Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
PHP-Agenda 2.2.4 - 'index.php' Local File Inclusion
CVE-2008-3031—webappsphp
Directory traversal vulnerability in index.php in Simple PHP Agenda 2.2.4 and earlier allows remote attackers to include
23RISK
open ↗
Referência✓ VexDay Proof
Catviz 0.4.0 beta1 - Multiple SQL Injections
CVE-2008-3129—webappsphp
Multiple SQL injection vulnerabilities in index.php in Catviz 0.4 beta 1 allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
pSys 0.7.0 Alpha - 'chatbox.php' SQL Injection
CVE-2008-3131—webappsphp
SQL injection vulnerability in chatbox.php in pSys 0.7.0 Alpha, when magic_quotes_gpc is disabled, allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
Triton CMS Pro 1.06 - 'x-forwarded-for' Blind SQL Injection
CVE-2008-3153—webappsphp
SQL injection vulnerability in Triton CMS Pro allows remote attackers to execute arbitrary SQL commands via the X-Forwar
23RISK
open ↗
Referência✓ VexDay Proof
CMS WebBlizzard - 'index.php' Blind SQL Injection
CVE-2008-3154—webappsphp
SQL injection vulnerability in index.php in WebBlizzard CMS allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
Panda Security ActiveScan 2.0 (Update) - Remote Buffer Overflow
CVE-2008-3155—remotewindows
Stack-based buffer overflow in the ActiveX control (as2guiie.dll) in Panda ActiveScan before 1.02.00 allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
Panda Security ActiveScan 2.0 (Update) - Remote Buffer Overflow
CVE-2008-3156—remotewindows
The ActiveScan ActiveX Control (as2guiie.dll) in Panda ActiveScan before 1.02.00 allows remote attackers to download and
23RISK
open ↗
Referência✓ VexDay Proof
Boonex Dolphin 6.1.2 - Multiple Remote File Inclusions
CVE-2008-3167—webappsphp
Multiple PHP remote file inclusion vulnerabilities in BoonEx Dolphin 6.1.2, when register_globals is enabled, allow remo
23RISK
open ↗
Referência✓ VexDay Proof
CodeDB 1.1.1 - 'list.php' Local File Inclusion
CVE-2008-3190—webappsphp
Directory traversal vulnerability in list.php in 1Scripts CodeDB 1.1.1 allows remote attackers to include and execute ar
23RISK
open ↗
Referência✓ VexDay Proof
jsite 1.0 oe - SQL Injection / Local File Inclusion
CVE-2008-3193—webappsphp
SQL injection vulnerability in jSite 1.0 OE allows remote attackers to execute arbitrary SQL commands via the page param
23RISK
open ↗
Referência✓ VexDay Proof
Avlc Forum - 'vlc_forum.php' SQL Injection
CVE-2008-3200—webappsphp
SQL injection vulnerability in vlc_forum.php in Avlc Forum as of 20080715 allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
my-gesuad 0.9.14 - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2009-1812—webappsphp
Multiple SQL injection vulnerabilities in myGesuad 0.9.14 (aka 0.9) allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
Pragyan CMS 2.6.2 - 'sourceFolder' Remote File Inclusion
CVE-2008-3207—webappsphp
PHP remote file inclusion vulnerability in cms/modules/form.lib.php in Pragyan CMS 2.6.2, when register_globals is enabl
23RISK
open ↗
Referência✓ VexDay Proof
Maian Guestbook 3.2 - Insecure Cookie Handling
CVE-2008-3320—webappsphp
admin/index.php in Maian Guestbook 3.2 and earlier allows remote attackers to bypass authentication and gain administrat
23RISK
open ↗
Referência✓ VexDay Proof
Maian Recipe 1.2 - Insecure Cookie Handling
CVE-2008-3322—webappsphp
admin/index.php in Maian Recipe 1.2 and earlier allows remote attackers to bypass authentication and gain administrative
23RISK
open ↗
Referência✓ VexDay Proof
Atom Photoblog 1.1.5b1 - 'photoId' SQL Injection
CVE-2008-3351—webappsphp
SQL injection vulnerability in atomPhotoBlog.php in Atom PhotoBlog 1.0.9.1 and 1.1.5b1 allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
Live Music Plus 1.1.0 - 'id' SQL Injection
CVE-2008-3352—webappsphp
SQL injection vulnerability in index.php in Live Music Plus 1.1.0 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
Dokeos E-Learning System 1.8.5 - Local File Inclusion
CVE-2008-3363—webappsphp
Directory traversal vulnerability in user_portal.php in the Dokeos E-Learning System 1.8.5 on Windows allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
ATutor 1.6.1-pl1 - 'import.php' Remote File Inclusion
CVE-2008-3368—webappsphp
PHP remote file inclusion vulnerability in tools/packages/import.php in ATutor 1.6.1 pl1 and earlier allows remote authe
23RISK
open ↗
Referência✓ VexDay Proof
XRms 1.99.2 - Remote File Inclusion / Cross-Site Scripting / Information Gathering
CVE-2008-3400—webappsphp
XRMS CRM 1.99.2 allows remote attackers to obtain configuration information via a direct request to tests/info.php, whic
23RISK
open ↗
Referência✓ VexDay Proof
FipsCMS Light 2.1 - 'r' SQL Injection
CVE-2008-3417—webappsasp
SQL injection vulnerability in home/index.asp in fipsCMS light 2.1 and earlier allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
eNdonesia 8.4 (Calendar Module) - SQL Injection
CVE-2008-3452—webappsphp
SQL injection vulnerability in the Calendar module in eNdonesia 8.4 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
Coppermine Photo Gallery 1.4.18 - Local File Inclusion / Remote Code Execution
CVE-2008-3486—webappsphp
Directory traversal vulnerability in the user_get_profile function in include/functions.inc.php in Coppermine Photo Gall
23RISK
open ↗
Referência✓ VexDay Proof
MyPHP CMS 0.3.1 - 'pid' SQL Injection
CVE-2008-3497—webappsphp
SQL injection vulnerability in pages.php in MyPHP CMS 0.3.1 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
AJchat 0.10 - 'unse' SQL Injection
CVE-2008-7210—webappsphp
directory.php in AJchat 0.10 allows remote attackers to bypass input validation and conduct SQL injection attacks via a
23RISK
open ↗
Referência✓ VexDay Proof
MaxCMS 2.0 - '/inc/ajax.asp' SQL Injection
CVE-2009-1764—webappsasp
SQL injection vulnerability in inc/ajax.asp in MaxCMS 2.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
phsBlog 0.1.1 - Multiple SQL Injections
CVE-2008-3588—webappsphp
Multiple SQL injection vulnerabilities in phsBlog 0.1.1 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência✓ VexDay Proof
Symphony 1.7.01 (non-patched) - Remote Code Execution
CVE-2008-3591—webappsphp
SQL injection vulnerability in lib/class.admin.php in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Ring Webring System 0.9.1 - Insecure Cookie Handling
CVE-2008-3602—webappsphp
admin/wr_admin.php in PHP-Ring Webring System (aka uPHP_ring_website) 0.9.1 allows remote attackers to bypass authentica
23RISK
open ↗
Referência✓ VexDay Proof
DELTAScripts PHP Classifieds 7.5 - Authentication Bypass
CVE-2008-5806—webappsphp
SQL injection vulnerability in login.php in DeltaScripts PHP Classifieds 7.5 and earlier allows remote attackers to exec
23RISK
open ↗
← previouspage 810 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.