Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,676cataloged exploits
39,951CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,372VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
E-topbiz Number Links 1 - 'id' SQL Injection
CVE-2008-5804—webappsphp
SQL injection vulnerability in admin/admin_catalog.php in e-topbiz Number Links 1 Php Script allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Auction - Blind SQL Injection
CVE-2008-6778—webappsphp
SQL injection vulnerability in viewfaqs.php in Scripts for Sites (SFS) EZ Auction allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component live chat - SQL Injection / Open Proxy
CVE-2008-6883—webappsphp
SQL injection vulnerability in the Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Snitz Forums 2000 - 'Active.asp' SQL Injection
CVE-2007-6240—webappsasp
SQL injection vulnerability in active.asp in Snitz Forums 2000 3.4.06 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
SH-News 3.0 - 'comments.php' SQL Injection
CVE-2007-6391—webappsphp
SQL injection vulnerability in patch/comments.php in SH-News 3.0 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
YACS CMS 6.6.1 - context[path_to_root] Remote File Inclusion
CVE-2006-4532—webappsphp
PHP remote file inclusion vulnerability in articles/article.php in Yet Another Community System (YACS) CMS 6.6.1 and ear
23RISK
open ↗
Referência✓ VexDay Proof
NewsLetter 3.5 - 'NL_PATH' Remote File Inclusion
CVE-2006-3986—webappsphp
PHP remote file inclusion vulnerability in index.php in Knusperleicht Newsletter 3.5 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6496—webappsasp
Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to register arbitrary users via a request to host
23RISK
open ↗
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6497—webappsasp
Hosting Controller 6.1 Hot fix 3.3 and earlier (1) allows remote attackers to change arbitrary user profiles via a reque
23RISK
open ↗
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6498—webappsasp
Multiple SQL injection vulnerabilities in Hosting Controller 6.1 Hot fix 3.3 and earlier allow remote authenticated user
23RISK
open ↗
Referência✓ VexDay Proof
HP Software Update Client 3.0.8.4 - Multiple Vulnerabilities
CVE-2007-6506—doswindows
The HPRulesEngine.ContentCollection.1 ActiveX Control in RulesEngine.dll for HP Software Update 4.000.005.007 and earlie
28RISK
open ↗
Referência✓ VexDay Proof
RunCMS 1.6 - Multiple Vulnerabilities
CVE-2007-6547—webappsphp
RunCMS before 1.6.1 does not require entry of the old password during a password change, which allows context-dependent
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Fusion Mod freshlinks - 'linkid' SQL Injection
CVE-2008-5074—webappsphp
SQL injection vulnerability in index.php in the Freshlinks 1.0 RC1 module for PHP-Fusion allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
Mihalism Multi Host 2.0.7 - 'download.php' Remote File Disclosure
CVE-2007-6653—webappsphp
Directory traversal vulnerability in download.php in Mihalism Multi Host 2.0.7 allows remote attackers to read arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Macrovision Installshield - 'isusweb.dll' Overwrite (SEH)
CVE-2007-6654—remotewindows
Buffer overflow in a certain ActiveX control in Macrovision InstallShield Update Service Web Agent 5.1.100.47363 allows
23RISK
open ↗
Referência✓ VexDay Proof
VideoLAN VLC Media Player 0.8.6d - 'httpd_FileCallBack' Remote Format String
CVE-2007-6682—remotewindows
Format string vulnerability in the httpd_FileCallBack function (network/httpd.c) in VideoLAN VLC 0.8.6d allows remote at
28RISK
open ↗
Referência✓ VexDay Proof
snetworks PHP Classifieds 5.0 - Remote File Inclusion
CVE-2008-0137—webappsphp
PHP remote file inclusion vulnerability in config.inc.php in SNETWORKS PHP CLASSIFIEDS 5.0 allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
samPHPweb 4.2.2 - 'db.php' Remote File Inclusion
CVE-2008-0143—webappsphp
PHP remote file inclusion vulnerability in common/db.php in samPHPweb, possibly 4.2.2 and others, as provided with SAM B
23RISK
open ↗
Referência✓ VexDay Proof
Myiosoft EasyBookMarker 4 - 'Parent' SQL Injection
CVE-2008-5651—webappsphp
SQL injection vulnerability in plugins/bookmarker/bookmarker_backend.php in MyioSoft EasyBookMarker 4.0 allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
4Images 1.7.x - 'search.php' SQL Injection
CVE-2006-5236—webappsphp
SQL injection vulnerability in search.php in 4images 1.7.x allows remote authenticated users to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
vsftpd 2.0.5 - 'CWD' (Authenticated) Remote Memory Consumption
CVE-2007-5962—doslinux
Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux (RHEL) 5 and Fedora 6 throug
28RISK
open ↗
Referência✓ VexDay Proof
NetRisk 1.9.7 - Cross-Site Scripting / SQL Injection
CVE-2008-0185—webappsphp
SQL injection vulnerability in index.php in NetRisk 1.9.7 and possibly earlier versions allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
NetRisk 1.9.7 - Cross-Site Scripting / SQL Injection
CVE-2008-0186—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in NetRisk 1.9.7 and possibly earlier allows remote attackers to i
23RISK
open ↗
Referência✓ VexDay Proof
minimal Gallery 0.8 - Remote File Disclosure
CVE-2008-0260—webappsphp
minimal Gallery 0.8 allows remote attackers to obtain configuration information via a direct request to php_info.php, wh
23RISK
open ↗
Referência✓ VexDay Proof
Agares phpAutoVideo 2.21 - 'articlecat' SQL Injection (1)
CVE-2008-0262—webappsphp
SQL injection vulnerability in includes/articleblock.php in Agares PhpAutoVideo 2.21 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
MTCMS 2.0 - SQL Injection
CVE-2008-0280—webappsphp
SQL injection vulnerability in index.php in MTCMS 2.0 and possibly earlier versions allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
vcart 3.3.2 - Multiple Remote File Inclusions
CVE-2008-0287—webappsphp
PHP remote file inclusion vulnerability in VisionBurst vcart 3.3.2 allows remote attackers to execute arbitrary PHP code
23RISK
open ↗
Referência✓ VexDay Proof
ImageAlbum 2.0.0b2 - 'id' SQL Injection
CVE-2008-0288—webappsphp
Multiple SQL injection vulnerabilities in ImageAlbum 2.0.0b2 allow remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
RichStrong CMS - 'cat' SQL Injection
CVE-2008-0291—webappsasp
SQL injection vulnerability in showproduct.asp in RichStrong CMS allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
SCO UnixWare < 7.1.4 p534589 - 'pkgadd' Local Privilege Escalation
CVE-2008-0310—localsco
Directory traversal vulnerability in pkgadd in SCO UnixWare 7.1.4 before p534589 allows local users to create or append
23RISK
open ↗
← previouspage 85 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.