Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits

40,961CVEs with public exploitation

24,696lab-tested

All Referência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

VS-News-System 1.2.1 - 'newsordner' Remote File Inclusion

CVE-2007-1017—webappsphp

PHP remote file inclusion vulnerability in show_news_inc.php in VirtualSystem VS-News-System 1.2.1 and earlier allows re

23RISK

open ↗

Referência✓ VexDay Proof

PHPStore PHP Job Search Script - Arbitrary File Upload

CVE-2008-6931—webappsphp

Unrestricted file upload vulnerability in PHPStore Job Search (aka PHPCareers) allows remote authenticated users to exec

23RISK

open ↗

Referência✓ VexDay Proof

Advaced-Clan-Script 3.4 - 'mcf.php' Remote File Inclusion

CVE-2006-5061—webappsphp

PHP remote file inclusion vulnerability in mcf.php in Advanced-Clan-Script (AVCX) 3.4 and earlier allows remote attacker

23RISK

open ↗

Referência✓ VexDay Proof

mxBB Module ErrorDocs 1.0 - 'common.php' Remote File Inclusion

CVE-2006-6545—webappsphp

PHP remote file inclusion vulnerability in includes/common.php in the ErrorDocs 1.0.0 and earlier module for mxBB (mx_er

23RISK

open ↗

Referência✓ VexDay Proof

LushiWarPlaner 1.0 - 'register.php' SQL Injection

CVE-2007-0864—webappsphp

SQL injection vulnerability in register.php in LushiWarPlaner 1.0 allows remote attackers to inject arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

Beacon 0.2.0 - 'splash.lang.php' Remote File Inclusion

CVE-2007-2663—webappsphp

PHP remote file inclusion vulnerability in language/1/splash.lang.php in Beacon 0.2.0 allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

Censura 1.15.04 - 'censura.php?vendorid' SQL Injection

CVE-2007-2673—webappsphp

SQL injection vulnerability in includes/funcs_vendors.php in Censura 1.15.04, and other versions before 1.16.04, allows

23RISK

open ↗

Referência✓ VexDay Proof

Google Chrome 0.2.149.27 - 'SaveAs' Remote Buffer Overflow

CVE-2008-6994—remotewindows

Stack-based buffer overflow in the SaveAs feature (SaveFileAsWithFilter function) in win_util.cc in Google Chrome 0.2.14

28RISK

open ↗

Referência✓ VexDay Proof

A-Blog 2.0 - 'menu.php' Remote File Inclusion

CVE-2006-5092—webappsphp

PHP remote file inclusion vulnerability in navigation/menu.php in A-Blog 2 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

TutorialCMS 1.01 - Authentication Bypass

CVE-2007-2822—webappsphp

TutorialCMS 1.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication via the

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Windows Message Queuing Service - RPC Buffer Overflow (MS07-065) (1)

CVE-2007-3039—remotewindows

Stack-based buffer overflow in the Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4, Window

50RISK

open ↗

Referência✓ VexDay Proof

LightRO CMS 1.0 - 'index.php?projectid' SQL Injection

CVE-2007-0904—webappsphp

SQL injection vulnerability in projects.php in LightRO CMS 1.0 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

zKup CMS 2.0 < 2.3 - Arbitrary File Upload

CVE-2008-7123—webappsphp

Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

CodeAvalanche Articles - Database Disclosure

CVE-2008-5900—webappsasp

CodeAvalanche Articles stores sensitive information under the web root with insufficient access control, which allows re

23RISK

open ↗

Referência✓ VexDay Proof

ProjectCMS 1.0b - 'index.php?sn' SQL Injection

CVE-2009-1500—webappsphp

SQL injection vulnerability in index.php in ProjectCMS 1.0 Beta allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

sPHPell 1.01 - Multiple Remote File Inclusions

CVE-2007-3522—webappsphp

Multiple PHP remote file inclusion vulnerabilities in sPHPell 1.01 allow remote attackers to execute arbitrary PHP code

