Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Redaxo 3.2 - 'INCLUDE_PATH' Remote File Inclusion
CVE-2006-2843—webappsphp
PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute arbitrary PHP code via a URL
23RISK
open ↗
Referência✓ VexDay Proof
Click N Print Coupons 2006.01 - 'key' SQL Injection
CVE-2006-6859—webappsasp
SQL injection vulnerability in coupon_detail.asp in Website Designs For Less Click N' Print Coupons 2005.01 and earlier
23RISK
open ↗
Referência✓ VexDay Proof
otscms 2.1.5 - SQL Injection / Cross-Site Scripting
CVE-2007-0846—webappsphp
Cross-site scripting (XSS) vulnerability in forum.php in Open Tibia Server CMS (OTSCMS) 2.1.5 and earlier allows remote
23RISK
open ↗
Referência✓ VexDay Proof
GL-SH Deaf Forum 6.4.4 - Local File Inclusion
CVE-2007-3535—webappsphp
Multiple directory traversal vulnerabilities in GL-SH Deaf Forum 6.4.4 and earlier allow remote attackers to include and
23RISK
open ↗
Referência✓ VexDay Proof
Pluxml 0.3.1 - Remote Code Execution
CVE-2007-3542—webappsphp
Cross-site scripting (XSS) vulnerability in admin/auth.php in Pluxml 0.3.1 allows remote attackers to inject arbitrary w
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module PopnupBlog 2.52 - 'postid' Blind SQL Injection
CVE-2007-1979—webappsphp
SQL injection vulnerability in index.php in the PopnupBlog 2.52 and earlier module for Xoops allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
NuCommunity 1.0 - 'cl_CatListing.asp' SQL Injection
CVE-2006-5881—webappsasp
SQL injection vulnerability in cl_CatListing.asp in Dynamic Dataworx NuCommunity 1.0 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
mutiple timesheets 5.0 - Multiple Vulnerabilities
CVE-2008-1414—webappsphp
Cross-site scripting (XSS) vulnerability in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
ViArt Shop 3.5 - 'category_id' SQL Injection
CVE-2008-3369—webappsphp
SQL injection vulnerability in products_rss.php in ViArt Shop 3.5 and earlier allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2008-6510—webappsjsp
Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and earlier allows remote
23RISK
open ↗
Referência✓ VexDay Proof
PHPDirector 0.21 - 'videos.php?id' SQL Injection
CVE-2007-3562—webappsphp
SQL injection vulnerability in videos.php in PHP Director 0.21 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
PlaySms 0.9.3 - Multiple Local/Remote File Inclusions
CVE-2009-0103—webappsphp
Multiple PHP remote file inclusion vulnerabilities in playSMS 0.9.3 allow remote attackers to execute arbitrary PHP code
28RISK
open ↗
Referência✓ VexDay Proof
Mundi Mail 0.8.2 - 'top' Remote File Inclusion
CVE-2009-2095—webappsphp
PHP remote file inclusion vulnerability in template/simpledefault/admin/_masterlayout.php in Mundi Mail 0.8.2, when regi
23RISK
open ↗
Referência✓ VexDay Proof
MP3 TrackMaker 1.5 - '.mp3' Local Heap Overflow (PoC)
CVE-2009-0175—doswindows
Heap-based buffer overflow in Heathco Software MP3 TrackMaker 1.5 allows remote attackers to cause a denial of service (
23RISK
open ↗
Referência✓ VexDay Proof
elvin bts 1.2.0 - Multiple Vulnerabilities
CVE-2009-2130—webappsphp
Elvin 1.2.0 allows remote attackers to read the PHP source code of (1) login.ei, (2) jump_bug.ei, or (3) create_account.
23RISK
open ↗
Referência✓ VexDay Proof
EnjoySAP ActiveX rfcguisink.rfcguisink.1 - Remote Heap Overflow (PoC)
CVE-2007-3606—doswindows
Heap-based buffer overflow in the rfcguisink.rfcguisink.1 ActiveX control in the EnjoySAP SAP GUI, on systems using ASCI
23RISK
open ↗
Referência✓ VexDay Proof
dnGuestbook 2.0 - SQL Injection
CVE-2006-1710—webappsphp
SQL injection vulnerability in admin.php in Design Nation DNGuestbook 2.0 allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
EnjoySAP ActiveX kweditcontrol.kwedit.1 - Remote Stack Overflow (PoC)
CVE-2007-3607—doswindows
Multiple unspecified vulnerabilities in ActiveX controls in the EnjoySAP SAP GUI allow remote attackers to cause a denia
23RISK
open ↗
Referência✓ VexDay Proof
pivot 1.40.4-7 - Multiple Vulnerabilities
CVE-2009-2134—webappsphp
pivot/tb.php in Pivot 1.40.4 and 1.40.7 allows remote attackers to obtain sensitive information via an invalid url param
23RISK
open ↗
Referência✓ VexDay Proof
ig shop 1.0 - Code Execution / SQL Injection
CVE-2007-0132—webappsphp
SQL injection vulnerability in compare_product.php in iGeneric iG Shop 1.4 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
EnjoySAP ActiveX rfcguisink.rfcguisink.1 - Remote Heap Overflow (PoC)
CVE-2007-3608—doswindows
Multiple unspecified vulnerabilities in ActiveX controls in the EnjoySAP SAP GUI allow remote attackers to create certai
23RISK
open ↗
Referência✓ VexDay Proof
VRNews 1.1.1 - 'admin.php' Remote Security Bypass
CVE-2007-3611—webappsphp
admin.php in VRNews 1.1.1, and possibly other 1.x versions, does not require authentication, which allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
A-Link WL54AP3 / WL54AP2 - Cross-Site Request Forgery / Cross-Site Scripting
CVE-2008-6823—remotehardware
Multiple cross-site request forgery (CSRF) vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Wordpad - '.doc' File Local Denial of Service (PoC)
CVE-2009-0259—doswindows
The Word processor in OpenOffice.org 1.1.2 through 1.1.5 allows remote attackers to cause a denial of service (crash) an
23RISK
open ↗
Referência✓ VexDay Proof
GameSiteScript 3.1 - profile id SQL Injection
CVE-2007-3631—webappsphp
SQL injection vulnerability in index.php in GameSiteScript (gss) 3.1 and earlier allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
Gravy Media Photo Host 1.0.8 - Local File Disclosure
CVE-2009-2184—webappsphp
Absolute path traversal vulnerability in forcedownload.php in Gravy Media Photo Host 1.0.8 allows remote attackers to re
23RISK
open ↗
Referência✓ VexDay Proof
HP Digital Imaging 'hpqvwocx.dll 2.1.0.556' - 'SaveToFile()' File Write
CVE-2007-3649—remotewindows
Absolute path traversal vulnerability in a certain ActiveX control in hpqvwocx.dll 2.1.0.556 in Hewlett-Packard (HP) Dig
23RISK
open ↗
Referência✓ VexDay Proof
Vigile CMS 1.4 - Multiple Vulnerabilities
CVE-2007-6085—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in index.php in VigileCMS 1.4 allow remote attackers to inject arbit
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Fusion Module topliste 1.0 - 'cid' SQL Injection
CVE-2007-1980—webappsphp
SQL injection vulnerability in index.php in the Topliste 1.0 module for PHP-Fusion allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
BibCiter 1.4 - Multiple SQL Injections
CVE-2009-0324—webappsphp
Multiple SQL injection vulnerabilities in BibCiter 1.4 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
← previouspage 93 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.