Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,230cataloged exploits

36,424CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

X-Cart - Multiple Remote File Inclusions

CVE-2007-4907—webappsphp

Multiple PHP remote file inclusion vulnerabilities in X-Cart allow remote attackers to execute arbitrary PHP code via a

23RISK

open ↗

Referência✓ VexDay Proof

JetCast Server 2.0.0.4308 - Remote Denial of Service

CVE-2007-4911—doswindows

JSMP3OGGWt.dll in JetCast Server 2.0.0.4308 allows remote attackers to cause a denial of service (daemon crash) via a lo

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component joom12pic 1.0 - Remote File Inclusion

CVE-2007-4954—webappsphp

PHP remote file inclusion vulnerability in admin.joom12pic.php in the joom12Pic (com_joom12pic) 1.0 component for Joomla

28RISK

open ↗

Referência✓ VexDay Proof

KwsPHP 1.0 - 'login.php' SQL Injection

CVE-2007-4956—webappsphp

Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via (1) th

23RISK

open ↗

Referência✓ VexDay Proof

Chupix CMS 0.2.3 - 'download.php' Remote File Disclosure

CVE-2007-4957—webappsphp

Multiple directory traversal vulnerabilities in download.php in Chupix CMS 0.2.3 allow remote attackers to read or overw

23RISK

open ↗

Referência✓ VexDay Proof

Xforum 1.4 - 'topic' SQL Injection

CVE-2008-0279—webappsphp

SQL injection vulnerability in liretopic.php in Xforum 1.4 and possibly others allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

DomPHP 0.81 - Remote Add Administrator

CVE-2008-0282—webappsphp

SQL injection vulnerability in welcome/inscription.php in DomPHP 0.81 and earlier allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

Foojan Wms 1.0 - 'story' SQL Injection

CVE-2008-0447—webappsphp

SQL injection vulnerability in index.php in Foojan WMS PHP Weblog 1.0 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Easysitenetwork Recipe - 'categoryId' SQL Injection

CVE-2008-0453—webappsphp

SQL injection vulnerability in list.php in Easysitenetwork Recipe allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

Liquid-Silver CMS 0.1 - 'update' Local File Inclusion

CVE-2008-0459—webappsphp

Directory traversal vulnerability in update/index.php in Liquid-Silver CMS 0.35, when magic_quotes_gpc is disabled, allo

23RISK

open ↗

Referência✓ VexDay Proof

OneCMS 2.4 - 'abc' SQL Injection

CVE-2007-5016—webappsphp

SQL injection vulnerability in userreviews.php in OneCMS 2.4 allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência✓ VexDay Proof

Airsensor M520 - HTTPd Remote Denial of Service / Buffer Overflow (PoC)

CVE-2007-5036—doshardware

Multiple buffer overflows in the AirDefense Airsensor M520 with firmware 4.3.1.1 and 4.4.1.4 allow remote authenticated

23RISK

open ↗

Referência✓ VexDay Proof

neuron news 1.0 - 'index.php?q' Local File Inclusion

CVE-2007-5050—webappsphp

Directory traversal vulnerability in index.php in Neuron News 1.0 allows remote attackers to include and execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

ActiveKB KnowledgeBase 2.x - 'catId' SQL Injection

CVE-2007-5131—webappsphp

SQL injection vulnerability in index.php in Interspire ActiveKB NX 2.x allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component com_downloads - SQL Injection

CVE-2008-0652—webappsphp

SQL injection vulnerability in index.php in the Downloads (com_downloads) component for Mambo and Joomla! allows remote

23RISK

open ↗

Referência✓ VexDay Proof

FaceBook PhotoUploader - 'ImageUploader4.ocx 4.5.57.0' Remote Buffer Overflow

CVE-2008-0660—remotewindows

Multiple stack-based buffer overflows in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.6.17.0, 4.5.70.0,

35RISK

open ↗

Referência✓ VexDay Proof

The Everything Development System Pre-1.0 - SQL Injection

CVE-2008-0675—webappsphp

SQL injection vulnerability in cms/index.pl in The Everything Development Engine in The Everything Development System Pr

23RISK

open ↗

Referência✓ VexDay Proof

FSFDT v3.000 d9 - 'HELP' Remote Buffer Overflow

CVE-2007-5256—remotewindows

Multiple stack-based buffer overflows in FSD 2.052 d9 and earlier, and FSFDT FSD 3.000 d9 and earlier, allow (1) remote

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_Marketplace 1.1.1 - SQL Injection

CVE-2008-0689—webappsphp

SQL injection vulnerability in index.php in the Marketplace (com_marketplace) 1.1.1 and 1.1.1-pl1 component for Joomla!

23RISK

open ↗

Referência✓ VexDay Proof

BookmarkX script 2007 - 'topicid' SQL Injection

CVE-2008-0695—webappsphp

SQL injection vulnerability in index.php in BookmarkX script 2007 allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component MCQuiz 0.9 Final - 'tid' SQL Injection

CVE-2008-0800—webappsphp

SQL injection vulnerability in index.php in the McQuiz (com_mcquiz) 0.9 Final component for Joomla! allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

phpArcadeScript 3.0RC2 - 'userid' SQL Injection

CVE-2008-1163—webappsphp

SQL injection vulnerability in index.php in phpArcadeScript 1.0 through 3.0 RC2 allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

PhpBlock a8.4 - 'PATH_TO_CODE' Remote File Inclusion

CVE-2008-1776—webappsphp

PHP remote file inclusion vulnerability in modules/basicfog/basicfogfactory.class.php in PhpBlock A8.4 allows remote att

28RISK

open ↗

Referência✓ VexDay Proof

Prozilla Forum Service - 'forum' SQL Injection

CVE-2008-1789—webappsphp

SQL injection vulnerability in forum.php in Prozilla Forum allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

Dream4 Koobi Pro 6.25 Poll - 'poll_id' SQL Injection

CVE-2008-2036—webappsphp

SQL injection vulnerability in index.php in dream4 Koobi Pro 6.25 allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

Smeego 1.0 - 'Cookie lang' Local File Inclusion

CVE-2008-2352—webappsphp

Directory traversal vulnerability in index.php in Smeego 1.0, when magic_quotes_gpc is disabled, allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Archangel Weblog 0.90.02 - 'post_id' SQL Injection

CVE-2008-2356—webappsphp

SQL injection vulnerability in index.php in Archangel Weblog 0.90.02 and earlier allows remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

Flatnuke 3 - Remote Cookie Manipulation / Privilege Escalation

CVE-2007-5771—webappsphp

Flatnuke 3 (aka FlatnuX) allows remote attackers to obtain administrative access via a myforum%00 cookie.

23RISK

open ↗

Referência✓ VexDay Proof

Flatnuke 3 - Remote Command Execution / Privilege Escalation

CVE-2007-5773—webappsphp

Cross-site request forgery (CSRF) vulnerability in index.php in the File Manager module in Flatnuke 3 allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

1Book Guestbook Script 1.0.1 - Code Execution

CVE-2008-2638—webappsphp

Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitr

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.