Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits

40,961CVEs with public exploitation

24,696lab-tested

All Referência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

24,696 exploits

Referência✓ VexDay Proof

YourFreeWorld Classifieds Hosting - SQL Injection

CVE-2008-4884—webappsphp

SQL injection vulnerability in tr.php in YourFreeWorld Classifieds Hosting Script allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

Visagesoft eXPert PDF ViewerX - 'VSPDFViewerX.ocx' File Overwrite

CVE-2008-4919—remotewindows

Insecure method vulnerability in VISAGESOFT eXPert PDF Viewer X ActiveX control (VSPDFViewerX.ocx) 3.0.990.0 allows remo

23RISK

open ↗

Referência✓ VexDay Proof

ModernBill 4.4.x - Cross-Site Scripting / Remote File Inclusion

CVE-2008-5060—webappsphp

Multiple PHP remote file inclusion vulnerabilities in ModernBill 4.4 and earlier allow remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

Yoxel 1.23beta - 'itpm_estimate.php' Remote Code Execution

CVE-2008-5071—webappsphp

Multiple eval injection vulnerabilities in itpm_estimate.php in Yoxel 1.23beta and earlier allow remote authenticated us

23RISK

open ↗

Referência✓ VexDay Proof

K-Lite Mega Codec Pack 3.5.7.0 - Local Windows Explorer Denial of Service (PoC)

CVE-2008-5072—doswindows

vsfilter.dll in K-Lite Mega Codec Pack 3.5.7.0 allows remote attackers to cause a denial of service (application crash)

23RISK

open ↗

Referência✓ VexDay Proof

VAMP Webmail 2.0beta1 - 'yesno.phtml' Remote File Inclusion

CVE-2006-5147—webappsphp

PHP remote file inclusion vulnerability in wamp_dir/setup/yesno.phtml in VAMP Webmail 2.0beta1 and earlier allows remote

23RISK

open ↗

Referência✓ VexDay Proof

Deterministic Network Enhancer - 'dne2000.sys' Kernel Ring0 SYSTEM

CVE-2008-5121—localwindows

dne2000.sys in Citrix Deterministic Network Enhancer (DNE) 2.21.7.233 through 3.21.7.17464, as used in (1) Cisco VPN Cli

23RISK

open ↗

Referência✓ VexDay Proof

webSPELL 4.01.01 - Database Backup Download

CVE-2006-4782—webappsphp

src/index.php in WebSPELL 4.01.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authe

23RISK

open ↗

Referência✓ VexDay Proof

Clean CMS 1.5 - Blind SQL Injection / Cross-Site Scripting

CVE-2008-5289—webappsphp

SQL injection vulnerability in full_txt.php in Werner Hilversum Clean CMS 1.5 allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

sCssBoard (Multiple Versions) - 'pwnpack' Remote s

CVE-2008-5578—webappsphp

Multiple SQL injection vulnerabilities in index.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allow remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

Picture-Engine 1.2.0 - 'wall.php?cat' SQL Injection

CVE-2007-1791—webappsphp

SQL injection vulnerability in wall.php in Picture-Engine 1.2.0 and earlier allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

PHPstore Wholesale - 'id' SQL Injection

CVE-2008-5493—webappsphp

SQL injection vulnerability in track.php in PHPStore Wholesales (aka Wholesale) allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

PozScripts Business Directory Script - 'cid' SQL Injection

CVE-2008-5496—webappsphp

SQL injection vulnerability in showcategory.php in PozScripts Business Directory Script allows remote attackers to execu

23RISK

open ↗

Referência✓ VexDay Proof

BandSite CMS 1.1.4 - Insecure Cookie Handling

CVE-2008-5497—webappsphp

BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the login_

23RISK

open ↗

Referência✓ VexDay Proof

Poll Pro 2.0 - Authentication Bypass

CVE-2008-5573—webappsasp

SQL injection vulnerability in the login feature in Poll Pro 2.0 allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

Nukedit 4.9.x - Remote Create Admin

CVE-2008-5582—webappsphp

SQL injection vulnerability in utilities/login.asp in Nukedit 4.9.x, and possibly earlier, allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

FlaP 1.0b - 'pachtofile' Remote File Inclusion

CVE-2007-2940—webappsphp

Multiple PHP remote file inclusion vulnerabilities in FlaP 1.0b (1.0 Beta) allow remote attackers to execute arbitrary P

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Internet Explorer 6 / Ademco co. ltd. ATNBaseLoader100 Module - Remote Buffer Overflow

CVE-2007-2938—remotewindows

Buffer overflow in the BaseRunner ActiveX control in the Ademco ATNBaseLoader100 Module (ATNBaseLoader100.dll) 5.4.0.6,

35RISK

open ↗

Referência✓ VexDay Proof

WEBBDOMAIN Polls 1.01 - Authentication Bypass

CVE-2008-6625—webappsphp

SQL injection vulnerability in getin.php in WEBBDOMAIN Polls (aka Poll) 1.0 and 1.01 allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

Ktools Photostore 3.5.2 - Multiple SQL Injections

CVE-2008-6649—webappsphp

SQL injection vulnerability in manager/image_details_editor.php in Ktools PhotoStore 2.5, 2.9.8, 3.1.0, and other versio

23RISK

open ↗

Referência✓ VexDay Proof

Kaqoo Auction - 'install_root' Multiple Remote File Inclusions

CVE-2007-1790—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Kaqoo Auction Software Free Edition allow remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

Butterfly ORGanizer 2.0.0 - SQL Injection / Cross-Site Scripting

CVE-2008-6700—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in Butterfly Organizer 2.0.0 allow remote attackers to inject arbitr

23RISK

open ↗

Referência✓ VexDay Proof

xeCMS 1.0.0 RC2 - Insecure Cookie Handling

CVE-2008-6714—webappsphp

admin.php in xeCMS 1.0.0 RC2 and earlier allows remote attackers to bypass authentication and access the admin panel by

28RISK

open ↗

Referência✓ VexDay Proof

ReVou Twitter Clone - Arbitrary File Upload

CVE-2008-6751—webappsphp

Unrestricted file upload vulnerability in index.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging allows

23RISK

open ↗

Referência✓ VexDay Proof

SFS EZ Affiliate - 'cat_id' SQL Injection

CVE-2008-6780—webappsphp

SQL injection vulnerability in directory.php in Scripts for Sites (SFS) SFS EZ Affiliate allows remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

MindDezign Photo Gallery 2.2 - SQL Injection

CVE-2008-6788—webappsphp

SQL injection vulnerability in MindDezign Photo Gallery 2.2, when magic_quotes_gpc is disabled, allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

MindDezign Photo Gallery 2.2 - Arbitrary Add Admin

CVE-2008-6789—webappsphp

SQL injection vulnerability in MindDezign Photo Gallery 2.2 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

WebStudio CMS - Blind SQL Injection

CVE-2008-5336—webappsphp

SQL injection vulnerability in index.php in WebStudio CMS allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

Vibro-School-CMS - 'nID' SQL Injection

CVE-2008-6795—webappsphp

SQL injection vulnerability in view_news.php in nicLOR Vibro-School-CMS allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

PHPwebnews 0.2 MySQL Edition - 'det' SQL Injection

CVE-2008-6812—webappsphp

SQL injection vulnerability in bukutamu.php in phpWebNews 0.2 MySQL Edition allows remote attackers to execute arbitrary

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.