Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,794cataloged exploits
36,057CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,459Referência 22,721GitHub PoC 14,946VulnCheck XDB 8,829Nuclei 4,350Metasploit 3,489✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
OxYProject 0.85 - 'edithistory.php' Remote Code Execution
CVE-2008-6651—webappsphp
Static code injection vulnerability in edithistory.php in OxYProject OxYBox 0.85 allows remote attackers to inject arbit
23RISK
open ↗
Referência✓ VexDay Proof
CPCommerce 1.1.0 - 'id_category' SQL Injection
CVE-2007-2890—webappsphp
SQL injection vulnerability in category.php in cpCommerce 1.1.0 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
wanewsletter 2.1.3 - Remote File Inclusion
CVE-2007-2969—webappsphp
PHP remote file inclusion vulnerability in newsletter.php in WAnewsletter 2.1.3 and earlier allows remote attackers to e
35RISK
open ↗
Referência✓ VexDay Proof
Inout Search Engine - Remote Code Execution
CVE-2007-2988—webappsphp
A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administra
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Address Book 3.1.5 - SQL Injection / Cross-Site Scripting
CVE-2008-2566—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to inje
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component SimpleShop 3.4 - SQL Injection
CVE-2008-2568—webappsphp
SQL injection vulnerability in the Simple Shop Galore (com_simpleshop) component 3.4 and earlier for Joomla! allows remo
23RISK
open ↗
Referência✓ VexDay Proof
freeSSHd 1.2.1 - (Authenticated) Remote Stack Overflow (PoC)
CVE-2008-2573—doswindows
Stack-based buffer overflow in SFTP in freeSSHd 1.2.1 allows remote authenticated users to execute arbitrary code via a
23RISK
open ↗
Referência✓ VexDay Proof
freeSSHd 1.2.1 - (Authenticated) Remote Overflow (SEH)
CVE-2008-2573—remotewindows
Stack-based buffer overflow in SFTP in freeSSHd 1.2.1 allows remote authenticated users to execute arbitrary code via a
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component JooBlog 0.1.1 - Blind SQL Injection
CVE-2008-2630—webappsphp
SQL injection vulnerability in the JooBlog (com_jb2) component 0.1.1 for Joomla! allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
PHP 'COM' Extensions - inconsistent Win32 'safe_mode' Bypass
CVE-2007-1382—localwindows
The PHP COM extensions for PHP on Windows systems allow context-dependent attackers to execute arbitrary code via a WScr
23RISK
open ↗
Referência✓ VexDay Proof
Acoustica Mixcraft 4.2 - Universal Stack Overflow (SEH)
CVE-2008-3877—localwindows
Stack-based buffer overflow in Acoustica Mixcraft 4.1 Build 96 and 4.2 Build 98 allows user-assisted attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
Ultra Office - ActiveX Control Arbitrary File Corruption
CVE-2008-3879—doswindows
The Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 and earlier in Ultra Shareware Ultra Office Contr
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component JoomRadio 1.0 - 'id' SQL Injection
CVE-2008-2633—webappsphp
Multiple SQL injection vulnerabilities in the EXP JoomRadio (com_joomradio) component 1.0 for Joomla! allow remote attac
23RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Adult Directory - 'directory.php' SQL Injection
CVE-2008-6784—webappsphp
SQL injection vulnerability in directory.php in Scripts For Sites (SFS) EZ Adult Directory allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module eCal 2.24 - 'display.php' SQL Injection
CVE-2007-1813—webappsphp
SQL injection vulnerability in display.php in the eCal 2.24 and earlier module for Xoops allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
Acoustica MP3 CD Burner 4.32 - Local Buffer Overflow (PoC)
CVE-2007-3006—doswindows
Buffer overflow in Acoustica MP3 CD Burner 4.32 allows user-assisted remote attackers to execute arbitrary code via a .a
23RISK
open ↗
Referência✓ VexDay Proof
mebiblio 0.4.7 - SQL Injection / Arbitrary File Upload / Cross-Site Scripting
CVE-2008-2647—webappsphp
SQL injection vulnerability in admin/journal_change_mask.inc.php in meBiblio 0.4.7 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
CMSimple 3.1 - Local File Inclusion / Arbitrary File Upload
CVE-2008-2650—webappsphp
Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote a
43RISK
open ↗
Referência✓ VexDay Proof
smeweb 1.4b - SQL Injection / Cross-Site Scripting
CVE-2008-2652—webappsphp
Multiple SQL injection vulnerabilities in catalog.php in SMEWeb 1.4b and 1.4f allow remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
CMME 1.12 - Local File Inclusion / Cross-Site Scripting / Cross-Site Request Forgery/Download Backup/Make Directory
CVE-2008-3926—webappsphp
Multiple directory traversal vulnerabilities in Content Management Made Easy (CMME) 1.12 allow remote attackers to (1) r
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component iJoomla! News Portal 1.0 - 'itemID' SQL Injection
CVE-2008-2676—webappsphp
SQL injection vulnerability in the iJoomla News Portal (com_news_portal) component 1.0 and earlier for Joomla! allows re
23RISK
open ↗
Referência✓ VexDay Proof
Telephone Directory 2008 - SQL Injection / Cross-Site Scripting
CVE-2008-2677—webappsphp
Cross-site scripting (XSS) vulnerability in edit1.php in Telephone Directory 2008 allows remote attackers to inject arbi
23RISK
open ↗
Referência✓ VexDay Proof
realm CMS 2.3 - Multiple Vulnerabilities
CVE-2008-2680—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in _db/compact.asp in Realm CMS 2.3 and earlier allow remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
EsFaq 2.0 - 'idcat' SQL Injection
CVE-2008-3952—webappsphp
SQL injection vulnerability in questions.php in EsFaq 2.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Ice Gallery 0.5b2 - 'catid' Blind SQL Injection
CVE-2008-6852—webappsphp
SQL injection vulnerability in the Ice Gallery (com_ice) component 0.5 beta 2 for Joomla! allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Active Web Mail 4 - Blind SQL Injection
CVE-2008-6873—webappsasp
SQL injection vulnerability in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL commands via the Tab
23RISK
open ↗
Referência✓ VexDay Proof
ASPSiteWare Automotive Dealer 1.0/2.0 - SQL Injection
CVE-2008-6874—webappsphp
Multiple SQL injection vulnerabilities in ASP SiteWare autoDealer 1 and 2 allow remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
Black Ice Software Inc Barcode SDK - 'BIDIB.ocx' Multiple Vulnerabilities
CVE-2008-2684—remotewindows
The BIDIB.BIDIBCtrl.1 ActiveX control in BIDIB.ocx 10.9.3.0 in Black Ice Barcode SDK 5.01 allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Flux CMS 1.5.0 - 'loadsave.php' Arbitrary File Overwrite
CVE-2008-2686—webappsphp
webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overw
23RISK
open ↗
Referência✓ VexDay Proof
BrowserCRM 5.002.00 - 'clients.php' Remote File Inclusion
CVE-2008-2689—webappsphp
PHP remote file inclusion vulnerability in pub/clients.php in BrowserCRM 5.002.00 allows remote attackers to execute arb
35RISK
open ↗
← previouspage 9 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.