Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,230cataloged exploits

36,424CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

Google Chrome 1.0.154.43 - Clickjacking

CVE-2009-0374—remotewindows

Google Chrome 1.0.154.43 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action th

23RISK

open ↗

Referência✓ VexDay Proof

snetworks PHP Classifieds 5.0 - Remote File Inclusion

CVE-2008-0137—webappsphp

PHP remote file inclusion vulnerability in config.inc.php in SNETWORKS PHP CLASSIFIEDS 5.0 allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

WWWISIS 7.1 - 'IsisScript' Local File Disclosure / Cross-Site Scripting

CVE-2007-5455—webappscgi

Cross-site scripting (XSS) vulnerability in wxis.exe in WWWISIS 7.1 and earlier allows remote attackers to inject arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Pixie CMS - Cross-Site Scripting / SQL Injection

CVE-2009-1066—webappsphp

SQL injection vulnerability in the referral function in admin/lib/lib_logs.php in Pixie CMS 1.01a allows remote attacker

23RISK

open ↗

Referência✓ VexDay Proof

Simplog 0.9.2 - 's' Remote Command Execution

CVE-2006-1779—webappsphp

Cross-site scripting (XSS) vulnerability in login.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attacke

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Flash Uploader 2.5.1 - Remote File Inclusion

CVE-2007-5457—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Michael Dempfle Joomla Flash Uploader (com_jfu or com_joomla_flash

35RISK

open ↗

Referência✓ VexDay Proof

KwsPHP 1.0 Module Newsletter - SQL Injection

CVE-2007-5458—webappsphp

SQL injection vulnerability in index.php in the newsletter module 1.0 for KwsPHP, when magic_quotes_gpc is disabled, all

23RISK

open ↗

Referência✓ VexDay Proof

Mafia Scum Tools 2.0.0 - 'index.php?gen' Remote File Inclusion

CVE-2007-0501—webappsphp

PHP remote file inclusion vulnerability in index.php in Mafia Scum Tools 2.0.0 in Matthew Wardrop Advanced Random Genera

23RISK

open ↗

Referência✓ VexDay Proof

GNU/Gallery 1.1.1.0 - 'admin.php' Local File Inclusion

CVE-2008-2353—webappsphp

Directory traversal vulnerability in admin.php in GNU/Gallery 1.1.1.0 and earlier allows remote attackers to include and

23RISK

open ↗

Referência✓ VexDay Proof

PHP 4.4.6 - 'ibase_connect()' Local Buffer Overflow

CVE-2007-1475—localwindows

Multiple buffer overflows in the (1) ibase_connect and (2) ibase_pconnect functions in the interbase extension in PHP 4.

23RISK

open ↗

Referência✓ VexDay Proof

MyBlog: PHP and MySQL Blog/CMS software - SQL Injection / Cross-Site Scripting

CVE-2008-2963—webappsphp

Multiple SQL injection vulnerabilities in MyBlog allow remote attackers to execute arbitrary SQL commands via the (1) vi

23RISK

open ↗

Referência✓ VexDay Proof

Integramod Nederland 1.4.2 - Remote File Inclusion

CVE-2007-5140—webappsphp

PHP remote file inclusion vulnerability in includes/archive/archive_topic.php in IntegraMOD Nederland 1.4.2 allows remot

23RISK

open ↗

Referência✓ VexDay Proof

K-Lite Mega Codec Pack 3.5.7.0 - Local Windows Explorer Denial of Service (PoC)

CVE-2008-5072—doswindows

vsfilter.dll in K-Lite Mega Codec Pack 3.5.7.0 allows remote attackers to cause a denial of service (application crash)

23RISK

open ↗

Referência✓ VexDay Proof

teatro 1.6 - 'basePath' Remote File Inclusion

CVE-2007-5780—webappsphp

PHP remote file inclusion vulnerability in pub/pub08_comments.php in teatro 1.6 allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

