Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
falcon CMS 1.4.3 - Remote File Inclusion / Cross-Site Scripting
CVE-2007-6490—webappsphp
Cross-site request forgery (CSRF) vulnerability in Falcon Series One CMS 1.4.3 allows remote attackers to change a passw
23RISK
open ↗
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6495—webappsasp
inc_newuser.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to change the permis
23RISK
open ↗
Referência✓ VexDay Proof
YourFreeWorld Classifieds - 'category' SQL Injection
CVE-2008-3755—webappsphp
SQL injection vulnerability in view.php in YourFreeWorld Classifieds Script allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
March Networks DVR 3204 - Logfile Information Disclosure
CVE-2007-6638—remotehardware
March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows r
28RISK
open ↗
Referência✓ VexDay Proof
LushiNews 1.01 - 'comments.php' SQL Injection
CVE-2007-0865—webappsphp
SQL injection vulnerability in comments.php in LushiNews 1.01 and earlier allows remote authenticated users to inject ar
23RISK
open ↗
Referência✓ VexDay Proof
Acoustica Beatcraft 1.02 Build 19 - '.bcproj' Local Buffer Overflow
CVE-2008-4087—localwindows
Stack-based buffer overflow in Acoustica Beatcraft 1.02 Build 19 allows user-assisted attackers to cause a denial of ser
23RISK
open ↗
Referência✓ VexDay Proof
E-PHP CMS - 'article.php' SQL Injection
CVE-2008-4142—webappsphp
SQL injection vulnerability in article.php in E-Php CMS allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
PHP Webquest 2.6 - 'id_actividad' SQL Injection
CVE-2008-0219—webappsphp
SQL injection vulnerability in soporte_horizontal_w.php in PHP Webquest 2.6 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Aria 0.99-6 - 'page' Local File Inclusion
CVE-2008-0332—webappsphp
Directory traversal vulnerability in arias/help/effect.php in aria 0.99-6 allows remote attackers to include and execute
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke Modules Manuales 0.1 - 'cid' SQL Injection
CVE-2008-0922—webappsphp
SQL injection vulnerability in the Manuales 0.1 module for PHP-Nuke allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft DNS Server - Dynamic DNS Update/Change
CVE-2007-1644—remotewindows
The dynamic DNS update mechanism in the DNS Server service on Microsoft Windows does not properly authenticate clients i
35RISK
open ↗
Referência✓ VexDay Proof
FOSS Gallery Admin 1.0 - Arbitrary File Upload
CVE-2008-4509—webappsphp
Unrestricted file upload vulnerability in processFiles.php in FOSS Gallery Admin and FOSS Gallery Public 1.0 beta allows
23RISK
open ↗
Referência✓ VexDay Proof
FOSS Gallery Public 1.0 - Arbitrary File Upload
CVE-2008-4509—webappsphp
Unrestricted file upload vulnerability in processFiles.php in FOSS Gallery Admin and FOSS Gallery Public 1.0 beta allows
23RISK
open ↗
Referência✓ VexDay Proof
Comodo AntiVirus 2.0 - 'ExecuteStr()' Remote Command Execution
CVE-2008-0470—remotewindows
A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteS
35RISK
open ↗
Referência✓ VexDay Proof
Web Wiz Forums 9.07 - 'sub' Directory Traversal
CVE-2008-0480—webappsasp
Multiple directory traversal vulnerabilities in Web Wiz Forums 9.07 and earlier allow remote attackers to list arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin fGallery 2.4.1 - 'fimrss.php' SQL Injection
CVE-2008-0491—webappsphp
SQL injection vulnerability in fim_rss.php in the fGallery 2.4.1 plugin for WordPress allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Absolute Poll Manager XE 4.1 - 'xlacomments.asp' SQL Injection
CVE-2008-4569—webappsasp
SQL injection vulnerability in xlacomments.asp in XIGLA Software Absolute Poll Manager XE 4.1 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component 'com_akogallery' 2.5b - SQL Injection
CVE-2008-0561—webappsphp
SQL injection vulnerability in index.php in the Arthur Konze AkoGallery (com_akogallery) 2.5 beta component for Mambo an
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component Restaurant 1.0 - SQL Injection
CVE-2008-0562—webappsphp
SQL injection vulnerability in index.php in the Restaurant (com_restaurant) 1.0 component for Mambo and Joomla! allows r
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Module Calendar (Agenda) 1.5.5 - Remote File Inclusion
CVE-2007-2049—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the Calendar Module (com_calendar) 1.5.5 for Mambo allow remote at
23RISK
open ↗
Referência✓ VexDay Proof
Pilot Group eTraining - 'news_read.php' SQL Injection
CVE-2008-4709—webappsphp
SQL injection vulnerability in news_read.php in Pilot Group (PG) eTraining allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Flip 3.0 - Remote Password Hash Disclosure
CVE-2007-5063—webappsphp
Adam Scheinberg Flip 3.0 and earlier stores sensitive information under the web root with insufficient access control, w
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_slideshow - Remote File Inclusion
CVE-2007-5065—webappsphp
PHP remote file inclusion vulnerability in admin.slideshow1.php in the Flash Slide Show (com_slideshow) component for Jo
35RISK
open ↗
Referência✓ VexDay Proof
Ourgame GLWorld 2.x - 'hgs_startNotify()' ActiveX Buffer Overflow
CVE-2008-0647—remotewindows
Multiple stack-based buffer overflows in the HanGamePluginCn18.HanGamePluginCn18.1 ActiveX control in HanGamePluginCn18.
23RISK
open ↗
Referência✓ VexDay Proof
Dovecot IMAP 1.0.10 < 1.1rc2 - Remote Email Disclosure
CVE-2008-1218—remotemultiple
Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs,
23RISK
open ↗
Referência✓ VexDay Proof
Mihalism Multi Host Download - 'Username' Blind SQL Injection
CVE-2008-0714—webappsphp
SQL injection vulnerability in users.php in Mihalism Multi Host allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
Dream4 Koobi CMS 4.3.0 < 4.2.3 - 'categ' SQL Injection
CVE-2008-1336—webappsphp
SQL injection vulnerability in Koobi CMS 4.2.3 through 4.3.0 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Dream4 Koobi Pro 6.25 Showimages - 'galid' SQL Injection
CVE-2008-4778—webappsphp
SQL injection vulnerability in the gallery module in Koobi CMS 4.3.0 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Eznet 3.5.0 - Remote Stack Overflow / Denial of Service
CVE-2003-1339—remotewindows
Stack-based buffer overflow in eZnet.exe, as used in eZ (a) eZphotoshare, (b) eZmeeting, (c) eZnetwork, and (d) eZshare
35RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component custompages 1.1 - Remote File Inclusion
CVE-2008-1505—webappsphp
PHP remote file inclusion vulnerability in the SSTREAMTV custompages (com_custompages) 1.1 and earlier component for Joo
35RISK
open ↗
← previouspage 79 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.