Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits

40,961CVEs with public exploitation

24,696lab-tested

All Referência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

WiClear 0.10 - 'path' Remote File Inclusion

CVE-2006-5506—webappsphp

Multiple PHP remote file inclusion vulnerabilities in WiClear 0.10 allow remote attackers to execute arbitrary PHP code

28RISK

open ↗

Referência✓ VexDay Proof

OTManager CMS 2.4 - Insecure Cookie Handling

CVE-2008-7179—webappsphp

OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMI

23RISK

open ↗

Referência✓ VexDay Proof

ZZ FlashChat 3.1 - 'help.php' Local File Inclusion

CVE-2007-5620—webappsphp

Directory traversal vulnerability in admin/inc/help.php in ZZ:FlashChat 3.1 and earlier allows remote attackers to inclu

23RISK

open ↗

Referência✓ VexDay Proof

ezcms 1.2 - Blind SQL Injection / Authentication Bypass

CVE-2008-2921—webappsphp

SQL injection vulnerability in index.php in EZTechhelp EZCMS 1.2 and earlier allows remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

Ovidentia 6.6.5 - 'item' SQL Injection

CVE-2008-4423—webappsphp

SQL injection vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

PHP Classifieds 7.1 - 'detail.php' SQL Injection

CVE-2006-5828—webappsphp

SQL injection vulnerability in detail.php in DeltaScripts PHP Classifieds 7.1 and earlier allows remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

Gallery MX 2.0.0 - Blind SQL Injection

CVE-2008-6379—webappsasp

SQL injection vulnerability in pics_pre.asp in Gallery MX 2.0.0 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

impleo music Collection 2.0 - SQL Injection / Cross-Site Scripting

CVE-2009-2154—webappsphp

SQL injection vulnerability in admin/login.php in Impleo Music Collection 2.0, when magic_quotes_gpc is disabled, allows

23RISK

open ↗

Referência✓ VexDay Proof

Apple CFNetwork - HTTP Response Denial of Service

CVE-2007-0464—dososx

The _CFNetConnectionWillEnqueueRequests function in CFNetwork 129.19 on Apple Mac OS X 10.4 through 10.4.10 allows remot

28RISK

open ↗

Referência✓ VexDay Proof

PeopleAggregator 1.2pre6-release-53 - Multiple Remote File Inclusions

CVE-2007-5631—webappsphp

Multiple PHP remote file inclusion vulnerabilities in PeopleAggregator 1.2pre6, when register_globals is enabled, allow

35RISK

open ↗

Referência✓ VexDay Proof

ECShop 2.5.0 - 'order_sn' SQL Injection

CVE-2009-1622—webappsphp

SQL injection vulnerability in user.php in EcShop 2.5.0 allows remote attackers to execute arbitrary SQL commands via th

23RISK

open ↗

Referência✓ VexDay Proof

Inout Search Engine - Remote Code Execution

CVE-2007-2988—webappsphp

A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administra

23RISK

open ↗

Referência✓ VexDay Proof

Zip Store Chat 4.0/5.0 - Authentication Bypass

CVE-2009-2142—webappsphp

Multiple SQL injection vulnerabilities in admin/index.asp in Zip Store Chat 4.0 and 5.0 allow remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

WordPress Plugin Photoracer 1.0 - 'id' SQL Injection

CVE-2009-2122—webappsphp

SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

TR News 2.1 - 'nb' SQL Injection

CVE-2008-1957—webappsphp

SQL injection vulnerability in news.php in Tr Script News 2.1 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Thyme 1.0 - SQL Injection

CVE-2008-6116—webappsphp

SQL injection vulnerability in the EXtrovert Software Thyme (com_thyme) 1.0 component for Joomla! allows remote attacker

23RISK

open ↗

Referência✓ VexDay Proof

Virtue Classifieds - 'category' SQL Injection

CVE-2009-2021—webappsphp

SQL injection vulnerability in search.php in Virtue Classifieds allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

Def-Blog 1.0.3 - 'comadd.php' SQL Injection

CVE-2006-5383—webappsphp

SQL injection vulnerability in comadd.php in Def-Blog 1.0.1 and earlier allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

PHPortal 1 - 'topicler.php?id' SQL Injection

CVE-2009-2098—webappsphp

SQL injection vulnerability in topicler.php in phPortal 1.0 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

Discussion Forums 2k 3.3 - Multiple SQL Injections

CVE-2008-6100—webappsphp

Multiple SQL injection vulnerabilities in Discussion Forums 2k 3.3, when magic_quotes_gpc is disabled, allow remote atta

23RISK

open ↗

Referência✓ VexDay Proof

Sami HTTP Server 2.0.1 - HTTP 404 Object not found Denial of Service

CVE-2007-0548—doswindows

KarjaSoft Sami HTTP Server 2.0.1 allows remote attackers to cause a denial of service (daemon hang) via a large number o

23RISK

open ↗

Referência✓ VexDay Proof

PHPCollegeExchange 0.1.5c - 'listing_view.php?itemnr' SQL Injection

CVE-2009-2096—webappsphp

SQL injection vulnerability in house/listing_view.php in phpCollegeExchange 0.1.5c allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

virtue news - SQL Injection / Cross-Site Scripting

CVE-2009-2019—webappsphp

SQL injection vulnerability in news_detail.php in Virtue News Manager allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Webdrivers Simple Forum - 'message_details.php' SQL Injection

CVE-2006-5802—webappsphp

SQL injection vulnerability in message_details.php in The Web Drivers Simple Forum, dated 20060318, allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

Social Groupie - 'id' SQL Injection

CVE-2008-6358—webappsphp

SQL injection vulnerability in group_index.php in Social Groupie allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

Virtue Book Store - 'cid' SQL Injection

CVE-2009-2017—webappsphp

SQL injection vulnerability in products.php in Virtue Book Store allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

WebChamado 1.1 - Arbitrary Add Admin

CVE-2008-2907—webappsphp

SQL injection vulnerability in admin/index.php in WebChamado 1.1, when magic_quotes_gpc is disabled, allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

Photo Galerie Standard 1.1 - 'view.php' SQL Injection

CVE-2007-0786—webappsphp

SQL injection vulnerability in view.php in Noname Media Photo Galerie Standard 1.1.1 and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

ASPNuke 0.80 - 'register.asp' SQL Injection

CVE-2006-6070—webappsasp

SQL injection vulnerability in module/account/register/register.asp in ASP Nuke 0.80 and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component MooFAQ (com_moofaq) - Local File Inclusion

CVE-2009-2015—webappsphp

Directory traversal vulnerability in includes/file_includer.php in the Ideal MooFAQ (com_moofaq) component 1.0 for Jooml

38RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.