Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Online Grades 3.2.4 - Authentication Bypass
CVE-2009-0452—webappsphp
Multiple SQL injection vulnerabilities in parents/login.php in Online Grades 3.2.4, when magic_quotes_gpc is disabled, a
23RISK
open ↗
Referência✓ VexDay Proof
sourdough 0.3.5 - Remote File Inclusion
CVE-2009-0456—webappsphp
PHP remote file inclusion vulnerability in examples/example_clientside_javascript.php in patForms, as used in Sourdough
23RISK
open ↗
Referência✓ VexDay Proof
Rankem - File Disclosure / Cross-Site Scripting / Cookie
CVE-2009-0248—webappsphp
Cross-site scripting (XSS) vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to inject arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
AdaptCMS Lite 1.4 - Cross-Site Scripting / Remote File Inclusion
CVE-2009-0527—webappsphp
PHP remote file inclusion vulnerability in plugins/rss_importer_functions.php in AdaptCMS Lite 1.4 allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
Live for Speed S1/S2/Demo - '.spr' Local Buffer Overflow
CVE-2007-4257—localwindows
Multiple buffer overflows in Live for Speed (LFS) S1 and S2 allow user-assisted remote attackers to execute arbitrary co
23RISK
open ↗
Referência✓ VexDay Proof
DD-WRT HTTPd Daemon/Service - Remote Command Execution
CVE-2008-6974—remotehardware
Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp1 and earlier allow remote attack
23RISK
open ↗
Referência✓ VexDay Proof
Ncaster 1.7.2 - 'archive.php' Remote File Inclusion
CVE-2007-4320—webappsphp
PHP remote file inclusion vulnerability in admin/addons/archive/archive.php in Ncaster 1.7.2 allows remote attackers to
45RISK
open ↗
Referência✓ VexDay Proof
MDPro Module My_eGallery - 'pid' SQL Injection
CVE-2009-0728—webappsphp
SQL injection vulnerability in the My_eGallery module for MAXdev MDPro (MD-Pro) and Postnuke allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
BabbleBoard 1.1.6 - Cross-Site Request Forgery/Cookie Grabber
CVE-2008-6906—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in BabbleBoard 1.1.6 allows remote attackers to inject arbitrary w
23RISK
open ↗
Referência✓ VexDay Proof
Pars4U Videosharing 1.0 - Cross-Site Scripting / Blind SQL Injection
CVE-2008-3771—webappsphp
Cross-site scripting (XSS) vulnerability in members.php in Pars4u Videosharing 1 allows remote attackers to inject arbit
23RISK
open ↗
Referência✓ VexDay Proof
EDraw Office Viewer Component 5.1 - HttpDownloadFile() Insecure Method
CVE-2007-4420—remotewindows
Absolute path traversal vulnerability in a certain ActiveX control in officeviewer.ocx 5.1.199.1 in EDraw Office Viewer
23RISK
open ↗
Referência✓ VexDay Proof
PHP infoboard 7 plus - Multiple Vulnerabilities
CVE-2008-4333—webappsphp
Cross-site scripting (XSS) vulnerability in PHP infoBoard V.7 Plus allows remote attackers to inject arbitrary web scrip
23RISK
open ↗
Referência✓ VexDay Proof
QuestCMS - Cross-Site Scripting / Directory Traversal / SQL Injection
CVE-2008-4774—webappsphp
Cross-site scripting (XSS) vulnerability in main/main.php in QuestCMS allows remote attackers to inject arbitrary web sc
23RISK
open ↗
Referência✓ VexDay Proof
OTManager CMS 24a - Local File Inclusion / Cross-Site Scripting
CVE-2008-5202—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in OTManager CMS 24a allows remote attackers to inject arbitrary w
23RISK
open ↗
Referência✓ VexDay Proof
CMS NetCat 3.12 - Multiple Vulnerabilities
CVE-2008-5729—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in AIST NetCat 3.12 and earlier allow remote attackers to inject arb
