Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits

40,961CVEs with public exploitation

24,696lab-tested

All Referência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

26,571 exploits

Referência✓ VexDay Proof

eLineStudio Site Composer (ESC) 2.6 - Multiple Vulnerabilities

CVE-2008-2864—webappsphp

eLineStudio Site Composer (ESC) 2.6 and earlier allows remote attackers to obtain sensitive information via a direct req

23RISK

open ↗

Referência✓ VexDay Proof

E-topbiz ViralDX 2.07 - 'bannerid' SQL Injection

CVE-2008-2867—webappsphp

SQL injection vulnerability in adclick.php in E-topbiz Viral DX 1 2.07 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Jokes & Funny Pics Script - 'sb_jokeid' SQL Injection

CVE-2008-2874—webappsphp

SQL injection vulnerability in index.php in Softbiz Jokes & Funny Pics Script allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

FubarForum 1.5 - 'index.php' Local File Inclusion

CVE-2008-2887—webappsphp

Directory traversal vulnerability in index.php in chaozz@work FubarForum 1.5 allows remote attackers to include and exec

23RISK

open ↗

Referência✓ VexDay Proof

Online Fantasy Football League (OFFL) 0.2.6 - 'teams.php' SQL Injection

CVE-2008-2890—webappsphp

Multiple SQL injection vulnerabilities in Online Fantasy Football League (OFFL) 0.2.6 and earlier allow remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

emuCMS 0.3 - 'cat_id' SQL Injection

CVE-2008-2891—webappsphp

SQL injection vulnerability in index.php in eMuSOFT emuCMS 0.3 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

FireAnt 1.3 - 'index.php' Local File Inclusion

CVE-2008-2896—webappsphp

Directory traversal vulnerability in index.php in FireAnt 1.3 allows remote attackers to include and execute arbitrary l

23RISK

open ↗

Referência✓ VexDay Proof

Family Connections CMS 1.4 - Multiple SQL Injections

CVE-2008-2901—webappsphp

Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated user

23RISK

open ↗

Referência✓ VexDay Proof

WebChamado 1.1 - 'tsk_id' SQL Injection

CVE-2008-2906—webappsphp

SQL injection vulnerability in lista_anexos.php in WebChamado 1.1 allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

Contenido 4.8.4 - Remote File Inclusion / Cross-Site Scripting

CVE-2008-2911—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in index.php in Contenido 4.8.4 allow remote attackers to inject arb

23RISK

open ↗

Referência✓ VexDay Proof

Pre Job Board - 'JobSearch.php' SQL Injection

CVE-2008-2915—webappsphp

Multiple SQL injection vulnerabilities in jobseekers/JobSearch.php (aka the search module) in Pre Job Board allow remote

23RISK

open ↗

Referência✓ VexDay Proof

Cartweaver 3 - 'prodId' Blind SQL Injection

CVE-2008-2918—webappsphp

SQL injection vulnerability in details.php in Application Dynamics Cartweaver 3.0 allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

ezcms 1.2 - Blind SQL Injection / Authentication Bypass

CVE-2008-2920—webappsphp

admin/filemanager/ (aka the File Manager) in EZTechhelp EZCMS 1.2 and earlier does not require authentication, which all

23RISK

open ↗

Referência✓ VexDay Proof

MyBlog: PHP and MySQL Blog/CMS software - SQL Injection / Cross-Site Scripting

CVE-2008-2963—webappsphp

Multiple SQL injection vulnerabilities in MyBlog allow remote attackers to execute arbitrary SQL commands via the (1) vi

23RISK

open ↗

Referência✓ VexDay Proof

jaxultrabb 2.0 - Local File Inclusion / Cross-Site Scripting

CVE-2008-2965—webappsphp

Cross-site scripting (XSS) vulnerability in viewforum.php in JaxUltraBB (JUBB) 2.0 and earlier allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

jaxultrabb 2.0 - Local File Inclusion / Cross-Site Scripting

CVE-2008-2966—webappsphp

Directory traversal vulnerability in viewprofile.php in JaxUltraBB 2.0 and earlier allows remote attackers to read arbit

23RISK

open ↗

Referência✓ VexDay Proof

PHP KnowledgeBase Script 2.4 - 'cat_id' SQL Injection

CVE-2008-2972—webappsphp

SQL injection vulnerability in index.php in KbLance allows remote attackers to execute arbitrary SQL commands via the ca

23RISK

open ↗

Referência✓ VexDay Proof

mm chat 1.5 - Local File Inclusion / Cross-Site Scripting

CVE-2008-2974—webappsphp

Directory traversal vulnerability in chatconfig.php in MM Chat 1.5, when register_globals is enabled, allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

ourvideo CMS 9.5 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting

CVE-2008-2978—webappsphp

Directory traversal vulnerability in phpi/rss.php in Ourvideo CMS 9.5, when register_globals is enabled, allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

phpDMCA 1.0.0 - Multiple Remote File Inclusions

CVE-2008-2986—webappsphp

Multiple PHP remote file inclusion vulnerabilities in phpDMCA 1.0.0 allow remote attackers to execute arbitrary PHP code

23RISK

open ↗

Referência✓ VexDay Proof

Fez 1.3/2.0 RC1 - 'list.php' SQL Injection

CVE-2008-6028—webappsphp

SQL injection vulnerability in list.php in University of Queensland Library Fez 1.3 and 2.0 RC1 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Iamma Simple Gallery 1.0/2.0 - Arbitrary File Upload

CVE-2008-6084—webappsphp

Unrestricted file upload vulnerability in pages/download.php in Iamma Simple Gallery 1.0 and 2.0 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Scriptsez Mini Hosting Panel - 'members.php' Local File Inclusion

CVE-2008-6090—webappsphp

Directory traversal vulnerability in members.php in ScriptsEz Mini Hosting Panel allows remote attackers to read arbitra

23RISK

open ↗

Referência✓ VexDay Proof

Goople CMS 1.7 - Insecure Cookie Handling

CVE-2008-6118—webappsphp

win/content/upload.php in Goople CMS 1.7 allows remote attackers to bypass authentication and gain administrative access

23RISK

open ↗

Referência

CVE-2008-6132

CVE-2008-6132—

Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magic_quotes_gpc is disabled, allo

43RISK

open ↗

Referência✓ VexDay Proof

HispaH textlinksads - 'index.php' SQL Injection

CVE-2008-6154—webappsphp

SQL injection vulnerability in index.php in Hispah Text Links Ads 1.1 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Falt4 CMS RC4 - 'FCKeditor' Arbitrary File Upload

CVE-2008-6178—webappsphp

Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2

23RISK

open ↗

Referência✓ VexDay Proof

IndexScript 3.0 - 'parent_id' SQL Injection

CVE-2008-6179—webappsphp

SQL injection vulnerability in sug_cat.php in IndexScript 3.0 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component ownbiblio 1.5.3 - 'catid' SQL Injection

CVE-2008-6184—webappsphp

SQL injection vulnerability in the OwnBiblio (com_ownbiblio) component 1.5.3 for Joomla! allows remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

2532/Gigs 1.2.2 - Arbitrary Database Backup/Download

CVE-2008-6199—webappsphp

2532designs 2532|Gigs 1.2.2 and earlier allows remote attackers to trigger a backup and obtain sensitive information via

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.