Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,230cataloged exploits
36,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
E-Store Kit-1 < 2 PayPal Edition - 'pid' SQL Injection
CVE-2008-3594—webappsphp
SQL injection vulnerability in viewdetails.php in MagicScripts E-Store Kit-1, E-Store Kit-2, E-Store Kit-1 Pro PayPal Ed
23RISK
open ↗
Referência✓ VexDay Proof
Constructr CMS 3.02.5 stable - Multiple Vulnerabilities
CVE-2008-5847—webappsphp
Constructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent atta
23RISK
open ↗
Referência✓ VexDay Proof
TekBase All-in-One 3.1 - Multiple SQL Injections
CVE-2009-2120—webappsphp
Multiple SQL injection vulnerabilities in TekBase All-in-One 3.1 allow remote authenticated users to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
GPS CMS 1.2 - 'print.asp' SQL Injection
CVE-2007-0554—webappsasp
SQL injection vulnerability in print.asp in Guo Xu Guos Posting System (GPS) 1.2 allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
PHPDirector 0.21 - 'videos.php?id' SQL Injection
CVE-2007-3562—webappsphp
SQL injection vulnerability in videos.php in PHP Director 0.21 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Blog:CMS 4.2.1b - SQL Injection / Cross-Site Scripting
CVE-2008-0359—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in BLOG:CMS 4.2.1b allow remote attackers to inject arbitrary web sc
23RISK
open ↗
Referência✓ VexDay Proof
mutiple timesheets 5.0 - Multiple Vulnerabilities
CVE-2008-1414—webappsphp
Cross-site scripting (XSS) vulnerability in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
ViArt Shop 3.5 - 'category_id' SQL Injection
CVE-2008-3369—webappsphp
SQL injection vulnerability in products_rss.php in ViArt Shop 3.5 and earlier allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2008-6510—webappsjsp
Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and earlier allows remote
23RISK
open ↗
Referência✓ VexDay Proof
NuCommunity 1.0 - 'cl_CatListing.asp' SQL Injection
CVE-2006-5881—webappsasp
SQL injection vulnerability in cl_CatListing.asp in Dynamic Dataworx NuCommunity 1.0 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Yblog 0.2.2.2 - Cross-Site Scripting / SQL Injection
CVE-2008-2668—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in yBlog 0.2.2.2 allow remote attackers to inject arbitrary web scri
23RISK
open ↗
Referência✓ VexDay Proof
Claroline 1.7.6 - 'includePath' Remote Code Execution
CVE-2006-2868—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.6 allow remote attackers to execute arbitrary PHP co
28RISK
open ↗
Referência✓ VexDay Proof
OneCMS 2.4 - SQL Injection / Upload
CVE-2008-7208—webappsphp
Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
AuraCMS 2.2 - 'albums' Pramater SQL Injection
CVE-2008-0735—webappsphp
SQL injection vulnerability in mod/gallery/ajax/gallery_data.php in AuraCMS 2.2 allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
dnGuestbook 2.0 - SQL Injection
CVE-2006-1710—webappsphp
SQL injection vulnerability in admin.php in Design Nation DNGuestbook 2.0 allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
ig shop 1.0 - Code Execution / SQL Injection
CVE-2007-0132—webappsphp
SQL injection vulnerability in compare_product.php in iGeneric iG Shop 1.4 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
aspwebalbum 3.2 - Multiple Vulnerabilities
CVE-2008-6977—webappsasp
Cross-site scripting (XSS) vulnerability in album.asp in Full Revolution aspWebAlbum 3.2 allows remote attackers to inje
23RISK
open ↗
Referência✓ VexDay Proof
A-Link WL54AP3 / WL54AP2 - Cross-Site Request Forgery / Cross-Site Scripting
CVE-2008-6823—remotehardware
Multiple cross-site request forgery (CSRF) vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2
23RISK
open ↗
Referência✓ VexDay Proof
FunkBoard CF0.71 - 'profile.php' Remote User Pass Change
CVE-2006-2896—webappsphp
profile.php in FunkBoard CF0.71 allows remote attackers to change arbitrary passwords via a modified uid hidden form fie
23RISK
open ↗
Referência✓ VexDay Proof
ModernBill 4.4.x - Cross-Site Scripting / Remote File Inclusion
CVE-2008-5059—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in ModernBill 4.4 and earlier allows remote attackers to inject ar
23RISK
open ↗
Referência✓ VexDay Proof
cPanel WebHost Manager (WHM) - '/webmail/x3/mail/clientconf.html?acct' Cross-Site Scripting
CVE-2012-6448—webappsphp
Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗
Referência✓ VexDay Proof
phpBazar 2.0.2 - 'adid' SQL Injection
CVE-2008-3767—webappsphp
SQL injection vulnerability in classified.php in phpBazar 2.0.2 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
427bb 2.3.1 - SQL Injection / Cross-Site Scripting
CVE-2008-2561—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in 427BB 2.3.1 allow remote attackers to inject arbitrary web script
23RISK
open ↗
Referência✓ VexDay Proof
ClanLite 2.x - SQL Injection / Cross-Site Scripting
CVE-2008-5214—webappsphp
Cross-site scripting (XSS) vulnerability in service/calendrier.php in ClanLite 2.2006.05.20 allows remote attackers to i
23RISK
open ↗
Referência✓ VexDay Proof
ourvideo CMS 9.5 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2008-2979—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in phpi/login.php in Ourvideo CMS 9.5 allow remote attackers to inje
23RISK
open ↗
Referência✓ VexDay Proof
gf-3xplorer 2.4 - Cross-Site Scripting / Local File Inclusion
CVE-2007-6474—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in GF-3XPLORER 2.4 allow remote attackers to inject arbitrary web sc
23RISK
open ↗
Referência✓ VexDay Proof
NetRisk 1.9.7 - Cross-Site Scripting / SQL Injection
CVE-2008-0186—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in NetRisk 1.9.7 and possibly earlier allows remote attackers to i
23RISK
open ↗
Referência✓ VexDay Proof
myPHPNuke < 1.8.8_8rc2 - Cross-Site Scripting / SQL Injection
CVE-2008-4089—webappsphp
Cross-site scripting (XSS) vulnerability in print.php in myPHPNuke (MPN) before 1.8.8_8rc2 allows remote attackers to in
23RISK
open ↗
Referência✓ VexDay Proof
isweb CMS 3.0 - SQL Injection / Cross-Site Scripting
CVE-2008-5933—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in index.php in CMS ISWEB 3.0 allow remote attackers to inject arbit
23RISK
open ↗
Referência✓ VexDay Proof
WEBBDOMAIN WebShop 1.02 - SQL Injection / Cross-Site Scripting
CVE-2008-6629—webappsphp
Cross-site scripting (XSS) vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote a
23RISK
open ↗
← previouspage 110 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.