Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
TriO 2.1 - 'browse.php' SQL Injection
CVE-2008-3418—webappsphp
SQL injection vulnerability in browse.php in TriO 2.1 and earlier allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
txtCMS 0.3 - 'index.php' Local File Inclusion
CVE-2008-5217—webappsphp
Directory traversal vulnerability in index.php in txtCMS 0.3, when register_globals is enabled and magic_quotes_gpc is d
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module wiwimod 0.4 - Remote File Inclusion
CVE-2007-3289—webappsphp
PHP remote file inclusion vulnerability in spaw/spaw_control.class.php in the WiwiMod 0.4 module for XOOPS allows remote
28RISK
open ↗
Referência✓ VexDay Proof
XRms 1.99.2 - Remote File Inclusion / Cross-Site Scripting / Information Gathering
CVE-2008-3399—webappsphp
PHP remote file inclusion vulnerability in activities/workflow-activities.php in XRMS CRM 1.99.2, when register_globals
23RISK
open ↗
Referência✓ VexDay Proof
phpAbook 0.8.8b - 'cookie' Local File Inclusion
CVE-2008-4490—webappsphp
Directory traversal vulnerability in config.inc.php in phpAbook 0.8.8b and earlier, when magic_quotes_gpc is disabled, a
23RISK
open ↗
Referência✓ VexDay Proof
PunBB Mod PunPortal 0.1 - Local File Inclusion
CVE-2008-5418—webappsphp
Directory traversal vulnerability in login.php in the PunPortal module before 2.0 for PunBB allows remote attackers to i
23RISK
open ↗
Referência✓ VexDay Proof
e-Vision CMS 2.0.2 - Multiple Local File Inclusions
CVE-2008-6551—webappsphp
Multiple directory traversal vulnerabilities in e-Vision CMS 2.0.2 and earlier, when magic_quotes_gpc is disabled, allow
23RISK
open ↗
Referência✓ VexDay Proof
EkinBoard 1.1.0 - Arbitrary File Upload / Authentication Bypass
CVE-2008-7156—webappsphp
EkinBoard 1.1.0 and earlier, when register_globals is enabled, allows remote attackers to bypass authorization and gain
23RISK
open ↗
Referência✓ VexDay Proof
LiveCMS 3.4 - 'categoria.php?cid' SQL Injection
CVE-2007-3290—webappsphp
categoria.php in LiveCMS 3.4 and earlier allows remote attackers to obtain sensitive information via a ' (quote) charact
23RISK
open ↗
Referência✓ VexDay Proof
ArcaVir 2009 < 9.4.320X.9 - 'ps_drv.sys' Local Privilege Escalation
CVE-2009-1824—localwindows
The ps_drv.sys kernel driver in ArcaBit ArcaVir 2009 Antivirus Protection 9.4.3201.9 and earlier, ArcaVir 2009 Internet
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows XP/2003 - 'afd.sys' Local Privilege Escalation (K-plugin) (MS08-066)
CVE-2008-3464—localwindows
afd.sys in the Ancillary Function Driver (AFD) component in Microsoft Windows XP SP2 and SP3 and Windows Server 2003 SP1
23RISK
open ↗
Referência✓ VexDay Proof
ContentNow 1.39 - 'pageid' SQL Injection
CVE-2006-6157—webappsphp
SQL injection vulnerability in index.php in ContentNow 1.39 and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module My_eGallery 3.04 - 'gid' SQL Injection
CVE-2008-7038—webappsphp
SQL injection vulnerability in the My_eGallery module for PHP-Nuke allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
NotFTP 1.3.1 - 'newlang' Local File Inclusion
CVE-2009-1407—webappsphp
Directory traversal vulnerability in config.php in NotFTP 1.3.1 allows remote attackers to read arbitrary files via a ..
