Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
eFiction 3.0 - 'toplists.php' SQL Injection
CVE-2008-2754—webappsphp
SQL injection vulnerability in toplists.php in eFiction 3.0 and 3.4.3, when magic_quotes_gpc is disabled, allows remote
23RISK
open ↗
Referência✓ VexDay Proof
phpLinkat 0.1 - Insecure Cookie Handling / SQL Injection
CVE-2008-3407—webappsphp
phpLinkat 0.1 allows remote attackers to bypass authentication and access unspecified pages under admin/ by sending a lo
23RISK
open ↗
Referência✓ VexDay Proof
Expert Advisior - 'index.php?id' SQL Injection
CVE-2007-3882—webappsphp
SQL injection vulnerability in index.php in Expert Advisor allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
PHP 5.2.1 - 'substr_compare()' Information Leak
CVE-2007-1375—localmultiple
Integer overflow in the substr_compare function in PHP 5.2.1 and earlier allows context-dependent attackers to read sens
23RISK
open ↗
Referência✓ VexDay Proof
ravennuke 2.3.0 - Multiple Vulnerabilities
CVE-2009-0677—webappsphp
avatarlist.php in the Your Account module, reached through modules.php, in Raven Web Services RavenNuke 2.30 allows remo
23RISK
open ↗
Referência✓ VexDay Proof
Mail Machine 3.989 - Local File Inclusion
CVE-2007-3702—webappsphp
Directory traversal vulnerability in the load function in cgi-bin/mail/mailmachine.cgi in Mail Machine 3.989 and earlier
23RISK
open ↗
Referência✓ VexDay Proof
Aprox CMS Engine 5.1.0.4 - 'index.php' SQL Injection
CVE-2008-3291—webappsphp
SQL injection vulnerability in index.php in AproxEngine (aka Aprox CMS Engine) 5.1.0.4 allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
Simple DNS Plus 5.0/4.1 - Remote Denial of Service
CVE-2008-3208—doswindows
Simple DNS Plus 4.1, 5.0, and possibly other versions before 5.1.101 allows remote attackers to cause a denial of servic
23RISK
open ↗
Referência✓ VexDay Proof
Nitro Web Gallery 1.4.3 - 'section' SQL Injection
CVE-2008-2817—webappsphp
SQL injection vulnerability in albums.php in NiTrO Web Gallery 1.4.3 and earlier allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
OpenImpro 1.1 - 'image.php' SQL Injection
CVE-2008-3599—webappsphp
SQL injection vulnerability in image.php in OpenImpro 1.1 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
opensurveypilot 1.2.1 - Remote File Inclusion
CVE-2007-2166—webappsphp
PHP remote file inclusion vulnerability in administration/user/lib/group.inc.php in OpenSurveyPilot (osp) 1.2.1 and earl
23RISK
open ↗
Referência✓ VexDay Proof
PHPAlbum 0.4.1 Beta 6 - 'language.php' Local File Inclusion
CVE-2006-6613—webappsphp
Directory traversal vulnerability in language.php in phpAlbum 0.4.1 Beta 6 and earlier, when magic_quotes_gpc is disable
23RISK
open ↗
Referência✓ VexDay Proof
YapBB 1.2 Beta2 - 'yapbb_session.php' Remote File Inclusion
CVE-2006-6633—webappsphp
PHP remote file inclusion vulnerability in include/yapbb_session.php in YapBB 1.2 Beta2 and earlier allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
Angel Lms 7.1 - 'default.asp?id' SQL Injection
CVE-2007-1250—webappsasp
SQL injection vulnerability in section/default.asp in ANGEL Learning Management Suite (LMS) 7.1 allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Mybizz-Classifieds - 'cat' SQL Injection
CVE-2008-2845—webappsphp
SQL injection vulnerability in index.php in MyBizz-Classifieds allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
CaupoShop Classic 1.3 - 'saArticle[ID]' SQL Injection
CVE-2008-2866—webappsphp
SQL injection vulnerability in csc_article_details.php in Caupo.net CaupoShop Classic 1.3 allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
FreeBSD 7.0-RELEASE - Telnet Daemon Privilege Escalation
CVE-2009-0641—localfreebsd
sys_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x versions deletes dangerous environment variables with a metho
23RISK
open ↗
Referência✓ VexDay Proof
TUTOS 1.3 - 'cmd.php' Remote Command Execution
CVE-2008-0149—webappsphp
TUTOS 1.3 allows remote attackers to read system information via a direct request to php/admin/phpinfo.php, which calls
23RISK
open ↗
Referência✓ VexDay Proof
Umer Inc Songs Portal Script - 'id' SQL Injection
CVE-2008-5921—webappsphp
SQL injection vulnerability in albums.php in Umer Inc Songs Portal allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
PNPHPBB2 < 1.2i - 'ModName' Multiple Local File Inclusions
CVE-2009-0592—webappsphp
Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute
35RISK
open ↗
Referência✓ VexDay Proof
mxCamArchive 2.2 - Bypass Configuration Download
CVE-2008-6956—webappsphp
Static code injection vulnerability in admin/admin.php in mxCamArchive 2.2 allows remote authenticated administrators to
23RISK
open ↗
Referência✓ VexDay Proof
FlexBB 0.6.3 - Cookies SQL Injection
CVE-2008-0157—webappsphp
SQL injection vulnerability in FlexBB 0.6.3 and earlier allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
ShareCMS 0.1 - Multiple SQL Injections
CVE-2008-2870—webappsphp
Multiple SQL injection vulnerabilities in ShareCMS 0.1 Beta allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
Mambo 4.6.4 - 'Output.php' Remote File Inclusion
CVE-2008-2905—webappsphp
PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4.6.4 and e
43RISK
open ↗
Referência✓ VexDay Proof
Pre ADS Portal 2.0 - SQL Injection
CVE-2008-2916—webappsphp
Multiple SQL injection vulnerabilities in Pre ADS Portal 2.0 and earlier, when magic_quotes_gpc is disabled, allow remot
23RISK
open ↗
Referência✓ VexDay Proof
Efestech Shop 2.0 - 'cat_id' SQL Injection
CVE-2008-3030—webappsphp
SQL injection vulnerability in default.asp in EfesTECH Shop 2.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
XchangeBoard 1.70 - 'boardID' SQL Injection
CVE-2008-3035—webappsphp
SQL injection vulnerability in newThread.php in XchangeBoard 1.70 Final and earlier allows remote authenticated users to
23RISK
open ↗
Referência✓ VexDay Proof
CMS little 0.0.1 - 'template' Local File Inclusion
CVE-2008-3036—webappsphp
Directory traversal vulnerability in index.php in CMS little 0.0.1 allows remote attackers to include and execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Racer 0.5.3 Beta 5 - Remote Buffer Overflow
CVE-2007-4370—remotewindows
Multiple buffer overflows in the (1) client and (2) server in Racer 0.5.3 beta 5 allow remote attackers to execute arbit
50RISK
open ↗
Referência✓ VexDay Proof
Gateway Weblaunch - ActiveX Control Insecure Method
CVE-2008-0220—remotewindows
Multiple stack-based buffer overflows in the WebLaunch.WeblaunchCtl.1 (aka CWebLaunchCtl) ActiveX control in weblaunch.o
28RISK
open ↗
← previouspage 772 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.