Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
phpskelsite 1.4 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2009-0595—webappsphp
PHP remote file inclusion vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled
35RISK
open ↗
Referência✓ VexDay Proof
bwired - 'index.php?newsID' SQL Injection
CVE-2007-3978—webappsphp
Session fixation vulnerability in bwired allows remote attackers to hijack web sessions by setting the PHPSESSID paramet
23RISK
open ↗
Referência✓ VexDay Proof
EnjoySAP ActiveX kweditcontrol.kwedit.1 - Remote Stack Overflow (PoC)
CVE-2007-3607—doswindows
Multiple unspecified vulnerabilities in ActiveX controls in the EnjoySAP SAP GUI allow remote attackers to cause a denia
23RISK
open ↗
Referência✓ VexDay Proof
Yerba SACphp 6.3 - Local File Inclusion
CVE-2008-4486—webappsphp
Directory traversal vulnerability in index.php in SAC.php (SACphp), as used in Yerba 6.3 and earlier, allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
elvin bts 1.2.0 - Multiple Vulnerabilities
CVE-2009-2124—webappsphp
Directory traversal vulnerability in page.php in Elvin 1.2.0 allows remote attackers to include and execute arbitrary lo
23RISK
open ↗
Referência✓ VexDay Proof
Potato News 1.0.0 - Local File Inclusion
CVE-2009-0722—webappsphp
Directory traversal vulnerability in admin.php in Potato News 1.0.0 allows remote attackers to include and execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
ZeeBuddy 2.1 - 'adid' SQL Injection
CVE-2008-3604—webappsphp
SQL injection vulnerability in bannerclick.php in ZeeBuddy 2.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
ErfurtWiki R1.02b - Local File Inclusion
CVE-2008-2672—webappsphp
Multiple directory traversal vulnerabilities in ErfurtWiki R1.02b and earlier, when register_globals is enabled, allow r
23RISK
open ↗
Referência✓ VexDay Proof
mm chat 1.5 - Local File Inclusion / Cross-Site Scripting
CVE-2008-2973—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in chathead.php in MM Chat 1.5 allow remote attackers to inject arbi
23RISK
open ↗
Referência✓ VexDay Proof
UploadImage/UploadScript 1.0 - Remote Change Admin Password
CVE-2008-0246—webappsphp
admin.php in UploadScript 1.0 does not check for the original password before making a change to a new password, which a
23RISK
open ↗
Referência✓ VexDay Proof
phpdaily - SQL Injection / Cross-Site Scripting / Local File Download
CVE-2008-4756—webappsphp
Cross-site scripting (XSS) vulnerability in add_prest_date.php in PHP-Daily allows remote attackers to inject arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
celerbb 0.0.2 - Multiple Vulnerabilities
CVE-2009-0853—webappsphp
login.php in CelerBB 0.0.2, when magic_quotes_gpc is disabled, allows remote attackers to bypass authentication and obta
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component mydyngallery 1.4.2 - SQL Injection
CVE-2008-5957—webappsphp
SQL injection vulnerability in the Mydyngallery (com_mydyngallery) component 1.4.2 for Joomla! allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
Active Business Directory 2 - Blind SQL Injection
CVE-2008-5972—webappsphp
SQL injection vulnerability in default.asp in Active Business Directory 2 allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
Pilot Group PG Roommate Finder Solution - Authentication Bypass
CVE-2008-5307—webappsphp
SQL injection vulnerability in admin/index.php in PG Roommate Finder Solution allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
YourFreeWorld Scrolling Text Ads - SQL Injection
CVE-2008-4885—webappsphp
SQL injection vulnerability in tr1.php in YourFreeWorld Scrolling Text Ads Script allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Ultimate Fun Book 1.02 - 'function.php' Remote File Inclusion
CVE-2007-1059—webappsphp
PHP remote file inclusion vulnerability in function.php in Ultimate Fun Book 1.02 allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Post 1.0 - Cookie Modification Privilege Escalation
CVE-2006-3772—webappsphp
PHP-Post 0.21 and 1.0, and possibly earlier versions, when auto-login is enabled, allows remote attackers to bypass secu
28RISK
open ↗
Referência✓ VexDay Proof
SH-News 0.93 - 'misc.php' Remote File Inclusion
CVE-2006-6801—webappsphp
PHP remote file inclusion vulnerability in misc.php in SH-News 0.93, when register_globals is enabled, allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
Vastal I-Tech MMORPG Zone - 'game_id' SQL Injection
CVE-2008-4460—webappsphp
SQL injection vulnerability in game.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Social Engine 2.0 - Multiple Local File Inclusions
CVE-2007-6581—webappsphp
Multiple directory traversal vulnerabilities in Social Engine 2.0 allow remote attackers to include and execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
LinkedIn Toolbar 3.0.2.1098 - Remote Buffer Overflow
CVE-2007-3955—remotewindows
Buffer overflow in the IEToolbar.IEContextMenu.1 ActiveX control in LinkedInIEToolbar.dll in the LinkedIn Toolbar 3.0.2.
23RISK
open ↗
Referência✓ VexDay Proof
WSN Links 2.20 - 'comments.php' SQL Injection
CVE-2008-6033—webappsphp
SQL injection vulnerability in comments.php in WSN Links 2.20 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
PHPMyDesk 1.0 Beta - 'viewticket.php' Local File Inclusion
CVE-2006-7132—webappsphp
Directory traversal vulnerability in pmd-config.php in PHPMyDesk 1.0beta allows remote attackers to include arbitrary lo
23RISK
open ↗
Referência✓ VexDay Proof
WinRAR 3.60 Beta 6 - SFX Path Local Stack Overflow
CVE-2006-3912—localwindows
Stack-based buffer overflow in the SFX module in WinRAR before 3.60 beta 8 has unspecified vectors and impact.
23RISK
open ↗
Referência✓ VexDay Proof
WinRAR 3.60 Beta 6 (French) - SFX Path Local Stack Overflow
CVE-2006-3912—localwindows
Stack-based buffer overflow in the SFX module in WinRAR before 3.60 beta 8 has unspecified vectors and impact.
23RISK
open ↗
Referência✓ VexDay Proof
ESPG (Enhanced Simple PHP Gallery) 1.72 - File Disclosure
CVE-2009-0331—webappsphp
Directory traversal vulnerability in gallery/comment.php in Enhanced Simple PHP Gallery (ESPG) 1.72 allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
Dokuwiki 2009-02-14 - Local File Inclusion
CVE-2009-1960—webappsphp
inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote att
35RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows - NAT Helper Components 'ipnathlp.dll' Remote Denial of Service
CVE-2006-5614—doswindows
Microsoft Windows NAT Helper Components (ipnathlp.dll) on Windows XP SP2, when Internet Connection Sharing is enabled, a
60RISK
open ↗
Referência✓ VexDay Proof
IF-CMS 2.0 - 'id' Blind SQL Injection
CVE-2009-0528—webappsphp
SQL injection vulnerability in frame.php in Rhadrix If-CMS 2.07 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
← previouspage 780 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.