Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,230cataloged exploits
36,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Gradman 0.1.3 - 'info.php' Local File Inclusion
CVE-2008-0393—webappsphp
Directory traversal vulnerability in info.php in GradMan 0.1.3 and earlier allows remote attackers to include and execut
23RISK
open ↗
Referência✓ VexDay Proof
Toshiba Surveillance - 'MeIpCamX.dll 1.0.0.4' Remote Buffer Overflow
CVE-2008-0399—remotewindows
Multiple buffer overflows in Toshiba Surveillance (Surveillix) RecordSend ActiveX control (MeIpCamX.DLL 1.0.0.4) allow r
23RISK
open ↗
Referência✓ VexDay Proof
Invision Gallery 2.0.7 - SQL Injection
CVE-2008-0421—webappsphp
SQL injection vulnerability in Invision Gallery 2.0.7 and earlier allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
Frimousse 0.0.2 - 'explorerdir.php' Local Directory Traversal
CVE-2008-0425—webappsphp
Absolute path traversal vulnerability in explorerdir.php in Frimousse 0.0.2 allows remote attackers to read arbitrary fi
23RISK
open ↗
Referência✓ VexDay Proof
bloofox 0.3 - SQL Injection / File Disclosure
CVE-2008-0428—webappsphp
Multiple SQL injection vulnerabilities in the login function in system/class_permissions.php in bloofoxCMS 0.3 allow rem
23RISK
open ↗
Referência✓ VexDay Proof
360 Web Manager 3.0 - 'IDFM' SQL Injection
CVE-2008-0430—webappsphp
SQL injection vulnerability in form.php in 360 Web Manager 3.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
IDM-OS 1.0 - 'Filename' File Disclosure
CVE-2008-0431—webappsphp
Directory traversal vulnerability in administrator/download.php in IDMOS (aka Phoenix) 1.0 allows remote attackers to re
23RISK
open ↗
Referência✓ VexDay Proof
flinx 1.3 - 'id' SQL Injection
CVE-2008-0468—webappsphp
SQL injection vulnerability in category.php in Flinx 1.3 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Move Networks Upgrade Manager Control - Remote Buffer Overflow
CVE-2008-0477—remotewindows
Stack-based buffer overflow in the QMPUpgrade.Upgrade.1 ActiveX control in QMPUpgrade.dll 1.0.0.1 in Move Networks Upgra
28RISK
open ↗
Referência✓ VexDay Proof
Web Wiz Forums 9.07 - 'sub' Directory Traversal
CVE-2008-0480—webappsasp
Multiple directory traversal vulnerabilities in Web Wiz Forums 9.07 and earlier allow remote attackers to list arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Quick.CMS.Lite 0.3 - Cookie sLanguage Local File Inclusion
CVE-2006-5834—webappsphp
Directory traversal vulnerability in general.php in OpenSolution Quick.Cms.Lite 0.3 allows remote attackers to include a
23RISK
open ↗
Referência✓ VexDay Proof
PHPAdventure 1.1 - 'ad_main.php' Remote File Inclusion
CVE-2006-5839—webappsphp
PHP remote file inclusion vulnerability in ad_main.php in PHPAdventure 1.1-Alpha and earlier allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
IrayoBlog 0.2.4 - '/inc/irayofuncs.php' Remote File Inclusion
CVE-2006-5849—webappsphp
PHP remote file inclusion vulnerability in inc/irayofuncs.php in IrayoBlog alpha-0.2.4 allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
saPHP Lesson 2.0 - 'forumid' SQL Injection
CVE-2005-3363—webappsphp
SQL injection vulnerability in Saphp Lesson, possibly saphp Lesson1.1 and saphpLesson2.0, allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Xcode OpenBase 10.0.0 (OSX) - Symlink Privilege Escalation
CVE-2006-5851—localosx
openexec in OpenBase SQL before 10.0.1 allows local users to create arbitrary files via a symlink attack on the /tmp/out
23RISK
