Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,211cataloged exploits
36,421CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,464Referência 23,022GitHub PoC 15,027VulnCheck XDB 8,846Nuclei 4,361Metasploit 3,491✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
phpsyncml 0.1.2 - Remote File Inclusion
CVE-2007-4978—webappsphp
Multiple PHP remote file inclusion vulnerabilities in phpSyncML 0.1.2 and earlier allow remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
PowerBook 1.21 - 'index.php' Local File Inclusion
CVE-2008-1537—webappsphp
Directory traversal vulnerability in pb_inc/admincenter/index.php in PowerScripts PowerBook 1.21 allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
WebCreator 0.2.6-rc3 - 'moddir' Remote File Inclusion
CVE-2007-1459—webappsphp
Multiple PHP remote file inclusion vulnerabilities in WebCreator 0.2.6-rc3 and earlier allow remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6502—webappsasp
Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to obtain sensitive information via (1)
23RISK
open ↗
Referência✓ VexDay Proof
Multi-Page Comment System 1.1.0 - Insecure Cookie Handling
CVE-2008-2293—webappsphp
admin.php in Multi-Page Comment System (MPCS) 1.0 and 1.1 allows remote attackers to bypass authentication and gain priv
23RISK
open ↗
Referência✓ VexDay Proof
Galatolo Web Manager 1.0 - SQL Injection
CVE-2008-2700—webappsphp
SQL injection vulnerability in view.php in Galatolo WebManager 1.0 and earlier allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
AyeView 2.20 - Invalid Bitmap Header Parsing Crash
CVE-2008-5937—doswindows
AyeView 2.20 allows user-assisted attackers to cause a denial of service (memory consumption or application crash) via a
23RISK
open ↗
Referência✓ VexDay Proof
Gravy Media Photo Host 1.0.8 - Local File Disclosure
CVE-2009-2184—webappsphp
Absolute path traversal vulnerability in forcedownload.php in Gravy Media Photo Host 1.0.8 allows remote attackers to re
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin Download - 'dl_id' SQL Injection
CVE-2008-1646—webappsphp
SQL injection vulnerability in wp-download.php in the WP-Download 1.2 plugin for WordPress allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
Simple HTTPd 1.38 - Multiple Vulnerabilities
CVE-2007-6404—remotewindows
Directory traversal vulnerability in Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin WP-Cal 0.3 - 'editevent.php' SQL Injection
CVE-2008-0490—webappsphp
SQL injection vulnerability in functions/editevent.php in the WP-Cal 0.3 plugin for WordPress allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
HomePH Design 2.10 RC2 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2008-2981—webappsphp
PHP remote file inclusion vulnerability in admin/templates/template_thumbnail.php in HomePH Design 2.10 RC2, when regist
23RISK
open ↗
Referência✓ VexDay Proof
Acc Autos 4.0 - Insecure Cookie Handling
CVE-2008-6292—webappsphp
Acc Autos 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the (1) usernam
23RISK
open ↗
Referência✓ VexDay Proof
AvailScript Jobs Portal Script - (Authenticated) Arbitrary File Upload
CVE-2008-7021—webappsphp
Unrestricted file upload vulnerability in editlogo.php in AvailScript Jobs Portal Script allows remote authenticated use
23RISK
open ↗
Referência✓ VexDay Proof
Popcorn 1.87 - Remote Heap Overflow (PoC)
CVE-2009-1647—doswindows
Heap-based buffer overflow in popcorn.exe in Ultrafunk Popcorn 1.87 allows remote POP3 servers to cause a denial of serv
23RISK
open ↗
Referência✓ VexDay Proof
Web Oddity Web Server 0.09b - Directory Traversal
CVE-2007-4726—remotelinux
Directory traversal vulnerability in Web Oddity 0.09b allows remote attackers to read arbitrary files via a .. (dot dot)
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component GameQ 4.0 - SQL Injection
CVE-2008-2701—webappsphp
SQL injection vulnerability in the GameQ (com_gameq) component 4.0 and earlier for Joomla! allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
e107 0.617 - Cross-Site Scripting Remote Cookie Disclosure
CVE-2005-2327—webappsphp
Cross-site scripting (XSS) vulnerability in e107 0.617 and earlier allows remote attackers to inject arbitrary web scrip
23RISK
open ↗
Referência✓ VexDay Proof
SiteBuilderElite 1.2 - Multiple Remote File Inclusions
CVE-2008-1123—webappsphp
Multiple PHP remote file inclusion vulnerabilities in SiteBuilder Elite 1.2 allow remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
JShop 1.x < 2.x - 'xPage' Local File Inclusion
CVE-2008-1624—webappsphp
Directory traversal vulnerability in v2demo/page.php in Jshop Server 1.x through 2.x allows remote attackers to include
23RISK
open ↗
Referência✓ VexDay Proof
UBBCentral UBB.Threads 6.4.x < 6.5.2 - 'thispath' Remote File Inclusion
CVE-2006-2568—webappsphp
PHP remote file inclusion vulnerability in addpost_newpoll.php in UBB.threads 6.4 through 6.5.2 and 6.5.1.1 (trial) allo
23RISK
open ↗
Referência✓ VexDay Proof
VidShare Pro - Arbitrary File Upload
CVE-2009-1750—webappsphp
Unrestricted file upload vulnerability in VidSharePro allows remote authenticated users to execute arbitrary code by upl
23RISK
open ↗
Referência✓ VexDay Proof
Sisfo Kampus 2006 - 'dwoprn.php?f' Arbitrary File Download
CVE-2007-4895—webappsphp
Directory traversal vulnerability in dwoprn.php in Sisfo Kampus 2006 (Semarang 3) allows remote attackers to read arbitr
23RISK
open ↗
Referência✓ VexDay Proof
AlkalinePHP 0.77.35 - 'adduser.php' Arbitrary Add Admin
CVE-2008-2346—webappsphp
AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creat
23RISK
open ↗
Referência✓ VexDay Proof
Tlnews 2.2 - Insecure Cookie Handling
CVE-2008-4752—webappsphp
TlNews 2.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlNews_login c
23RISK
open ↗
Referência✓ VexDay Proof
Poppawid 2.7 - 'form' Remote File Inclusion
CVE-2007-5221—webappsphp
PHP remote file inclusion vulnerability in mail/childwindow.inc.php in Poppawid 2.7 allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
RunCMS 1.6 - Multiple Vulnerabilities
CVE-2007-6546—webappsphp
RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a m
23RISK
open ↗
Referência✓ VexDay Proof
adaptweb 0.9.2 - Local File Inclusion / SQL Injection
CVE-2009-2151—webappsphp
Directory traversal vulnerability in index.php in AdaptWeb 0.9.2 allows remote attackers to read arbitrary files via a .
23RISK
open ↗
Referência✓ VexDay Proof
Noticeware E-mail Server 5.1.2.2 - 'POP3' Denial of Service
CVE-2008-6185—doswindows
NoticeWare Email Server NG 5.1.2.2 allows remote attackers to cause a denial of service (crash) via multiple POP3 reques
23RISK
open ↗
Referência✓ VexDay Proof
BolinOS 4.6.1 - Local File Inclusion / Cross-Site Scripting
CVE-2008-1557—webappsphp
BolinOS 4.6.1 allows remote attackers to obtain sensitive information via a direct request to system/actionspages/_b/con
23RISK
open ↗
← previouspage 101 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.