23RISK
open ↗
Referência✓ VexDay Proof
Mercury/32 Mail SMTPD - Remote Stack Overrun (PoC)
CVE-2007-4440—doswindows
Stack-based buffer overflow in the MercuryS SMTP server in Mercury Mail Transport System, possibly 4.51 and earlier, all
50RISK
open ↗
Referência✓ VexDay Proof
Lightweight news portal (LNP) 1.0b - Multiple Vulnerabilities
CVE-2008-7171—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Lightweight news portal (LNP) 1.0b allow remote attackers to inje
23RISK
open ↗
Referência✓ VexDay Proof
S-CMS 1.1 Stable - Insecure Cookie Handling / Mass Page Delete
CVE-2009-0863—webappsphp
SQL injection vulnerability in admin/delete_page.php in S-Cms 1.1 Stable allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
blogme 3.0 - Cross-Site Scripting / Authentication Bypass
CVE-2006-5976—webappsasp
Multiple SQL injection vulnerabilities in admin_login.asp in BlogMe 3.0 allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component NeoRecruit 1.4 - 'id' SQL Injection
CVE-2007-4506—webappsphp
SQL injection vulnerability in index.php in the NeoRecruit component (com_neorecruit) 1.4 and earlier for Joomla! allows
23RISK
open ↗
Referência✓ VexDay Proof
Venalsur on-line Booking Centre - Cross-Site Scripting / SQL Injection
CVE-2008-6216—webappsphp
SQL injection vulnerability in cadena_ofertas_ext.php in Venalsur Booking Centre Booking System for Hotels Group allows
23RISK
open ↗
Referência✓ VexDay Proof
Linux Kernel 2.6 (Gentoo / Ubuntu 8.10/9.04) UDEV < 1.4.1 - Local Privilege Escalation (2)
CVE-2009-1185—locallinux
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to ga
60RISK
open ↗
Referência✓ VexDay Proof
Pakupaku CMS 0.4 - Arbitrary File Upload / Local File Inclusion
CVE-2007-4640—webappsphp
Unrestricted file upload vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to upload an
23RISK
open ↗
Referência✓ VexDay Proof
Acoustica Mixcraft 4.2 Build 98 - 'mx4' Local Buffer Overflow
CVE-2008-3877—localwindows
Stack-based buffer overflow in Acoustica Mixcraft 4.1 Build 96 and 4.2 Build 98 allows user-assisted attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
webEdition 6.0.0.4 - 'WE_LANGUAGE' Local File Inclusion
CVE-2009-1222—webappsphp
Directory traversal vulnerability in index.php in webEdition 6.0.0.4 and earlier, when register_globals is enabled and m
23RISK
open ↗
Referência✓ VexDay Proof
Pc4Uploader 9.0 - Blind SQL Injection
CVE-2009-1742—webappsphp
code.php in PC4Arb Pc4 Uploader 9.0 and earlier makes it easier for remote attackers to conduct SQL injection attacks vi
23RISK
open ↗
Referência✓ VexDay Proof
PHPNS 1.1 - 'shownews.php?id' SQL Injection
CVE-2007-4628—webappsphp
SQL injection vulnerability in shownews.php in phpns 1.1 allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Referência✓ VexDay Proof
Weblogicnet - 'files_dir' Multiple Remote File Inclusions
CVE-2007-4715—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Weblogicnet allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗
Referência✓ VexDay Proof
Apple Mac OSX xnu 1228.x - 'hfs-fcntl' Kernel Privilege Escalation
CVE-2009-1235—localosx
XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space
23RISK
open ↗
Referência✓ VexDay Proof
Gravity Board X 2.0 Beta - SQL Injection / (Authenticated) Code Execution
CVE-2009-1277—webappsphp
SQL injection vulnerability in index.php in Gravity Board X (GBX) 2.0 BETA allows remote attackers to execute arbitrary
23RISK
open ↗
← previouspage 86 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.