Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,230cataloged exploits
36,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
F3Site 2.1 - Remote Code Execution
CVE-2007-0764—webappsphp
Unrestricted file upload vulnerability in F3Site 2.1 and earlier allows remote authenticated administrators to upload an
23RISK
open ↗
Referência✓ VexDay Proof
YouTube blog 0.1 - Remote File Inclusion / SQL Injection / Cross-Site Scripting
CVE-2008-3308—webappsphp
PHP remote file inclusion vulnerability in cuenta/cuerpo.php in C. Desseno YouTube Blog (ytb) 0.1, when register_globals
23RISK
open ↗
Referência✓ VexDay Proof
e107 < 0.7.8 - 'photograph' Arbitrary File Upload
CVE-2007-3429—webappsphp
Unrestricted file upload vulnerability in signup.php in e107 0.7.8 and earlier, when photograph upload is enabled, allow
23RISK
open ↗
Referência✓ VexDay Proof
CMS Ortus 1.13 - SQL Injection
CVE-2008-6282—webappsphp
SQL injection vulnerability in engine/users/users_edit_pub.inc in CMS Ortus 1.13 and earlier allows remote authenticated
23RISK
open ↗
Referência✓ VexDay Proof
Vivvo CMS 3.4 - 'index.php' Blind SQL Injection
CVE-2007-3939—webappsphp
SQL injection vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) CMS 3.4 and earlie
23RISK
open ↗
Referência✓ VexDay Proof
lustig.cms Beta 2.5 - 'forum.php?view' Remote File Inclusion
CVE-2007-5138—webappsphp
PHP remote file inclusion vulnerability in forum/forum.php in lustig.cms BETA 2.5 allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Litespeed Web Server 3.2.3 - Source Code Disclosure
CVE-2007-5654—remotemultiple
LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00
35RISK
open ↗
Referência✓ VexDay Proof
phpFaber URLInn 2.0.5 - 'dir_ws' Remote File Inclusion
CVE-2007-5754—webappsphp
PHP remote file inclusion vulnerability in urlinn_includes/config.php in phpFaber URLInn 2.0.5 allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
Constructr CMS 3.02.5 stable - Multiple Vulnerabilities
CVE-2008-5860—webappsphp
Directory traversal vulnerability in backend/template.php in Constructr CMS 3.02.5 and earlier, when register_globals is
23RISK
open ↗
Referência✓ VexDay Proof
PowerClan 1.14a - Authentication Bypass
CVE-2009-0707—webappsphp
SQL injection vulnerability in admin/index.php in PowerClan 1.14a allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
Realty Web-Base 1.0 - Authentication Bypass
CVE-2009-1658—webappsphp
Multiple SQL injection vulnerabilities in admin/admin.php in Realty Webware Technologies Realty Web-Base 1.0 allow remot
23RISK
open ↗
Referência✓ VexDay Proof
PHP Blue Dragon CMS 2.9 - Remote File Inclusion
CVE-2006-2392—webappsphp
PHP remote file inclusion vulnerability in public_includes/pub_popup/popup_finduser.php in PHP Blue Dragon Platinum 2.8.
23RISK
open ↗
Referência✓ VexDay Proof
IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow (PoC)
CVE-2008-3360—doswindows
Stack-based buffer overflow in the HTML parser in IntelliTamper 2.0.7 allows remote attackers to execute arbitrary code
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_Eventing 1.6.x - Blind SQL Injection
CVE-2009-0421—webappsphp
SQL injection vulnerability in the Eventing (com_eventing) 1.6.x component for Joomla! allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS 2.0.18 - Local File Inclusion / URL Redirecting
CVE-2008-0613—webappsphp
Open redirect vulnerability in htdocs/user.php in XOOPS 2.0.18 allows remote attackers to redirect users to arbitrary we
23RISK
open ↗
Referência✓ VexDay Proof
WebFileExplorer 3.1 - Authentication Bypass
CVE-2009-1323—webappsphp
SQL injection vulnerability in body.asp in Web File Explorer 3.1 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
2DayBiz Business Community Script - Multiple Vulnerabilities
CVE-2009-1651—webappsphp
SQL injection vulnerability in admin/member_details.php in 2daybiz Business Community Script allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
OLIB 7 WebView 2.5.1.1 - 'infile' Local File Inclusion
CVE-2008-5678—webappsphp
Fretwell-Downing Informatics (FDI) OLIB7 WebView 2.5.1.1 allows remote authenticated users to obtain sensitive informati
23RISK
open ↗
Referência✓ VexDay Proof
PHP121 Instant Messenger 1.4 - Remote Code Execution
CVE-2006-1828—webappsphp
SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
Ktools Photostore 3.5.2 - Multiple SQL Injections
CVE-2008-6649—webappsphp
SQL injection vulnerability in manager/image_details_editor.php in Ktools PhotoStore 2.5, 2.9.8, 3.1.0, and other versio
23RISK
open ↗
Referência✓ VexDay Proof
phpCommunityCalendar 4.0.3 - Cross-Site Scripting / SQL Injection
CVE-2006-2797—webappsphp
Multiple SQL injection vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
webEdition 6.0.0.4 - 'WE_LANGUAGE' Local File Inclusion
CVE-2009-1222—webappsphp
Directory traversal vulnerability in index.php in webEdition 6.0.0.4 and earlier, when register_globals is enabled and m
23RISK
open ↗
Referência✓ VexDay Proof
QuickCart 2.0 - 'categories.php' Local File Inclusion
CVE-2006-6390—webappsphp
Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0, when register_globals is enabled and magic
23RISK
open ↗
Referência✓ VexDay Proof
unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities
CVE-2009-1948—webappsphp
Multiple directory traversal vulnerabilities in forum.php in Unclassified NewsBoard (UNB) 1.6.4, when register_globals i
23RISK
open ↗
Referência✓ VexDay Proof
phpBB Insert User Mod 0.1.2 - Remote File Inclusion
CVE-2006-7100—webappsphp
PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBB Insert User 0.1.2 and earlier allows
23RISK
open ↗
Referência✓ VexDay Proof
Crea-Book 1.0 - Admin Access Bypass / Database Disclosure / Code Execution
CVE-2007-2001—webappsphp
Multiple direct static code injection vulnerabilities in admin/configurer2.php in Crea-Book 1.0 and earlier allow remote
23RISK
open ↗
Referência✓ VexDay Proof
W1L3D4 philboard 0.2 - 'W1L3D4_bolum.asp' SQL Injection
CVE-2007-2641—webappsasp
SQL injection vulnerability in W1L3D4_bolum.asp in W1L3D4 Philboard 0.2 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
IntelliTamper 2.07/2.08 Beta 4 - A HREF Remote Buffer Overflow
CVE-2008-3360—remotewindows
Stack-based buffer overflow in the HTML parser in IntelliTamper 2.0.7 allows remote attackers to execute arbitrary code
23RISK
open ↗
Referência✓ VexDay Proof
webSPELL 4.2.0c - Bypass BBCode Cross-Site Scripting Cookie Stealing
CVE-2009-1408—webappsphp
Cross-site scripting (XSS) vulnerability in webSPELL 4.2.0c allows remote attackers to inject arbitrary web script or HT
23RISK
open ↗
Referência✓ VexDay Proof
bwired - 'index.php?newsID' SQL Injection
CVE-2007-3978—webappsphp
Session fixation vulnerability in bwired allows remote attackers to hijack web sessions by setting the PHPSESSID paramet
23RISK
open ↗
← previouspage 154 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.