Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits

40,961CVEs with public exploitation

24,696lab-tested

All Referência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

CMSbright - 'id_rub_page' SQL Injection

CVE-2008-6991—webappsphp

SQL injection vulnerability in public/page.php in Websens CMSbright allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

Power Editor 2.0 - Remote File Disclosure / Edit

CVE-2008-2115—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in editor.php in ScriptsEZ.net Power Editor 2.0 allow remote attacke

23RISK

open ↗

Referência✓ VexDay Proof

CMS Ortus 1.13 - SQL Injection

CVE-2008-6282—webappsphp

SQL injection vulnerability in engine/users/users_edit_pub.inc in CMS Ortus 1.13 and earlier allows remote authenticated

23RISK

open ↗

Referência✓ VexDay Proof

PostcardMentor - 'cat_fldAuto' SQL Injection

CVE-2008-2132—webappsasp

SQL injection vulnerability in step1.asp in Systementor PostcardMentor allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

SmartBlog 1.3 - 'index.php' SQL Injection

CVE-2008-2183—webappsphp

SQL injection vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Miniweb 2.0 - 'historymonth' SQL Injection

CVE-2008-2197—webappsphp

SQL injection vulnerability in the blogwriter module 2.0 for Miniweb allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

Relative Real Estate Systems 3.0 - 'listing_id' SQL Injection

CVE-2008-2881—webappsphp

Relative Real Estate Systems 3.0 and earlier stores passwords in cleartext in a MySQL database, which allows context-dep

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Windows - InternalOpenColorProfile Heap Overflow (PoC) (MS08-046)

CVE-2008-2245—doswindows

Heap-based buffer overflow in the InternalOpenColorProfile function in mscms.dll in Microsoft Windows Image Color Manage

35RISK

open ↗

Referência✓ VexDay Proof

Phoenix View CMS Pre Alpha2 - SQL Injection / Local File Inclusion / Cross-Site Scripting

CVE-2008-2534—webappsphp

Directory traversal vulnerability in admin/admin_frame.php in Phoenix View CMS Pre Alpha2 and earlier allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

Advanced Image Hosting (AIH) 2.1 - SQL Injection

CVE-2008-2536—webappsphp

SQL injection vulnerability in out.php in YABSoft Advanced Image Hosting (AIH) Script 2.1 and earlier allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Jotloader 1.2.1.a - Blind SQL Injection

CVE-2008-2564—webappsphp

SQL injection vulnerability in the JotLoader (com_jotloader) component 1.2.1.a and earlier for Joomla! allows remote att

23RISK

open ↗

Referência✓ VexDay Proof

PHP-Address Book 3.1.5 - SQL Injection / Cross-Site Scripting

CVE-2008-2566—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to inje

23RISK

open ↗

Referência✓ VexDay Proof

freeSSHd 1.2.1 - (Authenticated) Remote Overflow (SEH)

CVE-2008-2573—remotewindows

Stack-based buffer overflow in SFTP in freeSSHd 1.2.1 allows remote authenticated users to execute arbitrary code via a

23RISK

open ↗

Referência✓ VexDay Proof

phpFaber URLInn 2.0.5 - 'dir_ws' Remote File Inclusion

CVE-2007-5754—webappsphp

PHP remote file inclusion vulnerability in urlinn_includes/config.php in phpFaber URLInn 2.0.5 allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

lustig.cms Beta 2.5 - 'forum.php?view' Remote File Inclusion

CVE-2007-5138—webappsphp

PHP remote file inclusion vulnerability in forum/forum.php in lustig.cms BETA 2.5 allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

mebiblio 0.4.7 - SQL Injection / Arbitrary File Upload / Cross-Site Scripting

CVE-2008-2647—webappsphp

SQL injection vulnerability in admin/journal_change_mask.inc.php in meBiblio 0.4.7 allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

Flux CMS 1.5.0 - 'loadsave.php' Arbitrary File Overwrite

CVE-2008-2686—webappsphp

webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overw

23RISK

open ↗

Referência✓ VexDay Proof

Black Ice Software Inc Barcode SDK - 'BITiff.ocx' Remote Buffer Overflow (1)

CVE-2008-2693—remotewindows

Stack-based buffer overflow in the BITIFF.BITiffCtrl.1 ActiveX control in BITiff.ocx 10.9.3.0 in Black Ice Barcode SDK 5

28RISK

open ↗

Referência✓ VexDay Proof

Black Ice Software Annotation Plugin - 'BiAnno.ocx' Remote Buffer Overflow

CVE-2008-2745—remotewindows

Stack-based buffer overflow in BiAnno ActiveX Control (BiAnno.ocx) in Black Ice Software Annotation Plugin 10.95 allows

28RISK

open ↗

Referência✓ VexDay Proof

Vivvo CMS 3.4 - 'index.php' Blind SQL Injection

CVE-2007-3939—webappsphp

SQL injection vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) CMS 3.4 and earlie

23RISK

open ↗

Referência✓ VexDay Proof

SHOUTcast Admin Panel 2.0 - 'page' Local File Inclusion

CVE-2008-2813—webappsphp

Directory traversal vulnerability in index.php in WallCity-Server Shoutcast Admin Panel 2.0, when magic_quotes_gpc is di

23RISK

open ↗

Referência✓ VexDay Proof

F3Site 2.1 - Remote Code Execution

CVE-2007-0764—webappsphp

Unrestricted file upload vulnerability in F3Site 2.1 and earlier allows remote authenticated administrators to upload an

23RISK

open ↗

Referência✓ VexDay Proof

Easy-Clanpage 3.0b1 - 'section' Local File Inclusion

CVE-2008-2818—webappsphp

Directory traversal vulnerability in Easy-Clanpage 3.0 b1 allows remote attackers to include and execute arbitrary local

23RISK

open ↗

Referência✓ VexDay Proof

3editor CMS 0.42 - 'index.php' Local File Inclusion

CVE-2006-6877—webappsphp

Directory traversal vulnerability in index.php in Matteo Lucarelli 3editor CMS 0.42 and earlier, when register_globals i

23RISK

open ↗

Referência✓ VexDay Proof

eLineStudio Site Composer (ESC) 2.6 - Multiple Vulnerabilities

CVE-2008-2864—webappsphp

eLineStudio Site Composer (ESC) 2.6 and earlier allows remote attackers to obtain sensitive information via a direct req

23RISK

open ↗

Referência✓ VexDay Proof

E-topbiz ViralDX 2.07 - 'bannerid' SQL Injection

CVE-2008-2867—webappsphp

SQL injection vulnerability in adclick.php in E-topbiz Viral DX 1 2.07 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Jokes & Funny Pics Script - 'sb_jokeid' SQL Injection

CVE-2008-2874—webappsphp

SQL injection vulnerability in index.php in Softbiz Jokes & Funny Pics Script allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

FubarForum 1.5 - 'index.php' Local File Inclusion

CVE-2008-2887—webappsphp

Directory traversal vulnerability in index.php in chaozz@work FubarForum 1.5 allows remote attackers to include and exec

23RISK

open ↗

Referência✓ VexDay Proof

Online Fantasy Football League (OFFL) 0.2.6 - 'teams.php' SQL Injection

CVE-2008-2890—webappsphp

Multiple SQL injection vulnerabilities in Online Fantasy Football League (OFFL) 0.2.6 and earlier allow remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

emuCMS 0.3 - 'cat_id' SQL Injection

CVE-2008-2891—webappsphp

SQL injection vulnerability in index.php in eMuSOFT emuCMS 0.3 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.