Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,230cataloged exploits

36,424CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

Joomla! Component Restaurante 1.0 - 'id' SQL Injection

CVE-2008-1465—webappsphp

SQL injection vulnerability in the Detodas Restaurante (com_restaurante) 1.0 component for Mambo and Joomla! allows remo

23RISK

open ↗

Referência✓ VexDay Proof

Alstrasoft e-Friends 4.98 - 'seid' Multiple SQL Injections

CVE-2007-6106—webappsphp

SQL injection vulnerability in index.php in AlstraSoft E-Friends 4.98 and earlier allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

Softbiz Web Host Directory Script - 'host_id' SQL Injection

CVE-2008-2087—webappsphp

SQL injection vulnerability in search_result.php in Softbiz Web Host Directory Script, when magic_quotes_gpc is disabled

23RISK

open ↗

Referência✓ VexDay Proof

Links Management Application 1.0 - 'lcnt' SQL Injection

CVE-2007-1339—webappsphp

SQL injection vulnerability in index.php in Links Management Application 1.0 allows remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

Dew-NewPHPLinks 2.0 - Local File Inclusion / Cross-Site Scripting

CVE-2009-1623—webappsphp

Cross-site scripting (XSS) vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to inject arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Ipswitch WS_FTP Home/Professional FTP Client - Remote Format String (PoC)

CVE-2008-3795—doswindows

Buffer overflow in Ipswitch WS_FTP Home client allows remote FTP servers to have an unknown impact via a long "message r

28RISK

open ↗

Referência✓ VexDay Proof

skyportal vrc6 - Multiple Vulnerabilities

CVE-2007-6078—webappsphp

Multiple SQL injection vulnerabilities in SkyPortal RC6 allow remote attackers to execute arbitrary SQL commands via uns

23RISK

open ↗

Referência✓ VexDay Proof

Acoustica Mixcraft 4.2 Build 98 - 'mx4' Local Buffer Overflow

CVE-2008-3877—localwindows

Stack-based buffer overflow in Acoustica Mixcraft 4.1 Build 96 and 4.2 Build 98 allows user-assisted attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

Pc4Uploader 9.0 - Blind SQL Injection

CVE-2009-1742—webappsphp

code.php in PC4Arb Pc4 Uploader 9.0 and earlier makes it easier for remote attackers to conduct SQL injection attacks vi

23RISK

open ↗

Referência✓ VexDay Proof

PHPNS 1.1 - 'shownews.php?id' SQL Injection

CVE-2007-4628—webappsphp

SQL injection vulnerability in shownews.php in phpns 1.1 allows remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência✓ VexDay Proof

Anserv Auction XL - 'cat' SQL Injection

CVE-2008-2189—webappsphp

SQL injection vulnerability in viewfaqs.php in AnServ Auction XL allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

Cahier de texte 2.0 - 'lire.php' SQL Injection

CVE-2006-5221—webappsphp

Multiple SQL injection vulnerabilities in Cahier de texte 2.0 allow remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência✓ VexDay Proof

CMME 1.12 - Local File Inclusion / Cross-Site Scripting / Cross-Site Request Forgery/Download Backup/Make Directory

CVE-2008-3924—webappsphp

The "Make a backup" functionality in Content Management Made Easy (CMME) 1.12 stores sensitive information under the web

23RISK

open ↗

Referência✓ VexDay Proof

UStore 1.0 - 'detail.asp' SQL Injection

CVE-2006-5891—webappsasp

SQL injection vulnerability in detail.asp in Superfreaker Studios UStore 1.0 allows remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

Estate Agent Manager 1.3 - 'default.asp' Authentication Bypass

CVE-2006-5934—webappsasp

SQL injection vulnerability in admin/default.asp in Estate Agent Manager 1.3 and earlier allows remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

Pre Shopping Mall 1.0 - SQL Injection

CVE-2007-2674—webappsphp

SQL injection vulnerability in detail.php in Pre Shopping Mall 1.0 allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

phpMySms 2.0 - 'ROOT_PATH' Remote File Inclusion

CVE-2006-3300—webappsphp

PHP remote file inclusion vulnerability in sms_config/gateway.php in PhpMySms 2.0 and earlier allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

Powies MatchMaker 4.05 - 'matchdetail.php' SQL Injection

CVE-2006-6039—webappsphp

SQL injection vulnerability in matchdetail.php in Powie's PHP MatchMaker 4.05 and earlier allows remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

Invision Power Board 2.1 < 2.1.6 - SQL Injection (1)

CVE-2006-7071—webappsphp

SQL injection vulnerability in classes/class_session.php in Invision Power Board (IPB) 2.1 up to 2.1.6 allows remote att

23RISK

open ↗

Referência✓ VexDay Proof

XOOPS Module Repository - 'viewcat.php' SQL Injection

CVE-2007-1847—webappsphp

SQL injection vulnerability in viewcat.php in the Repository module for Xoops allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

PHPRaid < 3.0.7 - 'rss.php?PHPraid_dir' Remote File Inclusion

CVE-2006-3317—webappsphp

PHP remote file inclusion vulnerability in phpRaid 3.0.6 allows remote attackers to execute arbitrary code via a URL in

28RISK

open ↗

Referência✓ VexDay Proof

NetVIOS 2.0 - 'page.asp' SQL Injection

CVE-2006-5954—webappsasp

SQL injection vulnerability in page.asp in NetVIOS 2.0 and earlier allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

vBulletin 3.6.4 - 'inlinemod.php?postids' SQL Injection

CVE-2007-1292—webappsphp

SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, mi

23RISK

open ↗

Referência✓ VexDay Proof

AJ HYIP ACME - 'readarticle.php' SQL Injection

CVE-2008-4044—webappsphp

SQL injection vulnerability in article/readarticle.php in AJ Square aj-hyip (aka AJ HYIP Acme) allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

aspWebLinks 2.0 - SQL Injection / Admin Pass Change

CVE-2006-2847—webappsasp

SQL injection vulnerability in links.asp in aspWebLinks 2.0 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

campus virtual-lms - Cross-Site Scripting / SQL Injection

CVE-2009-2149—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in Campus Virtual-LMS allow remote attackers to inject arbitrary web

23RISK

open ↗

Referência✓ VexDay Proof

bwired - 'index.php?newsID' SQL Injection

CVE-2007-3977—webappsphp

Cross-site scripting (XSS) vulnerability in bwired allows remote attackers to inject arbitrary web script or HTML via un

23RISK

open ↗

Referência✓ VexDay Proof

NoseRub 0.5.2 - Login SQL Injection

CVE-2007-6602—webappsphp

SQL injection vulnerability in app/models/identity.php in NoseRub 0.5.2 and earlier allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

Friendly Technologies - 'fwRemoteCfg.dll' ActiveX Command Execution

CVE-2008-4049—remotewindows

A certain ActiveX control in fwRemoteCfg.dll 3.3.3.1 in Friendly Technologies FriendlyPPPoE Client 3.0.0.57 allows remot

23RISK

open ↗

Referência✓ VexDay Proof

FlexBB 0.5.5 - '/inc/start.php?_COOKIE' SQL Bypass

CVE-2006-1978—webappsphp

SQL injection vulnerability in inc/start.php in FlexBB 0.5.5 and earlier allows remote attackers to execute arbitrary SQ

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.