23RISK
open ↗
Referência✓ VexDay Proof
TransLucid 1.75 - Multiple Vulnerabilities
CVE-2009-2145—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in transLucid 1.75 allow remote attackers to inject arbitrary web sc
23RISK
open ↗
Referência✓ VexDay Proof
bcoos 1.0.10 - Local File Inclusion / SQL Injection
CVE-2007-6079—webappsphp
Directory traversal vulnerability in include/common.php in bcoos 1.0.10 allows remote attackers to include and execute a
23RISK
open ↗
Referência✓ VexDay Proof
bcoos 1.0.13 - 'viewcat.php' SQL Injection
CVE-2008-6381—webappsphp
SQL injection vulnerability in modules/adresses/viewcat.php in bcoos 1.0.13, and possibly earlier, allows remote authent
23RISK
open ↗
Referência✓ VexDay Proof
Easy Photo Gallery 2.1 - Cross-Site Scripting / File Disclosure/Bypass / SQL Injection
CVE-2008-6988—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Easy Photo Gallery (aka Ezphotogallery) 2.1 allow remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
DomPHP 0.81 - 'index.php' Remote File Inclusion
CVE-2008-0283—webappsphp
PHP remote file inclusion vulnerability in /aides/index.php in DomPHP 0.81 and earlier allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
polypager 1.0rc2 - SQL Injection / Cross-Site Scripting
CVE-2008-3506—webappsphp
SQL injection vulnerability in PolyPager 1.0 rc2 and earlier allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Star Articles 6.0 - Blind SQL Injection (1)
CVE-2008-7075—webappsphp
Multiple SQL injection vulnerabilities in Kalptaru Infotech Ltd. Star Articles 6.0 allow remote attackers to inject arbi
23RISK
open ↗
Referência✓ VexDay Proof
Anata CMS 1.0b5 - 'change.php' Arbitrary Add Admin
CVE-2008-6665—webappsphp
change.php in Ananta CMS 1.0b5, with magic_quotes_gpc disabled, allows remote attackers to gain administrator privileges
23RISK
open ↗
Referência✓ VexDay Proof
Velocity Web-Server 1.0 - Directory Traversal
CVE-2008-7084—remotewindows
Directory traversal vulnerability in the web server 1.0 in Velocity Security Management System allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
ASPPortal 4.0.0 - 'default1.asp' SQL Injection
CVE-2006-5879—webappsasp
SQL injection vulnerability in default1.asp in ASPPortal 4.0.0 beta and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
ICQ 6.5 - URL Search Hook (Windows Explorer) Remote Buffer Overflow (PoC)
CVE-2009-1915—doswindows
Stack-based buffer overflow in the URL Search Hook (ICQToolBar.dll) in ICQ 6.5 allows remote attackers to cause a denial
23RISK
open ↗
Referência✓ VexDay Proof
bugmall shopping cart 2.5 - SQL Injection / Cross-Site Scripting
CVE-2007-3447—webappsphp
SQL injection vulnerability in BugMall Shopping Cart 2.5 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Interact 2.4.1 - Multiple Remote File Inclusions
CVE-2008-2220—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Interact Learning Community Environment Interact 2.4.1, when regis
23RISK
open ↗
Referência✓ VexDay Proof
cmsWorks 2.2 RC4 - 'mod_root' Remote File Inclusion
CVE-2008-2877—webappsphp
PHP remote file inclusion vulnerability in admin/include/lib.module.php in cmsWorks 2.2 RC4, when register_globals is en
23RISK
open ↗
Referência✓ VexDay Proof
Free Hosting Manager 1.2/2.0 - Insecure Cookie Handling
CVE-2008-3557—webappsphp
Free Hosting Manager 1.2 and 2.0 allows remote attackers to bypass authentication and gain administrative access by sett
23RISK
open ↗
Referência✓ VexDay Proof
Alstrasoft e-Friends 4.21 - Admin Session Retrieve
CVE-2007-2824—webappsphp
SQL injection vulnerability in paypal.php in AlstraSoft E-Friends 4.21 and earlier allows remote attackers to execute ar
23RISK
open ↗
← previouspage 88 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.