Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits

40,961CVEs with public exploitation

24,696lab-tested

All Referência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

AssetMan 2.4a - 'download_pdf.php' Remote File Disclosure

CVE-2007-1427—webappsphp

Directory traversal vulnerability in download_pdf.php in AssetMan 2.4a and earlier allows remote attackers to read arbit

23RISK

open ↗

Referência✓ VexDay Proof

CyBoards PHP Lite 1.21 - 'script_path' Remote File Inclusion

CVE-2007-1983—webappsphp

PHP remote file inclusion vulnerability in include/default_header.php in Cyboards PHP Lite 1.21 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Sisplet CMS 05.10 - 'site_path' Remote File Inclusion

CVE-2007-2347—webappsphp

PHP remote file inclusion vulnerability in main/forum/komentar.php in OneClick CMS (aka Sisplet CMS) 05.10 and earlier a

23RISK

open ↗

Referência✓ VexDay Proof

6ALBlog - 'newsid' SQL Injection

CVE-2007-3451—webappsphp

PHP remote file inclusion vulnerability in admin/index.php in 6ALBlog allows remote authenticated administrators to exec

23RISK

open ↗

Referência✓ VexDay Proof

XOOPS 2.0.18 - Local File Inclusion / URL Redirecting

CVE-2008-0612—webappsphp

Directory traversal vulnerability in htdocs/install/index.php in XOOPS 2.0.18 allows remote attackers to include and exe

23RISK

open ↗

Referência✓ VexDay Proof

Web Slider 0.6 - Insecure Cookie/Authentication Handling

CVE-2008-2298—webappsphp

Admin.php in Web Slider 0.6 allows remote attackers to bypass authentication and gain privileges by setting the admin co

23RISK

open ↗

Referência✓ VexDay Proof

txtSQL 2.2 Final - 'startup.php' Remote File Inclusion

CVE-2008-3595—webappsphp

PHP remote file inclusion vulnerability in examples/txtSQLAdmin/startup.php in txtSQL 2.2 Final allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

WinFTP Server 2.0.2 - 'PASV' Remote Denial of Service

CVE-2006-6673—doswindows

WinFtp Server 2.0.2 allows remote attackers to cause a denial of service (crash) via long (1) PASV, (2) LIST, (3) USER,

23RISK

open ↗

Referência✓ VexDay Proof

Quick 'n Easy Mail Server 3.3 (Demo) - Remote Denial of Service (PoC)

CVE-2009-1602—doswindows

Pablo Software Solutions Quick 'n Easy Mail Server 3.3 allows remote attackers to cause a denial of service (daemon outa

23RISK

open ↗

Referência✓ VexDay Proof

TLM CMS 1.1 - 'i-accueil.php?chemin' Remote File Inclusion

CVE-2007-0300—webappsphp

PHP remote file inclusion vulnerability in i-accueil.php in TLM CMS 1.1 and earlier allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

creative Guestbook 1.0 - Multiple Vulnerabilities

CVE-2007-1479—webappsphp

Cross-site scripting (XSS) vulnerability in Guestbook.php in Creative Guestbook 1.0 allows remote attackers to inject ar

23RISK

open ↗

Referência✓ VexDay Proof

MiniWeb HTTP Server 0.8.x - Remote Denial of Service

CVE-2007-3159—doswindows

http.c in MiniWeb Http Server 0.8.x allows remote attackers to cause a denial of service (application crash) via a negat

23RISK

open ↗

Referência✓ VexDay Proof

Picturesolution 2.1 - 'config.php?path' Remote File Inclusion

CVE-2007-5313—webappsphp

PHP remote file inclusion vulnerability in install/config.php in Picturesolution 2.1 and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

kontakt formular 1.4 - Remote File Inclusion

CVE-2007-6655—webappsphp

PHP remote file inclusion vulnerability in includes/function.php in Kontakt Formular 1.4 allows remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

ibase 2.03 - Remote File Disclosure

CVE-2008-6288—webappsphp

Directory traversal vulnerability in download.php in Interface Medien ibase 2.03 and earlier allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

Avant Browser 11.0 build 26 - Remote Stack Overflow Crash

CVE-2007-1501—doswindows

Stack-based buffer overflow in Avant Browser 11.0 build 26 allows remote attackers to cause a denial of service (crash)

23RISK

open ↗

Referência✓ VexDay Proof

PowerBook 1.21 - 'index.php' Local File Inclusion

CVE-2008-1537—webappsphp

Directory traversal vulnerability in pb_inc/admincenter/index.php in PowerScripts PowerBook 1.21 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Multi-Page Comment System 1.1.0 - Insecure Cookie Handling

CVE-2008-2293—webappsphp

admin.php in Multi-Page Comment System (MPCS) 1.0 and 1.1 allows remote attackers to bypass authentication and gain priv

23RISK

open ↗

Referência✓ VexDay Proof

Galatolo Web Manager 1.0 - SQL Injection

CVE-2008-2700—webappsphp

SQL injection vulnerability in view.php in Galatolo WebManager 1.0 and earlier allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

RX Maxsoft - 'fotoID' SQL Injection

CVE-2008-4912—webappsphp

SQL injection vulnerability in popup_img.php in the fotogalerie module in RS MAXSOFT allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

AvailScript Jobs Portal Script - (Authenticated) Arbitrary File Upload

CVE-2008-7021—webappsphp

Unrestricted file upload vulnerability in editlogo.php in AvailScript Jobs Portal Script allows remote authenticated use

23RISK

open ↗

Referência✓ VexDay Proof

PowerNews 2.5.4 - 'newsid' SQL Injection

CVE-2009-0705—webappsphp

SQL injection vulnerability in news.php in PowerScripts PowerNews 2.5.4, when magic_quotes_gpc is disabled, allows remot

23RISK

open ↗

Referência✓ VexDay Proof

Simple HTTPd 1.38 - Multiple Vulnerabilities

CVE-2007-6404—remotewindows

Directory traversal vulnerability in Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

WordPress Plugin WP-Cal 0.3 - 'editevent.php' SQL Injection

CVE-2008-0490—webappsphp

SQL injection vulnerability in functions/editevent.php in the WP-Cal 0.3 plugin for WordPress allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

Popcorn 1.87 - Remote Heap Overflow (PoC)

CVE-2009-1647—doswindows

Heap-based buffer overflow in popcorn.exe in Ultrafunk Popcorn 1.87 allows remote POP3 servers to cause a denial of serv

23RISK

open ↗

Referência✓ VexDay Proof

WordPress Plugin Download - 'dl_id' SQL Injection

CVE-2008-1646—webappsphp

SQL injection vulnerability in wp-download.php in the WP-Download 1.2 plugin for WordPress allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

HomePH Design 2.10 RC2 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting

CVE-2008-2981—webappsphp

PHP remote file inclusion vulnerability in admin/templates/template_thumbnail.php in HomePH Design 2.10 RC2, when regist

23RISK

open ↗

Referência✓ VexDay Proof

MyForum 1.3 - Insecure Cookie Handling

CVE-2008-5040—webappsphp

Graphiks MyForum 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the (1)

23RISK

open ↗

Referência✓ VexDay Proof

Yaws < 1.80 - Multiple Headers Remote Denial of Service Vulnerabilities

CVE-2009-0751—dosmultiple

Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with

28RISK

open ↗

Referência✓ VexDay Proof

JShop 1.x < 2.x - 'xPage' Local File Inclusion

CVE-2008-1624—webappsphp

Directory traversal vulnerability in v2demo/page.php in Jshop Server 1.x through 2.x allows remote attackers to include

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.