VHD Web Pack 2.0 - 'index.php' Local File Inclusion

CVE-2008-0609—webappsphp

Directory traversal vulnerability in index.php in DivideConcept VHD Web Pack 2.0 allows remote attackers to include and

23RISK

open ↗

Referência✓ VexDay Proof

LightBlog 9.6 - 'Username' Local File Inclusion

CVE-2008-0840—webappsphp

Directory traversal vulnerability in view_member.php in Public Warehouse LightBlog 9.6 allows remote attackers to includ

23RISK

open ↗

Referência✓ VexDay Proof

Mini File Host 1.2 - 'language' Local File Inclusion

CVE-2008-0357—webappsphp

Directory traversal vulnerability in pages/upload.php in Galaxyscripts Mini File Host 1.2.1 and earlier allows remote at

23RISK

open ↗

Referência✓ VexDay Proof

Kmita Tellfriend 2.0 - 'file' Remote File Inclusion

CVE-2008-2198—webappsphp

PHP remote file inclusion vulnerability in kmitaadmin/kmitat/htmlcode.php in Kmita Tellfriend 2.0 and earlier, when regi

23RISK

open ↗

Referência✓ VexDay Proof

PortalApp 4.0 - SQL Injection / Cross-Site Scripting / Authentication Bypass

CVE-2008-4613—webappsasp

SQL injection vulnerability in forums.asp in PortalApp 4.0 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

eSHOP100 - 'SUB' SQL Injection

CVE-2008-5190—webappsphp

SQL injection vulnerability in index.php in eSHOP100 allows remote attackers to execute arbitrary SQL commands via the S

23RISK

open ↗

Referência✓ VexDay Proof

OpenX 2.6 - 'bannerid' Blind SQL Injection

CVE-2008-6163—webappsphp

SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

DevelopItEasy Events Calendar 1.2 - Multiple SQL Injections

CVE-2008-6608—webappsphp

Multiple SQL injection vulnerabilities in DevelopItEasy Events Calendar 1.2 allow remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

FdWeB Espace Membre 2.01 - 'path' Remote File Inclusion

CVE-2007-0301—webappsphp

PHP remote file inclusion vulnerability in _admin/admin_menu.php in FdWeB Espace Membre 2.1 and earlier allows remote at

23RISK

open ↗

Referência✓ VexDay Proof

Motorola Wimax modem CPEi300 - File Disclosure / Cross-Site Scripting

CVE-2009-0392—remotehardware

Directory traversal vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated users to re

23RISK

open ↗

Referência✓ VexDay Proof

Mutant 0.9.2 - 'mutant_functions.php' Remote File Inclusion

CVE-2007-1961—webappsphp

PHP remote file inclusion vulnerability in mutant_functions.php in the Mutant 0.9.2 portal for phpBB 2.2 allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

WebPortal CMS 0.8b - Multiple Local/Remote File Inclusions

CVE-2009-1444—webappsphp

PHP remote file inclusion vulnerability in indexk.php in WebPortal CMS 0.8-beta allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

Expow 0.8 - 'autoindex.php?cfg_file' Remote File Inclusion

CVE-2007-2302—webappsphp

PHP remote file inclusion vulnerability in autoindex.php in Expow 0.8 allows remote attackers to execute arbitrary PHP c

23RISK

open ↗

Referência✓ VexDay Proof

NewsSync for phpBB 1.5.0rc6 - Remote File Inclusion

CVE-2007-3136—webappsphp

PHP remote file inclusion vulnerability in inc/nuke_include.php in newsSync 1.5.0rc6 allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

MyCMS 0.9.8 - Remote Command Execution (2)

CVE-2007-3585—webappsphp

PHP remote file inclusion vulnerability in games.php in MyCMS 0.9.8 and earlier allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

eXtremail 2.1.1 - Remote Heap Overflow (PoC)

CVE-2007-5466—doslinux

Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.