Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,682cataloged exploits

39,953CVEs with public exploitation

24,696lab-tested

All Referência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

BinGo News 3.01 - 'bnrep' Remote File Inclusion

CVE-2006-4648—webappsphp

PHP remote file inclusion vulnerability in bp_ncom.php in BinGo News (BP News) 3.01 and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Links Directory 1.1 - 'cat_id' SQL Injection

CVE-2008-1871—webappsphp

SQL injection vulnerability in links.php in Scriptsagent.com Links Directory 1.1 allows remote authenticated users to ex

23RISK

open ↗

Referência✓ VexDay Proof

Comdev News Publisher 4.1.2 - SQL Injection

CVE-2008-1872—webappsphp

SQL injection vulnerability in home.news.php in Comdev News Publisher 4.1.2 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

5th Avenue Shopping Cart - 'category_id' SQL Injection

CVE-2008-1921—webappsphp

SQL injection vulnerability in store_pages/category_list.php in 5th Avenue Shopping Cart 1.2 trial edition allows remote

23RISK

open ↗

Referência✓ VexDay Proof

Zune Software - ActiveX Arbitrary File Overwrite

CVE-2008-1933—remotewindows

Absolute path traversal vulnerability in a certain ActiveX control in Zune allows user-assisted remote attackers to over

28RISK

open ↗

Referência✓ VexDay Proof

Grape Statistics 0.2a - 'location' Remote File Inclusion

CVE-2008-1963—webappsphp

PHP remote file inclusion vulnerability in includes/functions.php in Quate Grape Web Statistics 0.2a allows remote attac

35RISK

open ↗

Referência✓ VexDay Proof

SubEdit Player build 4066 - subtitle Buffer Overflow (PoC)

CVE-2008-1973—doswindows

Heap-based buffer overflow in SubEdit Player build 4056 and 4066 allows remote attackers to cause a denial of service (c

23RISK

open ↗

Referência✓ VexDay Proof

E RESERV 2.1 - 'index.php' SQL Injection

CVE-2008-1975—webappsphp

SQL injection vulnerability in index.php in E-RESERV 2.1 allows remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência✓ VexDay Proof

Acidcat CMS 3.4.1 - Multiple Vulnerabilities

CVE-2008-1992—webappsphp

Acidcat CMS 3.4.1 does not properly restrict access to (1) default_mail_aspemail.asp, (2) default_mail_cdosys.asp or (3)

23RISK

open ↗

Referência✓ VexDay Proof

Watchfire Appscan 7.0 - ActiveX Multiple Insecure Methods

CVE-2008-2015—remotewindows

Multiple absolute path traversal vulnerabilities in certain ActiveX controls in WatchFire AppScan 7.0 allow remote attac

23RISK

open ↗

Referência✓ VexDay Proof

MiniBB 2.2 - Cross-Site Scripting / SQL Injection / Full Path Disclosure

CVE-2008-2029—webappsphp

Multiple SQL injection vulnerabilities in (1) setup_mysql.php and (2) setup_options.php in miniBB 2.2 and possibly earli

23RISK

open ↗

Referência✓ VexDay Proof

Power Editor 2.0 - Remote File Disclosure / Edit

CVE-2008-2115—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in editor.php in ScriptsEZ.net Power Editor 2.0 allow remote attacke

23RISK

open ↗

Referência✓ VexDay Proof

ScorpNews 1.0 - 'site' Remote File Inclusion

CVE-2008-2193—webappsphp

PHP remote file inclusion vulnerability in example.php in Thomas Gossmann ScorpNews 2.0 allows remote attackers to execu

23RISK

open ↗

Referência✓ VexDay Proof

Linkspile - 'cat_id' SQL Injection

CVE-2008-2263—webappsphp

SQL injection vulnerability in linking.page.php in Automated Link Exchange Portal allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

Kostenloses Linkmanagementscript - Remote File Inclusion

CVE-2008-2270—webappsphp

Multiple PHP remote file inclusion vulnerabilities in PHPWAY Kostenloses Linkmanagementscript allow remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

webSPELL 4.01.01 - Database Backup Download

CVE-2006-4782—webappsphp

src/index.php in WebSPELL 4.01.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authe

23RISK

open ↗

Referência✓ VexDay Proof

newsmanager 2.0 - Remote File Inclusion / File Disclosure / SQL Injection

CVE-2008-2341—webappsphp

PHP remote file inclusion vulnerability in ch_readalso.php in News Manager 2.0 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

MeltingIce File System 1.0 - Arbitrary Add User

CVE-2008-2348—webappsphp

MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and e

23RISK

open ↗

Referência✓ VexDay Proof

WR-Meeting 1.0 - 'msnum' Local File Disclosure

CVE-2008-2355—webappsphp

Directory traversal vulnerability in index.php in WR-Meeting 1.0, when magic_quotes_gpc is disabled, allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

Web Group Communication Center (WGCC) 1.0.3 - SQL Injection

CVE-2008-2446—webappsphp

Multiple SQL injection vulnerabilities in Web Group Communication Center (WGCC) 1.0.3 PreRelease 1 and earlier allow rem

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component xsstream-dm 0.01b - SQL Injection

CVE-2008-2454—webappsphp

SQL injection vulnerability in the xsstream-dm (com_xsstream-dm) component 0.01 Beta for Joomla! allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

LibSPF2 < 1.2.8 - DNS TXT Record Parsing Bug Heap Overflow (PoC)

CVE-2008-2469—dosmultiple

Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remo

28RISK

open ↗

Referência✓ VexDay Proof

gf-3xplorer 2.4 - Cross-Site Scripting / Local File Inclusion

CVE-2007-6475—webappsphp

Multiple directory traversal vulnerabilities in GF-3XPLORER 2.4 allow remote attackers to include and execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Phoenix View CMS Pre Alpha2 - SQL Injection / Local File Inclusion / Cross-Site Scripting

CVE-2008-2533—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in Phoenix View CMS Pre Alpha2 and earlier allow remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

Phoenix View CMS Pre Alpha2 - SQL Injection / Local File Inclusion / Cross-Site Scripting

CVE-2008-2535—webappsphp

Multiple SQL injection vulnerabilities in Phoenix View CMS Pre Alpha2 and earlier allow remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

BP Blog 6.0 - 'id' Blind SQL Injection

CVE-2008-2554—webappsasp

Multiple SQL injection vulnerabilities in BP Blog 6.0 allow remote attackers to execute arbitrary SQL commands via the (

23RISK

open ↗

Referência✓ VexDay Proof

Power Phlogger 2.2.5 - 'css_str' SQL Injection

CVE-2008-2562—webappsphp

SQL injection vulnerability in edCss.php in PowerPhlogger 2.2.5 and earlier allows remote authenticated users to execute

23RISK

open ↗

Referência✓ VexDay Proof

TutorialCMS 1.00 - 'search.php?search' SQL Injection

CVE-2007-2600—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in TutorialCMS (aka Photoshop Tutorials) 1.00 and earlier allow remo

23RISK

open ↗

Referência✓ VexDay Proof

BrowserCRM 5.002.00 - 'clients.php' Remote File Inclusion

CVE-2008-2689—webappsphp

PHP remote file inclusion vulnerability in pub/clients.php in BrowserCRM 5.002.00 allows remote attackers to execute arb

35RISK

open ↗

Referência✓ VexDay Proof

JAMM CMS - 'id' Blind SQL Injection

CVE-2008-2755—webappsphp

SQL injection vulnerability in index.php in JAMM CMS allows remote attackers to execute arbitrary SQL commands via the i

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.