Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits

40,961CVEs with public exploitation

24,696lab-tested

All Referência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

MagNet BeeHive CMS (header) - Remote File Inclusion

CVE-2006-3266—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Bee-hive Lite 1.2 and earlier, when register_globals is enabled, a

28RISK

open ↗

Referência✓ VexDay Proof

Shadowed Portal 5.599 - 'root' Remote File Inclusion

CVE-2006-4826—webappsphp

PHP remote file inclusion vulnerability in bottom.php in Shadowed Portal 5.599 and earlier allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Content 1.0.0 - 'itemID' SQL Injection

CVE-2008-6923—webappsphp

SQL injection vulnerability in the content component (com_content) 1.0.0 for Joomla! allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component xstandard editor 1.5.8 - Local Directory Traversal

CVE-2009-0113—webappsphp

Directory traversal vulnerability in attachmentlibrary.php in the XStandard component for Joomla! 1.5.8 and earlier allo

23RISK

open ↗

Referência✓ VexDay Proof

DeluxeBB 1.07 - Remote Create Admin

CVE-2006-3304—webappsphp

SQL injection vulnerability in cp.php in DeluxeBB 1.07 and earlier allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

Vastal I-Tech Visa Zone - 'news_id' SQL Injection

CVE-2008-4462—webappsphp

SQL injection vulnerability in view_news.php in Vastal I-Tech Visa Zone allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Google Chrome 0.2.149.27 - Automatic File Download

CVE-2008-6996—remotewindows

Google Chrome BETA (0.2.149.27) does not prompt the user before saving an executable file, which makes it easier for rem

23RISK

open ↗

Referência✓ VexDay Proof

SOTEeSKLEP 3.5RC9 - 'file' Remote File Disclosure

CVE-2007-4369—webappsphp

Directory traversal vulnerability in go/_files in SOTEeSKLEP before 4.0 allows remote attackers to read arbitrary files

23RISK

open ↗

Referência✓ VexDay Proof

Ol BookMarks Manager 0.7.5 - Local File Inclusion / Remote File Inclusion / SQL Injection

CVE-2008-6409—webappsphp

SQL injection vulnerability in index.php in ol'bookmarks manager 0.7.5 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

phpBookingCalendar 1.0c - 'details_view.php' SQL Injection

CVE-2006-1422—webappsphp

SQL injection vulnerability in details_view.php in PHP Booking Calendar 1.0c and earlier allows remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

MKPortal NoBoard Module (Beta) - Remote File Inclusion

CVE-2007-3813—webappsphp

PHP remote file inclusion vulnerability in include/user.php in the NoBoard BETA module for MKPortal allows remote attack

35RISK

open ↗

Referência✓ VexDay Proof

IBM Domino Web Access Upload Module - Overwrite (SEH)

CVE-2007-4474—remotewindows

Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, in

50RISK

open ↗

Referência✓ VexDay Proof

chipmunk topsites - Authentication Bypass / Cross-Site Scripting

CVE-2008-7071—webappsphp

SQL injection vulnerability in authenticate.php in Chipmunk Topsites allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component EventList 0.8 - 'did' SQL Injection

CVE-2007-4509—webappsphp

SQL injection vulnerability in index.php in the EventList component (com_eventlist) 0.8 and earlier for Joomla! allows r

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_iJoomla_rss - Blind SQL Injection

CVE-2009-2099—webappsphp

SQL injection vulnerability in the iJoomla RSS Feeder (com_ijoomla_rss) component for Joomla! allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

HP Virtual Rooms WebHPVCInstall Control - Remote Buffer Overflow

CVE-2008-0437—remotewindows

Multiple buffer overflows in the WebHPVCInstall.HPVirtualRooms14 ActiveX control in HPVirtualRooms14.dll 1.0.0.100, as u

35RISK

open ↗

Referência✓ VexDay Proof

Stash 1.0.3 - SQL Injection User Credentials Disclosure

CVE-2008-4590—webappsphp

Multiple SQL injection vulnerabilities in Stash 1.0.3 allow remote attackers to execute arbitrary SQL commands via (1) t

23RISK

open ↗

Referência✓ VexDay Proof

PHPWebGallery 1.3.4 - Cross-Site Scripting / Local File Inclusion

CVE-2008-4591—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in admin/include/isadmin.inc.php in PhpWebGallery 1.3.4 allow remote

23RISK

open ↗

Referência✓ VexDay Proof

Diesel Job Site - 'job_id' Blind SQL Injection

CVE-2008-6467—webappsphp

SQL injection vulnerability in jobs/jobseekers/job-info.php in Diesel Job Site allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

ReVou Twitter Clone - Authentication Bypass

CVE-2008-7083—webappsphp

Multiple SQL injection vulnerabilities in ReVou Micro Blogging Twitter clone allow remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

mxBB Module Activity Games 0.92 - Remote File Inclusion

CVE-2006-6615—webappsphp

PHP remote file inclusion vulnerability in includes/act_constants.php in the Activity Games (mx_act) 0.92 module for mxB

23RISK

open ↗

Referência✓ VexDay Proof

WordPress Plugin st_newsletter - 'stnl_iframe.php' SQL Injection

CVE-2008-4625—webappsphp

SQL injection vulnerability in stnl_iframe.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows r

23RISK

open ↗

Referência✓ VexDay Proof

Joovili 3.0 - Multiple SQL Injections

CVE-2008-4711—webappsphp

SQL injection vulnerability in Joovili 3.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

The Gemini Portal 4.7 - 'lang' Remote File Inclusion

CVE-2008-4720—webappsphp

Multiple PHP remote file inclusion vulnerabilities in The Gemini Portal 4.7 allow remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

phpQuestionnaire 3.12 - 'phpQRootDir' Remote File Inclusion

CVE-2006-4966—webappsphp

PHP remote file inclusion vulnerability in inc/ifunctions.php in chumpsoft phpQuestionnaire (phpQ) 3.12 allows remote at

23RISK

open ↗

Referência✓ VexDay Proof

ClickCart 6.0 - Authentication Bypass

CVE-2009-0462—webappsphp

Multiple SQL injection vulnerabilities in customer_login_check.asp in ClickTech ClickCart 6.0 allow remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

Kjtechforce mailman b1 - 'dest' Blind SQL Injection

CVE-2009-2164—webappsphp

Multiple SQL injection vulnerabilities in Kjtechforce mailman beta1, when magic_quotes_gpc is disabled, allow remote att

23RISK

open ↗

Referência✓ VexDay Proof

Ipswitch WS_FTP LE 5.08 - PASV Response Remote Buffer Overflow

CVE-2006-4974—remotewindows

Buffer overflow in Ipswitch WS_FTP Limited Edition (LE) 5.08 allows remote FTP servers to execute arbitrary code via a l

23RISK

open ↗

Referência✓ VexDay Proof

Informium 0.12.0 - 'common-menu.php' Remote File Inclusion

CVE-2006-2818—webappsphp

PHP remote file inclusion vulnerability in common-menu.php in Cameron McKay Informium 0.12.0 allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

pNews 1.1.0 - 'nbs' Remote File Inclusion

CVE-2006-5022—webappsphp

PHP remote file inclusion vulnerability in includes/global.php in Joshua Wilson pNews System 1.1.0 (aka PowerNews) allow

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.