Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Explay CMS 2.1 - Insecure Cookie Handling
CVE-2008-6411—webappsphp
Explay CMS 2.1 and earlier allows remote attackers to bypass authentication and gain administrative access by setting th
23RISK
open ↗
Referência✓ VexDay Proof
PhpAddEdit 1.3 - 'cookie' Authentication Bypass
CVE-2008-6581—webappsphp
login.php in PhpAddEdit 1.3 allows remote attackers to bypass authentication and gain administrative access by setting t
23RISK
open ↗
Referência✓ VexDay Proof
Corel WordPerfect X3 13.0.0.565 - '.prs' Local Buffer Overflow
CVE-2007-1735—localwindows
Stack-based buffer overflow in Corel WordPerfect Office X3 (13.0.0.565) allows user-assisted remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
SimpleBlog 2.3 - '/admin/edit.asp' SQL Injection
CVE-2006-6191—webappsasp
SQL injection vulnerability in admin/edit.asp in 8pixel.net simpleblog 2.3 and earlier allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
CPCommerce 1.1.0 - Cross-Site Scripting / Local File Inclusion
CVE-2008-1906—webappsphp
Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
acFTP FTP Server 1.5 - 'REST/PBSZ' Remote Denial of Service
CVE-2006-6775—doswindows
acFTP 1.5 allows remote authenticated users to cause a denial of service via a crafted argument to the (1) REST or (2) P
23RISK
open ↗
Referência✓ VexDay Proof
EggBlog 3.1.0 - Cookies SQL Injection
CVE-2008-0159—webappsphp
SQL injection vulnerability in index.php in eggBlog 3.1.0 and earlier allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
SCMS 1 - Local File Inclusion
CVE-2009-0330—webappsphp
Directory traversal vulnerability in index.php in Simple Content Management System (SCMS) 1 allows remote attackers to i
23RISK
open ↗
Referência✓ VexDay Proof
TeamSpeak 2.0 (Windows Release) - Remote Denial of Service
CVE-2007-3956—doswindows
TeamSpeak WebServer 2.0 for Windows does not validate parameter value lengths and does not expire TCP sessions, which al
23RISK
open ↗
Referência✓ VexDay Proof
pastelcms 0.8.0 - Local File Inclusion / SQL Injection
CVE-2009-1405—webappsphp
Directory traversal vulnerability in index.php in PastelCMS 0.8.0, when magic_quotes_gpc is disabled, allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
nweb2fax 0.2.7 - Multiple Vulnerabilities
CVE-2008-6669—webappsphp
viewrq.php in nweb2fax 0.2.7 and earlier allows remote attackers to execute arbitrary code via shell metacharacters in t
23RISK
open ↗
Referência✓ VexDay Proof
Ruby 1.9 - regex engine Remote Socket Memory Leak
CVE-2008-3443—dosmultiple
The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, an
28RISK
open ↗
Referência✓ VexDay Proof
Online Media Technologies 'AVSMJPEGFILE.DLL 1.1' - Remote Buffer Overflow (PoC)
CVE-2007-6327—doswindows
Buffer overflow in a certain ActiveX control in Online Media Technologies AVSMJPEGFILE.DLL 1.1.1.102 allows remote attac
28RISK
open ↗
Referência✓ VexDay Proof
Phoenician Casino FlashAX - ActiveX Remote Code Execution
CVE-2008-5691—remotewindows
Heap-based buffer overflow in the Phoenician Casino FlashAX ActiveX control 1.0.0.7 allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
Dagger CMS 2008 - 'dir_inc' Remote File Inclusion
CVE-2008-6636—webappsphp
PHP remote file inclusion vulnerability in skins/default.php in Geody Labs Dagger - The Cutting Edge r12feb2008, when re
23RISK
open ↗
Referência✓ VexDay Proof
Active NewsLetter 4.3 - 'ViewNewspapers.asp' SQL Injection
CVE-2007-1696—webappsasp
SQL injection vulnerability in ViewNewspapers.asp in Active Newsletter 4.3 and earlier allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
ibase 2.03 - Remote File Disclosure
CVE-2008-6288—webappsphp
Directory traversal vulnerability in download.php in Interface Medien ibase 2.03 and earlier allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
kontakt formular 1.4 - Remote File Inclusion
CVE-2007-6655—webappsphp
PHP remote file inclusion vulnerability in includes/function.php in Kontakt Formular 1.4 allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
PHPBB2 MODificat 0.2.0 - 'functions.php' Remote File Inclusion
CVE-2007-0656—webappsphp
PHP remote file inclusion vulnerability in includes/functions.php in phpBB2-MODificat 0.2.0 and earlier allows remote at
28RISK
open ↗
Referência✓ VexDay Proof
TOSMO/Mambo 1.4.13a - 'absolute_path' Remote File Inclusion
CVE-2007-2317—webappsphp
Multiple PHP remote file inclusion vulnerabilities in MiniBB Forum 1.5a and earlier, as used by TOSMO/Mambo 4.0.12 and p
23RISK
open ↗
Referência✓ VexDay Proof
Picturesolution 2.1 - 'config.php?path' Remote File Inclusion
CVE-2007-5313—webappsphp
PHP remote file inclusion vulnerability in install/config.php in Picturesolution 2.1 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
MiniWeb HTTP Server 0.8.x - Remote Denial of Service
CVE-2007-3159—doswindows
http.c in MiniWeb Http Server 0.8.x allows remote attackers to cause a denial of service (application crash) via a negat
23RISK
open ↗
Referência✓ VexDay Proof
FirmWorX 0.1.2 - Multiple Remote File Inclusions
CVE-2007-2891—webappsphp
Multiple PHP remote file inclusion vulnerabilities in FirmWorX 0.1.2 allow remote attackers to execute arbitrary PHP cod
23RISK
open ↗
Referência✓ VexDay Proof
Pre ADS Portal 2.0 - Authentication Bypass / Cross-Site Scripting
CVE-2008-6715—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Pre ADS Portal 2.0 and earlier allow remote attackers to inject a
23RISK
open ↗
Referência✓ VexDay Proof
Simple Web Content Management System - SQL Injection
CVE-2007-0093—webappsphp
SQL injection vulnerability in page.php in Simple Web Content Management System allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
Pre Real Estate Listings - Arbitrary File Upload
CVE-2008-7052—webappsphp
Unrestricted file upload vulnerability in profile.php in Pre Projects Pre Real Estate Listings allows remote authenticat
23RISK
open ↗
Referência✓ VexDay Proof
Artmedic CMS 3.4 - 'index.php' Local File Inclusion
CVE-2007-5600—webappsphp
Incomplete blacklist vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
Kensei Board 2.0.0b - Multiple SQL Injections
CVE-2009-1853—webappsphp
Multiple SQL injection vulnerabilities in index.php in Kensei Board 2.0 BETA (aka 2.0.0b) and earlier allow remote attac
23RISK
open ↗
Referência✓ VexDay Proof
creative Guestbook 1.0 - Multiple Vulnerabilities
CVE-2007-1479—webappsphp
Cross-site scripting (XSS) vulnerability in Guestbook.php in Creative Guestbook 1.0 allows remote attackers to inject ar
23RISK
open ↗
Referência✓ VexDay Proof
0irc-client 1345 build20060823 - Denial of Service
CVE-2007-1648—doswindows
0irc 1345 build 20060823 allows remote attackers to cause a denial of service (application crash) by operating an IRC se
23RISK
open ↗
← previouspage 781 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.