Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits

40,961CVEs with public exploitation

24,696lab-tested

All Referência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

Nitro Web Gallery 1.4.3 - 'section' SQL Injection

CVE-2008-2817—webappsphp

SQL injection vulnerability in albums.php in NiTrO Web Gallery 1.4.3 and earlier allows remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

Travelsized CMS 0.4 - 'FrontPage.php' Remote File Inclusion

CVE-2006-5182—webappsphp

PHP remote file inclusion vulnerability in frontpage.php in Dan Jensen Travelsized CMS 0.4 and earlier allows remote att

23RISK

open ↗

Referência✓ VexDay Proof

Bloo 1.00 - Multiple SQL Injections

CVE-2008-1313—webappsphp

Multiple SQL injection vulnerabilities in index.php in Bloo 1.00 and earlier allow remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Affiliate Market 0.1 Beta - Cross-Site Scripting / SQL Injection

CVE-2008-1177—webappsphp

SQL injection vulnerability in shop/detail.php in Affiliate Market (affmarket) 0.1 BETA allows remote attackers to execu

23RISK

open ↗

Referência✓ VexDay Proof

Affiliate Market 0.1 Beta - Cross-Site Scripting / SQL Injection

CVE-2008-1176—webappsphp

Cross-site scripting (XSS) vulnerability in function/sideblock.php in Affiliate Market (affmarket) 0.1 BETA allows remot

23RISK

open ↗

Referência✓ VexDay Proof

Creative Software AutoUpdate Engine - ActiveX Stack Overflow

CVE-2008-0955—remotewindows

Stack-based buffer overflow in the Creative Software AutoUpdate Engine ActiveX control in CTSUEng.ocx allows remote atta

50RISK

open ↗

Referência✓ VexDay Proof

MultiCart 2.0 - 'productdetails.php' SQL Injection

CVE-2008-0911—webappsphp

SQL injection vulnerability in productdetails.php in iScripts MultiCart 2.0 allows remote authenticated users to execute

23RISK

open ↗

Referência✓ VexDay Proof

PHP-Nuke Module Inhalt - 'cid' SQL Injection

CVE-2008-0907—webappsphp

SQL injection vulnerability in the Inhalt module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

PHP Live! 3.2.2 - 'questid' SQL Injection (1)

CVE-2008-0821—webappsphp

SQL injection vulnerability in admin/traffic/knowledge_searchm.php in OSI Codes Inc. PHP Live! 3.2.2 allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

CoolPlayer 2.19 - '.Skin' Local Buffer Overflow

CVE-2008-5735—localwindows

Stack-based buffer overflow in skin.c in CoolPlayer 2.17 through 2.19 allows remote attackers to execute arbitrary code

23RISK

open ↗

Referência✓ VexDay Proof

AuraCMS 1.62 - Multiple SQL Injections

CVE-2008-0811—webappsphp

Multiple SQL injection vulnerabilities in AuraCMS 1.62 allow remote attackers to execute arbitrary SQL commands via (1)

23RISK

open ↗

Referência✓ VexDay Proof

LookStrike Lan Manager 0.9 - Local/Remote File Inclusion

CVE-2008-0803—webappsphp

Multiple PHP remote file inclusion vulnerabilities in LookStrike Lan Manager 0.9 allow remote attackers to execute arbit

35RISK

open ↗

Referência✓ VexDay Proof

HP Compaq Notebooks - ActiveX Remote Code Execution

CVE-2007-6333—remotewindows

The HPInfoDLL.HPInfo.1 ActiveX control in HPInfoDLL.dll 1.0, as shipped with HP Info Center (hpinfocenter.exe) 1.0.1.1 i

23RISK

open ↗

Referência✓ VexDay Proof

PozScripts Classified Ads Script - 'cid' SQL Injection

CVE-2008-3673—webappsphp

SQL injection vulnerability in browsecats.php in PozScripts Classified Ads allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

awrate.com Message Board 1.0 - 'search.php' Remote File Inclusion

CVE-2006-6368—webappsphp

PHP remote file inclusion vulnerability in login.php.inc in awrate 1.0 allows remote attackers to execute arbitrary PHP

