Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits

40,961CVEs with public exploitation

24,696lab-tested

All Referência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

Galeria Zdjec 3.0 - 'zd_numer.php' Local File Inclusion

CVE-2007-0637—webappsphp

Directory traversal vulnerability in zd_numer.php in Galeria Zdjec 3.0 and earlier allows remote attackers to include an

23RISK

open ↗

Referência✓ VexDay Proof

e-cart.biz Shopping Cart - Arbitrary File Upload

CVE-2009-1447—webappsphp

Unrestricted file upload vulnerability in admin/editor/image.php in e-cart.biz Free Shopping Cart allows remote attacker

23RISK

open ↗

Referência✓ VexDay Proof

ProgSys 0.156 - 'RR.php' Remote File Inclusion

CVE-2006-4944—webappsphp

PHP remote file inclusion vulnerability in includes/pear/Net/DNS/RR.php in ProgSys 0.151 and earlier allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

Aigaion 1.2.1 - 'DIR' Remote File Inclusion

CVE-2006-5930—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Aigaion Web based bibliography management system 1.2.1 and earlier

23RISK

open ↗

Referência✓ VexDay Proof

Site@School 2.4.02 - Arbitrary File Upload

CVE-2006-4922—webappsphp

Unrestricted file upload vulnerability in starnet/editors/htmlarea/popups/images.php in Site@School (S@S) 2.4.02 and ear

23RISK

open ↗

Referência✓ VexDay Proof

Xt-Stats 2.4.0.b3 (server_base_dir) - Remote File Inclusion

CVE-2007-0576—webappsphp

PHP remote file inclusion vulnerability in xt_counter.php in Xt-Stats 2.3.x up to 2.4.0.b3 allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component MGM 0.95r2 - Remote File Inclusion

CVE-2006-3980—webappsphp

PHP remote file inclusion vulnerability in administrator/components/com_mgm/help.mgm.php in Mambo Gallery Manager (MGM)

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component 'com_colophon' 1.2 - Remote File Inclusion

CVE-2006-3969—webappsphp

PHP remote file inclusion vulnerability in administrator/components/com_colophon/admin.colophon.php in Colophon 1.2 and

23RISK

open ↗

Referência✓ VexDay Proof

ThaiQuickCart 3 - 'sLanguage' Cookie Local File Inclusion

CVE-2008-6735—webappsphp

Directory traversal vulnerability in qc/index.php in ThaiQuickCart 3 allows remote attackers to read arbitrary files via

23RISK

open ↗

Referência✓ VexDay Proof

Keller Web Admin CMS 0.94 Pro - Local File Inclusion (2)

CVE-2008-6734—webappsphp

Directory traversal vulnerability in Public/index.php in Keller Web Admin CMS 0.94 Pro allows remote attackers to includ

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! / Mambo Component New Article 1.1 - Remote File Inclusion

CVE-2007-2089—webappsphp

Multiple PHP remote file inclusion vulnerabilities in the Jx Development Article 1.1 and earlier component for Mambo and

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component equotes 0.9.4 - SQL Injection

CVE-2008-2628—webappsphp

SQL injection vulnerability in the eQuotes (com_equotes) component 0.9.4 for Joomla! allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

DFF PHP Framework API - 'Data Feed File' Remote File Inclusion

CVE-2008-4502—webappsphp

Multiple PHP remote file inclusion vulnerabilities in DataFeedFile (DFF) PHP Framework API allow remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

Censtore 7.3.x - 'censtore.cgi' Remote Command Execution

CVE-2006-1799—webappscgi

censtore.cgi in Censtore 7.3.002 and earlier allows remote attackers to execute arbitrary commands via shell metacharact

23RISK

open ↗

Referência✓ VexDay Proof

Rama CMS 0.9.8 - 'download.php' File Disclosure

CVE-2009-1768—webappsphp

Directory traversal vulnerability in download.php in Rama Zaiten CMS 0.9.8 and earlier allows remote attackers to read a

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_bayesiannaivefilter 1.1 - Remote File Inclusion

