Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,230cataloged exploits
36,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
iziContents rc6 - Local/Remote File Inclusion
CVE-2005-4600—webappsphp
Directory traversal vulnerability in tiny_mce_gzip.php in TinyMCE Compressor PHP before 1.06 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
KnowledgeBuilder 2.2 - 'visEdit_root' Remote File Inclusion
CVE-2006-5919—webappsphp
PHP remote file inclusion vulnerability in admin/e_data/visEdit_control.class.php in ActiveCampaign KnowledgeBuilder 2.2
23RISK
open ↗
Referência✓ VexDay Proof
webid 0.5.4 - Multiple Vulnerabilities
CVE-2008-7117—webappsphp
eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets (CSS) file
23RISK
open ↗
Referência✓ VexDay Proof
Kim Websites 1.0 - Authentication Bypass
CVE-2009-1026—webappsphp
Multiple SQL injection vulnerabilities in login.php in Kim Websites 1.0 allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
eZip Wizard 3.0 - Local Stack Buffer Overflow (PoC) (SEH)
CVE-2009-1028—doswindows
Stack-based buffer overflow in ediSys eZip Wizard 3.0 allows remote attackers to execute arbitrary code via a crafted .z
50RISK
open ↗
Referência✓ VexDay Proof
EasyNews 40tr - SQL Injection / Cross-Site Scripting / Local File Inclusion
CVE-2008-1651—webappsphp
Directory traversal vulnerability in admin/login.php in EasyNews 4.0 allows remote attackers to include and execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
gapicms 9.0.2 - 'dirDepth' Remote File Inclusion
CVE-2008-3183—webappsphp
PHP remote file inclusion vulnerability in ktmlpro/includes/ktedit/toolbar.php in gapicms 9.0.2 allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
DBGuestbook 1.1 - 'dbs_base_path' Remote File Inclusion
CVE-2007-1165—webappsphp
Multiple PHP remote file inclusion vulnerabilities in DBGuestbook 1.1 allow remote attackers to execute arbitrary PHP co
23RISK
open ↗
Referência✓ VexDay Proof
HIOX Random Ad 1.3 - Remote File Inclusion
CVE-2008-3401—webappsphp
PHP remote file inclusion vulnerability in hioxRandomAd.php in HIOX Random Ad (HRA) 1.3 allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
phpTrafficA 1.4.2 - 'pageid' SQL Injection
CVE-2007-3425—webappsphp
Directory traversal vulnerability in index.php in phpTrafficA 1.4.2 and earlier allows remote attackers to include arbit
23RISK
open ↗
Referência✓ VexDay Proof
Hotel Reservation System - 'city.asp' Blind SQL Injection
CVE-2008-4204—webappsasp
SQL injection vulnerability in city.asp in SoftAcid Hotel Reservation System (HRS) allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
YAP 1.1.1 - Blind SQL Injection / SQL Injection
CVE-2009-1038—webappsphp
Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
KDPics 1.11 - 'exif.php?lib_path' Remote File Inclusion
CVE-2006-6516—webappsphp
Multiple PHP remote file inclusion vulnerabilities in KDPics 1.16 and earlier allow remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Bloginator 1a - SQL Injection / Command Injection (via Cookie Bypass )
CVE-2009-1049—webappsphp
SQL injection vulnerability in articleCall.php in Bloginator 1A allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
FlashFXP 3.4.0 build 1145 - Remote Buffer Overflow (Denial of Service) (PoC)
CVE-2007-0825—doswindows
FlashFXP 3.4.0 build 1145 allows remote servers to cause a denial of service (CPU consumption) via a response to a PWD c
23RISK
open ↗
Referência✓ VexDay Proof
TorrentTrader Classic 1.07 - Multiple Vulnerabilities
CVE-2007-5311—webappsphp
Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic Edition 1.07 allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
ContentNow 1.4.1 - Arbitrary File Upload / Cross-Site Scripting
CVE-2008-3181—webappsphp
Unrestricted file upload vulnerability in upload.php in ContentNow CMS 1.4.1 allows remote authenticated users to execut
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows - GDI+ '.ICO' Remote Division By Zero
CVE-2008-4327—doswindows
gdiplus.dll in GDI+ in Microsoft Windows XP SP3 does not properly handle crafted .ico files, which allows remote attacke
28RISK
open ↗
Referência✓ VexDay Proof
PGOSD - '/misc/function.php3' Remote File Inclusion
CVE-2006-5543—webappsphp
PHP remote file inclusion vulnerability in misc/function.php3 in PHP Generator of Object SQL Database (PGOSD), when regi
23RISK
open ↗
Referência✓ VexDay Proof
evilboard 0.1a - SQL Injection / Cross-Site Scripting
CVE-2008-0155—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in EvilBoard 0.1a (Alpha) allows remote attackers to inject arbitr
23RISK
open ↗
Referência✓ VexDay Proof
PPLive 1.9.21 - '/LoadModule' URI Handlers Argument Injection
CVE-2009-1087—remotewindows
Multiple argument injection vulnerabilities in PPLive.exe in PPLive 1.9.21 and earlier allow remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
CenterIM 4.22.3 - Remote Command Execution
CVE-2008-1467—remotelinux
CenterIM 4.22.3 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters
23RISK
open ↗
Referência✓ VexDay Proof
phpBB Import Tools Mod 0.1.4 - Remote File Inclusion
CVE-2006-7147—webappsphp
PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBB Import Tools Mod 0.1.4 and earlier a
23RISK
open ↗
Referência✓ VexDay Proof
Hot Links SQL-PHP 3 - 'report.php' Multiple Vulnerabilities
CVE-2008-4378—webappsphp
SQL injection vulnerability in report.php in Mr. CGI Guy Hot Links SQL-PHP 3.0 and earlier allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
Flat Chat 2.0 - 'include online.txt' Remote Code Execution
CVE-2007-1394—webappsphp
Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
Gigaset SE461 WiMAX Router - Remote Denial of Service
CVE-2009-1152—doshardware
Siemens Gigaset SE461 WiMAX router 1.5-BL024.9.6401, and possibly other versions, allows remote attackers to cause a den
23RISK
open ↗
Referência✓ VexDay Proof
STPHPLibrary - 'STPHPLIB_DIR' Remote File Inclusion
CVE-2007-4737—webappsphp
Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
phpLinkat 0.1 - Insecure Cookie Handling / SQL Injection
CVE-2008-3407—webappsphp
phpLinkat 0.1 allows remote attackers to bypass authentication and access unspecified pages under admin/ by sending a lo
23RISK
open ↗
Referência✓ VexDay Proof
mxBB Module calsnails 1.06 - 'mx_common.php' File Inclusion
CVE-2006-6065—webappsphp
PHP remote file inclusion vulnerability in includes/mx_common.php in the CalSnails Module for MxBB Portal 1.06 allows re
23RISK
open ↗
Referência✓ VexDay Proof
Camera Life 2.6.2b4 - Arbitrary File Upload
CVE-2008-4366—webappsphp
Unrestricted file upload vulnerability in the image upload component in Camera Life 2.6.2b4 allows remote authenticated
23RISK
open ↗
← previouspage 134 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.