open ↗
Referência✓ VexDay Proof
Xcode OpenBase 10.0.0 (OSX) - Unsafe System Call Privilege Escalation
CVE-2006-5852—localosx
Untrusted search path vulnerability in openexec in OpenBase SQL before 10.0.1 allows local users to gain privileges via
23RISK
open ↗
Referência✓ VexDay Proof
Mercury Mail Transport System 4.01b - PH SERVER Remote Overflow
CVE-2005-4411—remotewindows
Buffer overflow in Mercury Mail Transport System 4.01b allows remote attackers to execute arbitrary code via a long requ
50RISK
open ↗
Referência✓ VexDay Proof
Munch Pro 1.0 - 'switch.asp' SQL Injection
CVE-2006-5880—webappsasp
SQL injection vulnerability on the subMenu page in switch.asp in Munch Pro 1.0 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Bigware Shop 2.0 - 'pollid' SQL Injection
CVE-2008-0498—webappsphp
SQL injection vulnerability in main_bigware_53.tpl.php in Bigware Shop 2.0 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
phpMyClub 0.0.1 - 'page_courante' Local File Inclusion
CVE-2008-0501—webappsphp
Directory traversal vulnerability in phpMyClub 0.0.1 allows remote attackers to include and execute arbitrary local file
23RISK
open ↗
Referência✓ VexDay Proof
Invision Power Board 2.1.4 - Register Users Denial of Service
CVE-2006-0888—dosmultiple
index.php in Invision Power Board (IPB) 2.0.1, with Code Confirmation disabled, allows remote attackers to cause an unsp
23RISK
open ↗
Referência✓ VexDay Proof
Persits XUpload 3.0 - 'AddFile()' Remote Buffer Overflow
CVE-2008-0492—remotewindows
Stack-based buffer overflow in the Persits.XUpload.2 ActiveX control in XUpload.ocx 3.0.0.4 and earlier in Persits XUplo
43RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin Adserve 0.2 - 'adclick.php' SQL Injection
CVE-2008-0507—webappsphp
SQL injection vulnerability in adclick.php in the AdServe 0.2 plugin for WordPress allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
MyBulletinBoard (MyBB) 1.03 - 'misc.php' SQL Injection
CVE-2006-0959—webappsphp
SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when register_globals is enabled, allows remote
23RISK
open ↗
Referência✓ VexDay Proof
CilemNews System 1.1 - 'yazdir.asp' haber_id SQL Injection
CVE-2006-0961—webappsasp
SQL injection vulnerability in yazdir.asp in Cilem Hiber 1.1 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Helix Server 11.0.1 (Windows 2000 SP4) - Remote Heap Overflow
CVE-2006-6026—remotewindows
Heap-based buffer overflow in Real Networks Helix Server and Helix Mobile Server before 11.1.3, and Helix DNA Server 11.
28RISK
open ↗
Referência✓ VexDay Proof
Gallery 2.0.3 - 'stepOrder[]' Remote Command Execution
CVE-2006-1219—webappsphp
Directory traversal vulnerability in Gallery 2.0.3 and earlier, and 2.1 before RC-2a, allows remote attackers to include
23RISK
open ↗
Referência✓ VexDay Proof
WORK System E-Commerce 3.0.1 - Remote File Inclusion
CVE-2006-6041—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Laurent Van den Reysen WORK system e-commerce 3.0.2, and other ver
23RISK
open ↗
Referência✓ VexDay Proof
PHPWebThings 1.5.2 - 'editor.php' Remote File Inclusion
CVE-2006-6042—webappsphp
PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 and earlier, when register_globals is e
23RISK
open ↗
Referência✓ VexDay Proof
Etomite CMS 0.6.1.2 - '/manager/index.php' Local File Inclusion
CVE-2006-6047—webappsphp
Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to
23RISK
open ↗
← previouspage 153 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.