Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
HP Virtual Rooms WebHPVCInstall Control - Remote Buffer Overflow
CVE-2008-0437—remotewindows
Multiple buffer overflows in the WebHPVCInstall.HPVirtualRooms14 ActiveX control in HPVirtualRooms14.dll 1.0.0.100, as u
35RISK
open ↗
Referência✓ VexDay Proof
Stash 1.0.3 - SQL Injection User Credentials Disclosure
CVE-2008-4590—webappsphp
Multiple SQL injection vulnerabilities in Stash 1.0.3 allow remote attackers to execute arbitrary SQL commands via (1) t
23RISK
open ↗
Referência✓ VexDay Proof
PHPWebGallery 1.3.4 - Cross-Site Scripting / Local File Inclusion
CVE-2008-4591—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in admin/include/isadmin.inc.php in PhpWebGallery 1.3.4 allow remote
23RISK
open ↗
Referência✓ VexDay Proof
Diesel Job Site - 'job_id' Blind SQL Injection
CVE-2008-6467—webappsphp
SQL injection vulnerability in jobs/jobseekers/job-info.php in Diesel Job Site allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
chipmunk topsites - Authentication Bypass / Cross-Site Scripting
CVE-2008-7072—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Chipmunk Topsites allows remote attackers to inject arbitrary w
23RISK
open ↗
Referência✓ VexDay Proof
guanxiCRM Business Solution 0.9.1 - Remote File Inclusion
CVE-2006-4898—webappsphp
PHP remote file inclusion vulnerability in include/phpxd/phpXD.php in guanxiCRM 0.9.1 and earlier allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
Simple PHP NewsLetter 1.5 - Local File Inclusion
CVE-2009-0340—webappsphp
Multiple directory traversal vulnerabilities in Simple PHP Newsletter 1.5 allow remote attackers to read arbitrary files
23RISK
open ↗
Referência✓ VexDay Proof
phpFastNews 1.0.0 - Insecure Cookie Handling
CVE-2008-4622—webappsphp
The isLoggedIn function in fastnews-code.php in phpFastNews 1.0.0 allows remote attackers to bypass authentication and g
23RISK
open ↗
Referência✓ VexDay Proof
BosNews 4.0 - 'article' SQL Injection
CVE-2008-4703—webappsphp
SQL injection vulnerability in news.php in BosDev BosNews 4.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Blogator-script 0.95 - Change User Password
CVE-2008-6473—webappsphp
_blogadata/include/init_pass2.php in Blogator-script 0.95 allows remote attackers to change the password for arbitrary u
23RISK
open ↗
Referência✓ VexDay Proof
ReVou Twitter Clone - Authentication Bypass
CVE-2008-7083—webappsphp
Multiple SQL injection vulnerabilities in ReVou Micro Blogging Twitter clone allow remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
mxBB Module Activity Games 0.92 - Remote File Inclusion
CVE-2006-6615—webappsphp
PHP remote file inclusion vulnerability in includes/act_constants.php in the Activity Games (mx_act) 0.92 module for mxB
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin st_newsletter - 'stnl_iframe.php' SQL Injection
CVE-2008-4625—webappsphp
SQL injection vulnerability in stnl_iframe.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows r
23RISK
open ↗
Referência✓ VexDay Proof
Joovili 3.0 - Multiple SQL Injections
CVE-2008-4711—webappsphp
SQL injection vulnerability in Joovili 3.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
The Gemini Portal 4.7 - 'lang' Remote File Inclusion
CVE-2008-4720—webappsphp
Multiple PHP remote file inclusion vulnerabilities in The Gemini Portal 4.7 allow remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
webid 0.5.4 - Multiple Vulnerabilities
CVE-2008-7116—webappsphp
SQL injection vulnerability in the admin panel (admin/) in WeBid auction script 0.5.4 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
webid 0.5.4 - Multiple Vulnerabilities
CVE-2008-7117—webappsphp
eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets (CSS) file
23RISK
open ↗
Referência✓ VexDay Proof
TorrentTrader Classic 1.09 - Multiple Vulnerabilities
CVE-2009-2160—webappsphp
TorrentTrader Classic 1.09 allows remote attackers to (1) obtain configuration information via a direct request to phpin
23RISK
open ↗
Referência✓ VexDay Proof
phpListPro 2.0.1 - 'Language' Remote Code Execution
CVE-2006-2523—webappsphp
PHP remote file inclusion vulnerability in config.php in phpListPro 2.0.1 and earlier, with magic_quotes_gpc disabled, a
23RISK
open ↗
Referência✓ VexDay Proof
TR Newsportal 0.36tr1 - 'poll.php' Remote File Inclusion
CVE-2006-2557—webappsphp
PHP remote file inclusion vulnerability in extras/poll/poll.php in Florian Amrhein NewsPortal before 0.37, and TR Newspo
28RISK
open ↗
Referência✓ VexDay Proof
WBB Plugin rGallery 1.09 - 'itemID' Blind SQL Injection
CVE-2008-4627—webappsphp
SQL injection vulnerability in the rGallery plugin 1.09 for WoltLab Burning Board (WBB) allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
Post Comments 3.0 - Insecure Cookie Handling
CVE-2008-4721—webappsphp
PHP Jabbers Post Comment 3.0 allows remote attackers to bypass authentication and gain administrative access by setting
23RISK
open ↗
Referência✓ VexDay Proof
Opera 9.60 - Persistent Cross-Site Scripting
CVE-2008-4725—remotewindows
Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to inject arbitrary web scri
23RISK
open ↗
Referência✓ VexDay Proof
Facil-CMS 0.1RC - Multiple Local File Inclusions
CVE-2008-7176—webappsphp
Multiple directory traversal vulnerabilities in Facil CMS 0.1RC allow remote attackers to read arbitrary files via a ..
23RISK
open ↗
Referência✓ VexDay Proof
Woltlab Burning Board 2.3.5 - 'links.php' SQL Injection
CVE-2006-2569—webappsphp
SQL injection vulnerability in links.php in 4R Linklist 1.0 RC2 and earlier, a module for Woltlab Burning Board, allows
23RISK
open ↗
Referência✓ VexDay Proof
phpQuestionnaire 3.12 - 'phpQRootDir' Remote File Inclusion
CVE-2006-4966—webappsphp
PHP remote file inclusion vulnerability in inc/ifunctions.php in chumpsoft phpQuestionnaire (phpQ) 3.12 allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
ClickCart 6.0 - Authentication Bypass
CVE-2009-0462—webappsphp
Multiple SQL injection vulnerabilities in customer_login_check.asp in ClickTech ClickCart 6.0 allow remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Kjtechforce mailman b1 - 'dest' Blind SQL Injection
CVE-2009-2164—webappsphp
Multiple SQL injection vulnerabilities in Kjtechforce mailman beta1, when magic_quotes_gpc is disabled, allow remote att
23RISK
open ↗
Referência✓ VexDay Proof
Ipswitch WS_FTP LE 5.08 - PASV Response Remote Buffer Overflow
CVE-2006-4974—remotewindows
Buffer overflow in Ipswitch WS_FTP Limited Edition (LE) 5.08 allows remote FTP servers to execute arbitrary code via a l
23RISK
open ↗
Referência✓ VexDay Proof
Informium 0.12.0 - 'common-menu.php' Remote File Inclusion
CVE-2006-2818—webappsphp
PHP remote file inclusion vulnerability in common-menu.php in Cameron McKay Informium 0.12.0 allows remote attackers to
23RISK
open ↗
← previouspage 777 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.