CVE-2006-3962—webappsphp

PHP remote file inclusion vulnerability in administrator/components/com_bayesiannaivefilter/lang.php in the bayesiannaiv

23RISK

open ↗

Referência✓ VexDay Proof

PGP Desktop 9.0.6 - 'PGPwded.sys' Local Denial of Service

CVE-2008-5731—doswindows

The PGPwded device driver (aka PGPwded.sys) in PGP Corporation PGP Desktop 9.0.6 build 6060 and 9.9.0 build 397 allows l

23RISK

open ↗

Referência✓ VexDay Proof

NoAh 0.9 pre 1.2 - 'filepath' Remote File Disclosure

CVE-2007-6187—webappsphp

Multiple directory traversal vulnerabilities in PHP Content Architect (aka NoAh) 0.9 pre 1.2 and earlier allow remote at

23RISK

open ↗

Referência✓ VexDay Proof

MyBlog: PHP and MySQL Blog/CMS software - Remote File Inclusion

CVE-2007-1968—webappsphp

PHP remote file inclusion vulnerability in games.php in Sam Crew MyBlog, possibly 1.0 through 1.6, allows remote attacke

23RISK

open ↗

Referência✓ VexDay Proof

I-Pos Internet Pay Online Store 1.3 Beta - SQL Injection

CVE-2008-2634—webappsasp

SQL injection vulnerability in index.asp in I-Pos Internet Pay Online Store 1.3 Beta and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

asiCMS alpha 0.208 - Multiple Remote File Inclusions

CVE-2008-4529—webappsphp

Multiple PHP remote file inclusion vulnerabilities in asiCMS alpha 0.208 allow remote attackers to execute arbitrary PHP

23RISK

open ↗

Referência✓ VexDay Proof

Hacks List phpBB Mod 1.21 - SQL Injection

CVE-2006-6216—webappsphp

SQL injection vulnerability in admin_hacks_list.php in the Nivisec Hacks List 1.21 and earlier phpBB module allows remot

23RISK

open ↗

Referência✓ VexDay Proof

MyKtools 2.4 - Arbitrary Database Backup

CVE-2008-6815—webappsphp

mykdownload.php in MyKtools 2.4 does not require administrative authentication, which allows remote attackers to read a

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Windows - '.hlp' Local HEAP Overflow (PoC)

CVE-2007-1912—doswindows

Heap-based buffer overflow in Microsoft Windows allows user-assisted remote attackers to have an unknown impact via a cr

28RISK

open ↗

Referência✓ VexDay Proof

RoomPHPlanning 1.5 - 'idresa' SQL Injection

CVE-2008-6633—webappsphp

SQL injection vulnerability in RoomPHPlanning 1.5 allows remote attackers to execute arbitrary SQL commands via the idre

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component com_flyspray < 1.0.1 - Remote File Disclosure

CVE-2006-6203—webappsphp

Directory traversal vulnerability in startdown.php in the Flyspray ME 1.0.1 (com_flyspray) component for Mambo allows re

23RISK

open ↗

Referência✓ VexDay Proof

Minerva 2.0.21 build 238a - 'phpbb_root_path' File Inclusion

CVE-2006-5077—webappsphp

PHP remote file inclusion vulnerability in admin/admin_topic_action_logging.php in Chris Smith Minerva Build 238 and ear

23RISK

open ↗

Referência✓ VexDay Proof

Free Image Hosting 2.0 - 'AD_BODY_TEMP' Remote File Inclusion

CVE-2007-1715—webappsphp

PHP remote file inclusion vulnerability in frontpage.php in Free Image Hosting 2.0 and earlier allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

Techno Dreams FAQ Manager 1.0 - SQL Injection

CVE-2006-4892—webappsasp

SQL injection vulnerability in faqview.asp in Techno Dreams FAQ Manager Package 1.0 allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

AJ Auction Pro - 'subcat.php' SQL Injection

CVE-2007-1298—webappsphp

SQL injection vulnerability in subcat.php in AJ Auction 1.0 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.