35RISK

open ↗

Referência✓ VexDay Proof

compteur 2.0 - 'param_editor.php' Remote File Inclusion

CVE-2006-5259—webappsphp

PHP remote file inclusion vulnerability in param_editor.php in Compteur 2 allows remote attackers to execute arbitrary P

23RISK

open ↗

Referência✓ VexDay Proof

Irokez Blog 0.7.1 - Multiple Remote File Inclusions

CVE-2006-6771—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Irokez CMS 0.7.1 and earlier, when register_globals is enabled, al

23RISK

open ↗

Referência✓ VexDay Proof

webSPELL 4.01.02 - 'topic' SQL Injection

CVE-2007-1163—webappsphp

SQL injection vulnerability in printview.php in webSPELL 4.01.02 and earlier allows remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

PHPMyNews 1.4 - 'cfg_include_dir' Remote File Inclusion

CVE-2006-5261—webappsphp

Multiple PHP remote file inclusion vulnerabilities in PHPMyNews 1.4 and earlier allow remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Internet Explorer 6 - 'mshtml.dll' Null Pointer Dereference

CVE-2007-0811—doswindows

Microsoft Internet Explorer 6.0 SP1 on Windows 2000, and 6.0 SP2 on Windows XP, allows remote attackers to cause a denia

28RISK

open ↗

Referência✓ VexDay Proof

b1gbb 2.24.0 - SQL Injection / Cross-Site Scripting

CVE-2007-3589—webappsphp

Multiple SQL injection vulnerabilities in b1gbb 2.24.0 allow remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência✓ VexDay Proof

Ocean12 Mailing List Manager Gold - File Disclosure / SQL Injection / Cross-Site Scripting

CVE-2008-5979—webappsphp

Cross-site scripting (XSS) vulnerability in default.asp in Ocean12 Mailing List Manager Gold allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

PHP News Reader 2.6.4 - 'phpBB.inc.php' Remote File Inclusion

CVE-2006-5284—webappsphp

PHP remote file inclusion vulnerability in auth/phpbb.inc.php in Shen Cheng-Da PHP News Reader (aka pnews) 2.6.4 and ear

23RISK

open ↗

Referência✓ VexDay Proof

EnjoySAP ActiveX kweditcontrol.kwedit.1 - Remote Stack Overflow (PoC)

CVE-2007-3605—doswindows

Stack-based buffer overflow in the kweditcontrol.kwedit.1 ActiveX control in FrontEnd\SapGui\kwedit.dll in the EnjoySAP

50RISK

open ↗

Referência✓ VexDay Proof

webcp 0.5.7 - 'filelocation' Remote File Disclosure

CVE-2008-6002—webappsphp

Absolute path traversal vulnerability in sendfile.php in web-cp 0.5.7, when register_globals is enabled, allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

phpskelsite 1.4 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting

CVE-2009-0595—webappsphp

PHP remote file inclusion vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled

35RISK

open ↗

Referência✓ VexDay Proof

EnjoySAP ActiveX kweditcontrol.kwedit.1 - Remote Stack Overflow (PoC)

CVE-2007-3607—doswindows

Multiple unspecified vulnerabilities in ActiveX controls in the EnjoySAP SAP GUI allow remote attackers to cause a denia

23RISK

open ↗

Referência✓ VexDay Proof

Open Conference Systems 1.1.4 - 'fullpath' File Inclusion

CVE-2006-5308—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Open Conference Systems (OCS) before 1.1.6 allow remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

HP Digital Imaging 'hpqvwocx.dll 2.1.0.556' - 'SaveToFile()' File Write

CVE-2007-3649—remotewindows

Absolute path traversal vulnerability in a certain ActiveX control in hpqvwocx.dll 2.1.0.556 in Hewlett-Packard (HP) Dig

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.