Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits

40,961CVEs with public exploitation

24,696lab-tested

All Referência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

Fuju News 1.0 - Authentication Bypass / SQL Injection

CVE-2006-1837—webappsphp

SQL injection vulnerability in archiv2.php in Fuju News 1.0 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

Fuju News 1.0 - Authentication Bypass / SQL Injection

CVE-2006-1838—webappsphp

edit_kategorie.php in Fuju News 1.0 allows remote attackers to bypass authentication by setting the authorized cookie.

23RISK

open ↗

Referência✓ VexDay Proof

Download-Engine 1.4.2 - 'spaw' Remote File Inclusion

CVE-2006-5291—webappsphp

PHP remote file inclusion vulnerability in admin/includes/spaw/spaw_control.class.php in Download-Engine 1.4.2 allows re

23RISK

open ↗

Referência✓ VexDay Proof

Vlbook 1.21 - Cross-Site Scripting / Local File Inclusion

CVE-2008-2072—webappsphp

Cross-site scripting (XSS) vulnerability in index.php in Virtual Design Studio vlbook 1.21 allows remote attackers to in

23RISK

open ↗

Referência✓ VexDay Proof

Blackorpheus ClanMemberSkript 1.0 - SQL Injection

CVE-2006-1917—webappsphp

SQL injection vulnerability in member.php in Blackorpheus ClanMemberSkript 1.0 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

DivX Player 6.7 - '.srt' File Subtitle Parsing Buffer Overflow

CVE-2008-1912—localwindows

Stack-based buffer overflow in DivX Player 6.7 build 6.7.0.22 and earlier allows user-assisted remote attackers to cause

28RISK

open ↗

Referência✓ VexDay Proof

Vlog System 1.1 - SQL Injection

CVE-2008-6111—webappsphp

SQL injection vulnerability in blog.php in NetArt Media Vlog System 1.1 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Cdsagenda 4.2.9 - 'SendAlertEmail.php' File Inclusion

CVE-2006-5384—webappsphp

PHP remote file inclusion vulnerability in modification/SendAlertEmail.php in CDS Software Consortium CDS Agenda 4.2.9 a

23RISK

open ↗

Referência✓ VexDay Proof

BXCP 0.3.0.4 - 'where' SQL Injection

CVE-2006-3394—webappsphp

SQL injection vulnerability in the files mod in index.php in BXCP 0.3.0.4 allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Module galleria 1.0b - Remote File Inclusion

CVE-2006-3396—webappsphp

PHP remote file inclusion vulnerability in galleria.html.php in Galleria Mambo Module 1.0 and earlier for Mambo allows r

23RISK

open ↗

Referência✓ VexDay Proof

WonderEdit Pro CMS (template_path) - Remote File Inclusion

CVE-2006-3422—webappsphp

PHP remote file inclusion vulnerability in WonderEdit Pro CMS allows remote attackers to execute arbitrary PHP code via

23RISK

open ↗

Referência✓ VexDay Proof

Borland Interbase 2007 - 'ibserver.exe' Buffer Overflow (PoC)

CVE-2008-1910—doswindows

Stack-based buffer overflow in the database service (ibserver.exe) in Borland InterBase 2007 SP2 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

IP Reg 0.4 - Multiple SQL Injections

CVE-2008-4606—webappsphp

Multiple SQL injection vulnerabilities in IP Reg 0.4 and earlier allow remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

KnowledgeQuest 2.6 - SQL Injection

CVE-2008-1726—webappsphp

Multiple SQL injection vulnerabilities in KnowledgeQuest 2.6, when magic_quotes_gpc is disabled, allow remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Eurologon CMS - 'files.php' Arbitrary File Download

CVE-2007-6185—webappsphp

Directory traversal vulnerability in users/files.php in Eurologon CMS allows remote attackers to read arbitrary files vi

23RISK

open ↗

Referência✓ VexDay Proof

Links Directory 1.1 - 'cat_id' SQL Injection

CVE-2008-1871—webappsphp

SQL injection vulnerability in links.php in Scriptsagent.com Links Directory 1.1 allows remote authenticated users to ex

23RISK

open ↗

Referência✓ VexDay Proof

PHP 5.2.1 with PECL PHPDOC - Local Buffer Overflow

CVE-2007-1709—localwindows

Buffer overflow in the confirm_phpdoc_compiled function in the phpDOC extension (PECL phpDOC) in PHP 5.2.1 allows contex

23RISK

open ↗

Referência✓ VexDay Proof

MyBulletinBoard (MyBB) 1.2.11 - 'private.php' SQL Injection (1)

CVE-2008-0787—webappsphp

SQL injection vulnerability in inc/datahandlers/pm.php in MyBB before 1.2.12 allows remote authenticated users to execut

23RISK

open ↗

Referência✓ VexDay Proof

Quick Poll Script - 'id' SQL Injection

CVE-2008-3765—webappsphp

SQL injection vulnerability in code.php in Quick Poll Script allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência✓ VexDay Proof

FlashGet 1.9 - 'FTP PWD Response' Remote Buffer Overflow (PoC)

CVE-2008-4321—doswindows

Buffer overflow in FlashGet (formerly JetCar) FTP 1.9 allows remote FTP servers to execute arbitrary code via a long res

23RISK

open ↗

Referência✓ VexDay Proof

easyTrade 2.x - 'id' SQL Injection

CVE-2008-2790—webappsphp

SQL injection vulnerability in detail.php in MountainGrafix easyTrade 2.x allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

vShare YouTube Clone 2.6 - 'tid' SQL Injection

CVE-2008-2223—webappsphp

SQL injection vulnerability in group_posts.php in vShare YouTube Clone 2.6 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component pc_cookbook 0.3 - Remote File Inclusion

CVE-2006-3530—webappsphp

PHP remote file inclusion vulnerability in com_pccookbook/pccookbook.php in the PccookBook Component for Mambo and Jooml

23RISK

open ↗

Referência✓ VexDay Proof

PAPOO 3_RC3 - SQL Injection / Admin Credentials Disclosure

CVE-2006-3572—webappsphp

SQL injection vulnerability in forumthread.php in Papoo 3 RC3 and earlier allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

ASP Stats Generator 2.1.1 - SQL Injection

CVE-2006-3580—webappsasp

SQL injection vulnerability in pages.asp in ASP Stats Generator before 2.1.2 allows remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

5th Avenue Shopping Cart - 'category_id' SQL Injection

CVE-2008-1921—webappsphp

SQL injection vulnerability in store_pages/category_list.php in 5th Avenue Shopping Cart 1.2 trial edition allows remote

23RISK

open ↗

Referência✓ VexDay Proof

Zune Software - ActiveX Arbitrary File Overwrite

CVE-2008-1933—remotewindows

Absolute path traversal vulnerability in a certain ActiveX control in Zune allows user-assisted remote attackers to over

28RISK

open ↗

Referência✓ VexDay Proof

osTicket 1.12 - Persistent Cross-Site Scripting

CVE-2019-14750—webappsphp

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It w

43RISK

open ↗

Referência✓ VexDay Proof

Plogger 3.0 - SQL Injection

CVE-2008-3563—webappsphp

Multiple SQL injection vulnerabilities in Plogger 3.0 and earlier allow remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

Winlpd 1.2 Build 1076 - Remote Buffer Overflow

CVE-2006-3670—remotewindows

Stack-based buffer overflow in Winlpd 1.26 allows remote attackers to execute arbitrary code via a long string in a requ

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.