allows remote attackers to include and execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

QuickTalk Forum 1.6 - Blind SQL Injection

CVE-2008-1316—webappsphp

SQL injection vulnerability in qtf_ind_search_ov.php in QT-cute QuickTalk Forum 1.6 and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

ITLPoll 2.7 Stable2 - Blind SQL Injection

CVE-2009-0295—webappsphp

SQL injection vulnerability in index.php in Information Technology Light Poll Information (ITLPoll) 2.7 Stable 2, when m

23RISK

open ↗

Referência✓ VexDay Proof

ItCMS 2.1a - Authentication Bypass

CVE-2009-0493—webappsphp

SQL injection vulnerability in login.php in IT!CMS 2.1a and earlier allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

Noname CMS 1.0 - Multiple SQL Injections

CVE-2008-6093—webappsphp

SQL injection vulnerability in index.php in Noname CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

Vastal I-Tech Freelance Zone - 'coder_id' SQL Injection

CVE-2008-4469—webappsphp

SQL injection vulnerability in view_cresume.php in Vastal I-Tech Freelance Zone allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

Vastal I-Tech DVD Zone - 'cat_id' SQL Injection

CVE-2008-4465—webappsphp

SQL injection vulnerability in view_mags.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component imagebrowser 0.1.5 rc2 - Directory Traversal

CVE-2008-4668—webappsphp

Directory traversal vulnerability in the Image Browser (com_imagebrowser) 0.1.5 component for Joomla! allows remote atta

43RISK

open ↗

Referência✓ VexDay Proof

Vastal I-Tech Jobs Zone - 'news_id' SQL Injection

CVE-2008-4463—webappsphp

SQL injection vulnerability in view_news.php in Vastal I-Tech Jobs Zone allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

DESlock+ < 3.2.6 - 'DLMFENC.sys' Local Kernel Ring0 link list zero (PoC)

CVE-2008-1138—doswindows

DLMFENC.sys 1.0.0.26 in DESlock+ 3.2.6 and earlier allows local users to cause a denial of service (system crash) via a

23RISK

open ↗

Referência✓ VexDay Proof

Camera Life 2.6.2b4 - SQL Injection / Cross-Site Scripting

CVE-2008-6087—webappsphp

Cross-site scripting (XSS) vulnerability in topic.php in Camera Life 2.6.2b4 allows remote attackers to inject arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

WordPress Plugin WP Comment Remix 1.4.3 - SQL Injection

CVE-2008-4732—webappsphp

SQL injection vulnerability in ajax_comments.php in the WP Comment Remix plugin before 1.4.4 for WordPress allows remote

23RISK

open ↗

Referência✓ VexDay Proof

mIRC 6.34 - Remote Buffer Overflow (PoC)

CVE-2008-4449—doswindows

Stack-based buffer overflow in mIRC 6.34 allows remote attackers to execute arbitrary code via a long hostname in a PRIV

50RISK

open ↗

Referência✓ VexDay Proof

LoudBlog 0.8.0a - 'ajax.php' SQL Injection

CVE-2008-6077—webappsphp

SQL injection vulnerability in loudblog/ajax.php in LoudBlog 0.8.0a and earlier allows remote authenticated users to exe

23RISK

open ↗

Referência✓ VexDay Proof

Kasseler CMS 1.3.0 - Local File Inclusion / Cross-Site Scripting

CVE-2008-3088—webappsphp

Cross-site scripting (XSS) vulnerability in the Files module in Kasseler CMS 1.3.0 and 1.3.1 Lite allows remote attacker

23RISK

open ↗

Referência✓ VexDay Proof

Miniweb 0.8.19 - Multiple Vulnerabilities

CVE-2008-0338—remotewindows

Directory traversal vulnerability in the mwGetLocalFileName function in http.c in MiniWeb HTTP Server 0.8.19 allows remo

23RISK

open ↗

Referência✓ VexDay Proof

Siteman 1.1.9 - 'cat' Remote File Disclosure

CVE-2008-0452—webappsphp

Directory traversal vulnerability in articles.php in Siteman 1.1.9 allows remote attackers to read arbitrary files via d

23RISK

open ↗

Referência✓ VexDay Proof

basebuilder 2.0.1 - 'main.inc.php' Remote File Inclusion

CVE-2008-6036—webappsphp

PHP remote file inclusion vulnerability in main.inc.php in BaseBuilder 2.0.1 and earlier allows remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

WSN Links Free 4.0.34P - 'comments.php' Blind SQL Injection

CVE-2008-6032—webappsphp

SQL injection vulnerability in comments.php in WSN Links Free 4.0.34P allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

PHP-Nuke Module Kose_Yazilari - 'artid' SQL Injection

CVE-2008-1053—webappsphp

Multiple SQL injection vulnerabilities in the Kose_Yazilari module for PHP-Nuke allow remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

ACGVclick 0.2.0 - 'path' Remote File Inclusion

CVE-2007-0577—webappsphp

PHP remote file inclusion vulnerability in function.inc.php in ACGVclick 0.2.0 and earlier allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

phpBB MOD Forum picture and META tags 1.7 - Remote File Inclusion

CVE-2007-1818—webappsphp

PHP remote file inclusion vulnerability in MOD_forum_fields_parse.php in the Forum picture and META tags 1.7 module for

23RISK

open ↗

Referência✓ VexDay Proof

YAAP 1.5 - '__autoload()' Remote File Inclusion

CVE-2007-2664—webappsphp

PHP remote file inclusion vulnerability in includes/common.php in Yaap 1.5 and earlier allows remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

Scallywag - 'template.php?path' Remote File Inclusion

CVE-2007-2900—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Scallywag 2005-04-25 allow remote attackers to execute arbitrary P

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft HTML Workshop 4.74 - Universal Buffer Overflow

CVE-2009-0133—localwindows

Buffer overflow in Microsoft HTML Help Workshop 4.74 and earlier allows context-dependent attackers to execute arbitrary

50RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.