Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,230cataloged exploits

36,424CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

DomPHP 0.81 - Remote Add Administrator

CVE-2008-0282—webappsphp

SQL injection vulnerability in welcome/inscription.php in DomPHP 0.81 and earlier allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

Foojan Wms 1.0 - 'story' SQL Injection

CVE-2008-0447—webappsphp

SQL injection vulnerability in index.php in Foojan WMS PHP Weblog 1.0 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Easysitenetwork Recipe - 'categoryId' SQL Injection

CVE-2008-0453—webappsphp

SQL injection vulnerability in list.php in Easysitenetwork Recipe allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

Liquid-Silver CMS 0.1 - 'update' Local File Inclusion

CVE-2008-0459—webappsphp

Directory traversal vulnerability in update/index.php in Liquid-Silver CMS 0.35, when magic_quotes_gpc is disabled, allo

23RISK

open ↗

Referência✓ VexDay Proof

OneCMS 2.4 - 'abc' SQL Injection

CVE-2007-5016—webappsphp

SQL injection vulnerability in userreviews.php in OneCMS 2.4 allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência✓ VexDay Proof

Airsensor M520 - HTTPd Remote Denial of Service / Buffer Overflow (PoC)

CVE-2007-5036—doshardware

Multiple buffer overflows in the AirDefense Airsensor M520 with firmware 4.3.1.1 and 4.4.1.4 allow remote authenticated

23RISK

open ↗

Referência✓ VexDay Proof

neuron news 1.0 - 'index.php?q' Local File Inclusion

CVE-2007-5050—webappsphp

Directory traversal vulnerability in index.php in Neuron News 1.0 allows remote attackers to include and execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

PhFiTo 1.3.0 - 'SRC_PATH' Remote File Inclusion

CVE-2007-5157—webappsphp

PHP remote file inclusion vulnerability in phfito-post.php in Alex Kocharin PHP Fidonet Tosser (PhFiTo) 1.3.0 in phpFido

23RISK

open ↗

Referência✓ VexDay Proof

PHP Links 1.3 - 'id' SQL Injection

CVE-2008-0565—webappsphp

SQL injection vulnerability in vote.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

FSFDT v3.000 d9 - 'HELP' Remote Buffer Overflow

CVE-2007-5256—remotewindows

Multiple stack-based buffer overflows in FSD 2.052 d9 and earlier, and FSFDT FSD 3.000 d9 and earlier, allow (1) remote

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_Marketplace 1.1.1 - SQL Injection

CVE-2008-0689—webappsphp

SQL injection vulnerability in index.php in the Marketplace (com_marketplace) 1.1.1 and 1.1.1-pl1 component for Joomla!

23RISK

open ↗

Referência✓ VexDay Proof

BookmarkX script 2007 - 'topicid' SQL Injection

CVE-2008-0695—webappsphp

SQL injection vulnerability in index.php in BookmarkX script 2007 allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

ImageStation - 'SonyISUpload.cab 1.0.0.38' ActiveX Buffer Overflow (PoC)

CVE-2008-0748—doswindows

Buffer overflow in the Sony AxRUploadServer.AxRUploadControl.1 ActiveX control in AxRUploadServer.dll 1.0.0.38 in SonyIS

28RISK

open ↗

Referência✓ VexDay Proof

phpArcadeScript 3.0RC2 - 'userid' SQL Injection

CVE-2008-1163—webappsphp

SQL injection vulnerability in index.php in phpArcadeScript 1.0 through 3.0 RC2 allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

1024 CMS 1.4.2 - Local File Inclusion / Blind SQL Injection

CVE-2008-1911—webappsphp

SQL injection vulnerability in includes/system.php in 1024 CMS 1.4.2 beta and earlier, when magic_quotes_gpc is disabled

23RISK

open ↗

Referência✓ VexDay Proof

Dream4 Koobi Pro 6.25 Poll - 'poll_id' SQL Injection

CVE-2008-2036—webappsphp

SQL injection vulnerability in index.php in dream4 Koobi Pro 6.25 allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

AlkalinePHP 0.80.00 Beta - 'thread.php' SQL Injection

CVE-2008-2395—webappsphp

SQL injection vulnerability in thread.php in AlkalinePHP 0.80.00 beta and earlier allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

FicHive 1.0 - 'category' Blind SQL Injection

CVE-2008-2416—webappsphp

SQL injection vulnerability in index.php in FicHive 1.0 allows remote attackers to execute arbitrary SQL commands via th

23RISK

open ↗

Referência✓ VexDay Proof

1Book Guestbook Script 1.0.1 - Code Execution

CVE-2008-2638—webappsphp

Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitr

23RISK

open ↗

Referência✓ VexDay Proof

emagiC CMS.Net 4.0 - 'emc.asp' SQL Injection

CVE-2007-5783—webappsasp

SQL injection vulnerability in emc.asp in emagiC CMS.Net 4.0 allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência✓ VexDay Proof

CaupoShop Pro 2.x - 'action' Remote File Inclusion

CVE-2007-5784—webappsphp

PHP remote file inclusion vulnerability in index.php in CaupoShop Pro 2.x allows remote attackers to execute arbitrary P

23RISK

open ↗

Referência✓ VexDay Proof

ASPilot Pilot Cart 7.3 - 'article' SQL Injection

CVE-2008-2688—webappsasp

SQL injection vulnerability in pilot.asp in ASPilot Pilot Cart 7.3 allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

ResearchGuide 0.5 - 'id' SQL Injection

CVE-2008-2964—webappsphp

SQL injection vulnerability in guide.php in ResearchGuide 0.5 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

Softbiz Ad Management plus Script 1 - SQL Injection

CVE-2007-5998—webappsphp

SQL injection vulnerability in ads.php in Softbiz Ad Management plus Script 1 allows remote authenticated users to execu

23RISK

open ↗

Referência✓ VexDay Proof

IceBB 1.0-rc6 - Remote Database Authentication Details

CVE-2007-6083—webappsphp

SQL injection vulnerability in admin/index.php in IceBB 1.0-rc6 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

bilboblog 2.1 - Multiple Vulnerabilities

CVE-2008-3303—webappsphp

admin/login.php in BilboBlog 0.2.1, when register_globals is enabled, allows remote attackers to bypass authentication a

23RISK

open ↗

Referência✓ VexDay Proof

Eurologon CMS - Multiple SQL Injections

CVE-2007-6164—webappsphp

Multiple SQL injection vulnerabilities in Eurologon CMS allow remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência✓ VexDay Proof

Apple QuickTime 7.2/7.3 - RTSP Response Remote Overwrite (SEH)

CVE-2007-6166—dosmultiple

Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac

50RISK

open ↗

Referência✓ VexDay Proof

WebStudio eCatalogue - Blind SQL Injection

CVE-2008-5294—webappsphp

SQL injection vulnerability in index.php in WebStudio eCatalogue allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

PG Real Estate - Authentication Bypass

CVE-2008-5306—webappsphp

SQL injection vulnerability in admin/index.php in PG Real Estate Solution allows remote attackers to execute arbitrary S

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.