Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,230cataloged exploits
36,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
k-rate - SQL Injection / Cross-Site Scripting
CVE-2008-7098—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Qsoft K-Rate Premium allow remote attackers to inject arbitrary w
23RISK
open ↗
Referência✓ VexDay Proof
k-rate - SQL Injection / Cross-Site Scripting
CVE-2008-7099—webappsphp
Unspecified vulnerability in the Manage Templates feature in Qsoft K-Rate Premium allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Moodle 1.5.2 - 'moodledata' Remote Session Disclosure
CVE-2007-1647—webappsphp
Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Excel 2000/2003 - Sheet Name (PoC)
CVE-2007-3490—doswindows
Unspecified vulnerability in Microsoft Excel 2003 SP2 allows remote attackers to have an unknown impact via unspecified
35RISK
open ↗
Referência✓ VexDay Proof
Najdi.si Toolbar - ActiveX Remote Buffer Overflow (PoC)
CVE-2008-7103—doswindows
Stack-based buffer overflow in an ActiveX control in najdisitoolbar.dll in Najdi.si Toolbar 2.0.4.1 allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
phpEventCalendar 0.2.3 - 'eventdisplay.php' SQL Injection
CVE-2007-3519—webappsphp
SQL injection vulnerability in eventdisplay.php in phpEventCalendar 0.2.3 and earlier allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Fusion 7.0.2 - Blind SQL Injection
CVE-2008-1918—webappsphp
SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the
23RISK
open ↗
Referência✓ VexDay Proof
Envolution 1.1.0 - 'PNSVlang' Remote Code Execution
CVE-2006-6445—webappsphp
Directory traversal vulnerability in error.php in Envolution 1.1.0 and earlier allows remote attackers to include and ex
23RISK
open ↗
Referência✓ VexDay Proof
WebSVN 2.0 - Cross-Site Scripting / File Handling / Code Execution
CVE-2008-5919—webappsphp
Directory traversal vulnerability in rss.php in WebSVN 2.0 and earlier, when magic_quotes_gpc is disabled, allows remote
23RISK
open ↗
Referência✓ VexDay Proof
E-GADS! 2.2.6 - 'common.php?locale' Remote File Inclusion
CVE-2007-2521—webappsphp
PHP remote file inclusion vulnerability in common.php in E-GADS! before 2.2.7 allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
Flexcustomer 0.0.6 - Admin Authentication Bypass / Possible PHP Code Writing
CVE-2008-6761—webappsphp
Static code injection vulnerability in admin/install.php in Flexcustomer 0.0.6 might allow remote attackers to inject ar
23RISK
open ↗
Referência✓ VexDay Proof
samPHPweb 4.2.2 - 'db.php' Remote File Inclusion
CVE-2008-0143—webappsphp
PHP remote file inclusion vulnerability in common/db.php in samPHPweb, possibly 4.2.2 and others, as provided with SAM B
23RISK
open ↗
Referência✓ VexDay Proof
WeBid 0.5.4 - 'item.php' SQL Injection
CVE-2008-7119—webappsphp
SQL injection vulnerability in item.php in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Filiale 1.0.4 - 'idFiliale' SQL Injection
CVE-2008-1935—webappsphp
SQL injection vulnerability in the Filiale 1.0.4 component for Joomla! allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
zKup CMS 2.0 < 2.3 - Remote Add Admin
CVE-2008-7124—webappsphp
zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allo
23RISK
open ↗
Referência✓ VexDay Proof
ArcadeBuilder Game Portal Manager 1.7 - SQL Injection
CVE-2007-3521—webappsphp
SQL injection vulnerability in ArcadeBuilder Game Portal Manager 1.7 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
W1L3D4 philboard 1.0 - 'philboard_reply.asp' SQL Injection
CVE-2008-1939—webappsasp
Multiple SQL injection vulnerabilities in W1L3D4 Philboard 1.0 allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
ZZ FlashChat 3.1 - 'help.php' Local File Inclusion
CVE-2007-5620—webappsphp
Directory traversal vulnerability in admin/inc/help.php in ZZ:FlashChat 3.1 and earlier allows remote attackers to inclu
23RISK
open ↗
Referência✓ VexDay Proof
QNX Neutrino 0.8.4 Atomic Edition - Remote Code Execution
CVE-2008-3150—webappsphp
Directory traversal vulnerability in index.php in Neutrino Atomic Edition 0.8.4 allows remote attackers to read and modi
23RISK
open ↗
Referência✓ VexDay Proof
LightNEasy 1.2 - no database Remote Hash Retrieve
CVE-2008-6537—webappsphp
LightNEasy/lightneasy.php in LightNEasy No database version 1.2 allows remote attackers to obtain the hash of the admini
23RISK
open ↗
Referência✓ VexDay Proof
phosheezy 2.0 - Remote Command Execution
CVE-2009-0250—webappsphp
Ryneezy phoSheezy 0.2 stores sensitive information under the web root with insufficient access control, which allows rem
23RISK
open ↗
Referência✓ VexDay Proof
Grape Statistics 0.2a - 'location' Remote File Inclusion
CVE-2008-1963—webappsphp
PHP remote file inclusion vulnerability in includes/functions.php in Quate Grape Web Statistics 0.2a allows remote attac
35RISK
open ↗
Referência✓ VexDay Proof
Docebo 3.5.0.3 - 'lib.regset.php' Command Execution
CVE-2008-7153—webappsphp
SQL injection vulnerability in the autoDetectRegion function in doceboCore/lib/lib.regset.php in Docebo 3.5.0.3 and earl
23RISK
open ↗
Referência✓ VexDay Proof
Rayzz Script 2.0 - Local/Remote File Inclusion
CVE-2007-6230—webappsphp
Directory traversal vulnerability in common/classes/class_HeaderHandler.lib.php in Rayzz Script 2.0 allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
b1gbb 2.24.0 - SQL Injection / Cross-Site Scripting
CVE-2007-3589—webappsphp
Multiple SQL injection vulnerabilities in b1gbb 2.24.0 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência✓ VexDay Proof
E RESERV 2.1 - 'index.php' SQL Injection
CVE-2008-1975—webappsphp
SQL injection vulnerability in index.php in E-RESERV 2.1 allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Referência✓ VexDay Proof
CodeAvalanche FreeForum - Database Disclosure
CVE-2008-5932—webappsasp
CodeAvalanche FreeForum stores sensitive information under the web root with insufficient access control, which allows r
23RISK
open ↗
Referência✓ VexDay Proof
OraMon 2.0.1 - Remote Configuration File Disclosure
CVE-2008-6869—webappsphp
Oramon Oracle Database Monitoring Tool 2.0.1 stores sensitive information under the web root with insufficient access co
23RISK
open ↗
Referência✓ VexDay Proof
EkinBoard 1.1.0 - Arbitrary File Upload / Authentication Bypass
CVE-2008-7157—webappsphp
Unrestricted file upload vulnerability in EkinBoard 1.1.0 and earlier allows remote attackers to execute arbitrary code
23RISK
open ↗
Referência✓ VexDay Proof
Pinnacle Studio 12 - '.hfz' Directory Traversal
CVE-2009-1743—localwindows
Directory traversal vulnerability in InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Syst
23RISK
open ↗
← previouspage 142 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.