Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
PHPSiteBackup 0.1 - 'pcltar.lib.php' Remote File Inclusion
CVE-2007-2199—webappsphp
PHP remote file inclusion vulnerability in lib/pcltar.lib.php (aka pcltar.php) in the PclTar module 1.3 and 1.3.1 for Vi
35RISK
open ↗
Referência✓ VexDay Proof
forum livre 1.0 - SQL Injection / Cross-Site Scripting
CVE-2007-0589—webappsasp
SQL injection vulnerability in Forum Livre 1.0 allows remote attackers to execute arbitrary SQL commands via the user pa
23RISK
open ↗
Referência✓ VexDay Proof
MySpace Resource Script (MSRS) 1.21 - Remote File Inclusion
CVE-2007-5721—webappsphp
PHP remote file inclusion vulnerability in _theme/breadcrumb.php in MySpacePros MySpace Resource Script (MSRS) 1.21 allo
23RISK
open ↗
Referência✓ VexDay Proof
Newxooper-PHP 0.9.1 - 'mapage.php' Remote File Inclusion
CVE-2006-6711—webappsphp
PHP remote file inclusion vulnerability in compteur/mapage.php in Newxooper 0.9.1 allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
SysInfo 1.21 - 'sysinfo.cgi' Remote Command Execution
CVE-2006-1831—webappscgi
Direct static code injection vulnerability in sysinfo.cgi in sysinfo 1.21 and possibly other versions before 2.25 allows
23RISK
open ↗
Referência✓ VexDay Proof
PHP Dir Submit - Authentication Bypass
CVE-2009-1787—webappsphp
Multiple SQL injection vulnerabilities in PHP Dir Submit (aka WebsiteSubmitter and Submitter Script) allow remote attack
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin BackUpWordPress 0.4.2b - Remote File Inclusion
CVE-2007-5800—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the BackUpWordPress 0.4.2b and earlier plugin for WordPress allow
35RISK
open ↗
Referência✓ VexDay Proof
SFS EZ HotScripts-like Site - 'cid' SQL Injection
CVE-2008-6243—webappsphp
SQL injection vulnerability in showcategory.php in Scripts For Sites (SFS) Hotscripts-like Site allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component MyContent 1.1.13 - Blind SQL Injection
CVE-2008-6430—webappsphp
SQL injection vulnerability in the MyContent (com_mycontent) component 1.1.13 for Joomla! allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
WEBBDOMAIN Webshop 1.02 - Authentication Bypass
CVE-2008-6627—webappsphp
SQL injection vulnerability in getin.php in WEBBDOMAIN WebShop 1.2, 1.1, 1.02, and earlier allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
WEBBDOMAIN Petition 1.02/2.0/3.0 - Authentication Bypass
CVE-2008-6624—webappsphp
SQL injection vulnerability in getin.php in WEBBDOMAIN Petition 1.02, 2.0, and 3.0 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
eXV2 Module MyAnnonces - 'lid' SQL Injection
CVE-2008-1406—webappsphp
SQL injection vulnerability in annonces-p-f.php in the MyAnnonces 1.8 module for eXV2 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
SapLPD 6.28 (Windows x86) - Remote Buffer Overflow
CVE-2008-0621—remotewindows_x86
Buffer overflow in SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to
60RISK
open ↗
Referência✓ VexDay Proof
XnView 1.92.1 - 'FontName' Slideshow Buffer Overflow
CVE-2008-0069—localwindows
Stack-based buffer overflow in XnView 1.92 and 1.92.1 allows user-assisted remote attackers to execute arbitrary code vi
23RISK
open ↗
Referência✓ VexDay Proof
CWB PRO 1.5 - 'INCLUDE_PATH' Remote File Inclusion
CVE-2007-1809—webappsphp
Multiple PHP remote file inclusion vulnerabilities in GraFX Company WebSite Builder (CWB) PRO 1.5 allow remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