23RISK

open ↗

Referência✓ VexDay Proof

F-Prot AntiVirus 4.6.6 - CHM Heap Overflow (PoC)

CVE-2006-6293—doslinux

Heap-based buffer overflow in FRISK Software F-Prot Antivirus before 4.6.7 allows user-assisted remote attackers to exec

28RISK

open ↗

Referência✓ VexDay Proof

BookmarkX script 2007 - 'topicid' SQL Injection

CVE-2008-0695—webappsphp

SQL injection vulnerability in index.php in BookmarkX script 2007 allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

gtcatalog 0.9.1 - 'index.php' Remote File Inclusion

CVE-2006-5923—webappsphp

PHP remote file inclusion vulnerability in index.php in Chris Mac gtcatalog (aka GimeScripts Shopping Catalog) 0.9.1 and

23RISK

open ↗

Referência✓ VexDay Proof

Scorp Book 1.0 - 'smilies.php?config' Remote File Inclusion

CVE-2007-1937—webappsphp

PHP remote file inclusion vulnerability in smilies.php in Scorp Book 1.0 allows remote attackers to execute arbitrary PH

23RISK

open ↗

Referência✓ VexDay Proof

MDaemon POP3 Server < 9.06 - 'USER' Remote Buffer Overflow (PoC)

CVE-2006-4364—doswindows

Multiple heap-based buffer overflows in the POP3 server in Alt-N Technologies MDaemon before 9.0.6 allow remote attacker

35RISK

open ↗

Referência✓ VexDay Proof

PHP-Fusion Mod TI - 'id' SQL Injection

CVE-2008-5733—webappsphp

SQL injection vulnerability in blog.php in the Team Impact TI Blog System mod for PHP-Fusion allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

CzarNews 1.14 - 'tpath' Remote File Inclusion

CVE-2005-0859—webappsphp

PHP remote file inclusion vulnerability in CzarNews 1.13b allows remote attackers to execute arbitrary PHP code via the

28RISK

open ↗

Referência✓ VexDay Proof

AirMore 1.6.1 - Denial of Service (PoC)

CVE-2019-9831—dosandroid

The AirMore application through 1.6.1 for Android allows remote attackers to cause a denial of service (system hang) via

28RISK

open ↗

Referência✓ VexDay Proof

PHP-Nuke Module Docum - 'artid' SQL Injection

CVE-2008-0906—webappsphp

SQL injection vulnerability in the Docum module in PHP-Nuke allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

AtomixMP3 < 2.3 - '.m3u' Local Buffer Overflow

CVE-2006-6287—localwindows

Stack-based buffer overflow in AtomixMP3 2.3 and earlier allows remote attackers to execute arbitrary code via a long pa

28RISK

open ↗

Referência✓ VexDay Proof

Quick and Dirty Blog (qdblog) 0.4 - SQL Injection / Local File Inclusion

CVE-2007-2304—webappsphp

Multiple directory traversal vulnerabilities in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote at

23RISK

open ↗

Referência✓ VexDay Proof

QuickUpCMS - Multiple SQL Injections Vulnerabilities

CVE-2008-2530—webappsphp

Multiple SQL injection vulnerabilities in Concepts & Solutions QuickUpCMS allow remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência✓ VexDay Proof

OTSCMS 2.1.3 - Multiple Remote File Inclusions

CVE-2006-5548—webappsphp

PHP remote file inclusion vulnerability in OTSCMS/OTSCMS.php in Open Tibia Server Content Management System (OTSCMS) 2.0

23RISK

open ↗

Referência✓ VexDay Proof

Globsy 1.0 - 'file' Remote File Disclosure

CVE-2008-0905—webappsphp

Directory traversal vulnerability in globsy_edit.php in Globsy 1.0 allows remote attackers to read arbitrary files via a

23RISK

open ↗

Referência✓ VexDay Proof

PBLang 4.66z - 'temppath' Remote File Inclusion

CVE-2006-5062—webappsphp

PHP remote file inclusion vulnerability in templates/pb/language/lang_nl.php in PBLang (PBL) 4.66z and earlier allows re

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.