PHP Generic library & Framework - 'INCLUDE_PATH' Remote File Inclusion
CVE-2007-0584—webappsphp
PHP remote file inclusion vulnerability in membres/membreManager.php in PhP Generic Library & Framework for comm (g-neri
45RISK
open ↗
Referência✓ VexDay Proof
UNAK-CMS 1.5 - 'dirroot' Remote File Inclusion
CVE-2006-4890—webappsphp
Multiple PHP remote file inclusion vulnerabilities in UNAK-CMS 1.5 and earlier allow remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component LMO 1.0b2 - Remote File Inclusion
CVE-2006-3970—webappsphp
PHP remote file inclusion vulnerability in lmo.php in the LMO Component (com_lmo) 1.0b2 and earlier for Joomla! allows r
23RISK
open ↗
Referência✓ VexDay Proof
tellmatic 1.0.7 - Multiple Remote File Inclusions
CVE-2007-6231—webappsphp
Multiple PHP remote file inclusion vulnerabilities in tellmatic 1.0.7 allow remote attackers to execute arbitrary PHP co
23RISK
open ↗
Referência✓ VexDay Proof
ftp Admin 0.1.0 - Local File Inclusion / Cross-Site Scripting / Authentication Bypass
CVE-2007-6232—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in FTP Admin 0.1.0 allows remote attackers to inject arbitrary web
23RISK
open ↗
Referência✓ VexDay Proof
Maran PHP Forum - 'forum_write.php' Remote Code Execution
CVE-2007-2182—webappsphp
Unrestricted file upload vulnerability in forum_write.php in Maran PHP Forum allows remote attackers to upload and execu
23RISK
open ↗
Referência✓ VexDay Proof
MatPo Link 1.2b - Blind SQL Injection / Cross-Site Scripting
CVE-2008-6606—webappsphp
SQL injection vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Alcatel OmniPCX Office 210/061.1 - Remote Command Execution
CVE-2008-1331—webappscgi
cgi-data/FastJSData.cgi in OmniPCX Office with Internet Access services OXO210 before 210/091.001, OXO600 before 610/014
23RISK
open ↗
Referência✓ VexDay Proof
McAfee E-Business Server 8.5.2 - Remote Code Execution / Denial of Service (PoC)
CVE-2008-0127—dosmultiple
The administration interface in McAfee E-Business Server 8.5.2 and earlier allows remote attackers to cause a denial of
23RISK
open ↗
Referência✓ VexDay Proof
Groupit 2.00b5 - 'c_basepath' Remote File Inclusion
CVE-2007-1472—webappsphp
Variable overwrite vulnerability in groupit/base/groupit.start.inc in Groupit 2.00b5 allows remote attackers to conduct
23RISK
open ↗
Referência✓ VexDay Proof
webSPELL 4.01.02 - 'gallery.php' Blind SQL Injection
CVE-2007-0502—webappsphp
SQL injection vulnerability in gallery.php in webSPELL 4.01.02 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Snitz Forums 2000 - 'Active.asp' SQL Injection
CVE-2007-6240—webappsasp
SQL injection vulnerability in active.asp in Snitz Forums 2000 3.4.06 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
mxbb module charts 1.0.0 - Remote File Inclusion
CVE-2006-6650—webappsphp
PHP remote file inclusion vulnerability in charts_constants.php in the Charts (mx_charts) 1.0.0 and earlier module for m
23RISK
open ↗
Referência✓ VexDay Proof
Easy Scripts Answer and Question Script - Multiple Vulnerabilities
CVE-2009-1655—webappsphp
Multiple SQL injection vulnerabilities in myaccount.php in Easy Scripts Answer and Question Script allow remote authenti
23RISK
open ↗
Referência✓ VexDay Proof
LightNEasy sqlite / no database 1.2.2 - Multiple Vulnerabilities
CVE-2008-6592—webappsphp
thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy "no database" (aka flat) and SQLite 1.2.2 and earlier, allows remo
23RISK
open ↗
← previouspage 809 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.