Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,230cataloged exploits
36,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
LightBlog 9.6 - 'Username' Local File Inclusion
CVE-2008-0840—webappsphp
Directory traversal vulnerability in view_member.php in Public Warehouse LightBlog 9.6 allows remote attackers to includ
23RISK
open ↗
Referência✓ VexDay Proof
Podcast Generator 1.1 - Remote Code Execution
CVE-2009-1226—webappsphp
core/admin/delete.php in Podcast Generator 1.1 and earlier does not properly restrict access to administrative functions
23RISK
open ↗
Referência✓ VexDay Proof
PHP Net Tools 2.7.1 - Remote Code Execution
CVE-2006-1921—webappsphp
nettools.php in PHP Net Tools 2.7.1 allows remote attackers to execute arbitrary commands via shell metacharacters in th
23RISK
open ↗
Referência✓ VexDay Proof
GuestCal 2.1 - 'index.php?lang' Local File Inclusion
CVE-2009-1319—webappsphp
Directory traversal vulnerability in includes/ini.inc.php in GuestCal 2.1 allows remote attackers to include and execute
23RISK
open ↗
Referência✓ VexDay Proof
Chipmunk Blog - (Authentication Bypass) Add Admin
CVE-2009-0399—webappsphp
Chipmunk Blogger Script allows remote attackers to gain administrator privileges via a direct request to admin/reguser.p
23RISK
open ↗
Referência✓ VexDay Proof
Syntax Desktop 2.7 - 'synTarget' Local File Inclusion
CVE-2009-0448—webappsphp
Directory traversal vulnerability in admin/modules/aa/preview.php in Syntax Desktop 2.7 allows remote attackers to inclu
23RISK
open ↗
Referência✓ VexDay Proof
CNStats 2.9 - 'who_r.php?bj' Remote File Inclusion
CVE-2007-2086—webappsphp
Multiple PHP remote file inclusion vulnerabilities in CNStats 2.9 allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗
Referência✓ VexDay Proof
Flip 3.0 - Remote Admin Creation
CVE-2007-5062—webappsphp
account.php in Adam Scheinberg Flip 3.0 and earlier allows remote attackers to create administrative accounts via the un
23RISK
open ↗
Referência✓ VexDay Proof
Catviz 0.4.0 beta1 - Local File Inclusion / Cross-Site Scripting
CVE-2009-1748—webappsphp
Multiple directory traversal vulnerabilities in index.php in Catviz 0.4.0 Beta 1 allow remote attackers to read arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Verlihub Control Panel 1.7.x - Local File Inclusion
CVE-2007-5321—webappsphp
Directory traversal vulnerability in index.php in Verlihub Control Panel (VHCP) 1.7 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
UploadImage/UploadScript 1.0 - Remote Change Admin Password
CVE-2008-0245—webappsphp
admin.php in UploadImage 1.0 does not check for the original password before making a change to a new password, which al
23RISK
open ↗
Referência✓ VexDay Proof
MySpeach 3.0.7 - Local/Remote File Inclusion
CVE-2007-1895—webappsphp
PHP remote file inclusion vulnerability in chat.php in Sky GUNNING MySpeach 3.0.7 and earlier, when used with PHP 5, all
23RISK
open ↗
Referência✓ VexDay Proof
yourplace 1.0.2 - Multiple Vulnerabilities / Remote Code Execution
CVE-2008-6772—webappsphp
login/register_form.php in YourPlace 1.0.2 and earlier does not check that a username already exists when a new account
23RISK
open ↗
Referência✓ VexDay Proof
WWWISIS 7.1 - 'IsisScript' Local File Disclosure / Cross-Site Scripting
CVE-2007-5484—webappscgi
Directory traversal vulnerability in wxis.exe in WWWISIS 7.1 allows local users to read arbitrary files via a .. (dot do
23RISK
open ↗
Referência✓ VexDay Proof
Harris WapChat 1 - Multiple Remote File Inclusions
CVE-2008-2074—webappsphp
Multiple PHP remote file inclusion vulnerabilities Harris Yusuf Arifin Harris Wap Chat 1.0, when register_globals is ena
23RISK
open ↗
Referência✓ VexDay Proof
NavBoard 2.6.0 - Remote Code Execution
CVE-2007-2899—webappsphp
Direct static code injection vulnerability in admin_config.php in NavBoard 2.6.0 allows remote attackers to inject arbit
23RISK
open ↗
Referência✓ VexDay Proof
Jamroom 3.3.5 - Remote File Inclusion
CVE-2008-2883—webappsphp
PHP remote file inclusion vulnerability in include/plugins/jrBrowser/payment.php in Jamroom 3.3.0 through 3.3.5 allows r
23RISK
open ↗
Referência✓ VexDay Proof
MyCMS 0.9.8 - Remote Command Execution (2)
CVE-2007-3586—webappsphp
Multiple direct static code injection vulnerabilities in MyCMS 0.9.8 and earlier allow remote attackers to inject arbitr
23RISK
open ↗
Referência✓ VexDay Proof
PortalApp 4.0 - SQL Injection / Cross-Site Scripting / Authentication Bypass
CVE-2008-4612—webappsasp
Cross-site scripting (XSS) vulnerability in PortalApp 4.0 allows remote attackers to inject arbitrary web script or HTML
23RISK
open ↗
Referência✓ VexDay Proof
WebPortal CMS 0.6.0 - 'index.php' SQL Injection
CVE-2007-6664—webappsphp
SQL injection vulnerability in index.php in WebPortal CMS 0.6.0 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Broadcast Machine 0.1 - Multiple Remote File Inclusions
CVE-2008-6287—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Broadcast Machine 0.1 allow remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
fresh email script 1.0 - Multiple Vulnerabilities
CVE-2008-7042—webappsphp
PHP remote file inclusion vulnerability in url.php in FreshScripts Fresh Email Script 1.0 through 1.11 allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
Gravity Board X 2.0 Beta - SQL Injection / (Authenticated) Code Execution
CVE-2009-1278—webappsphp
Static code injection vulnerability in forms/ajax/configure.php in Gravity Board X (GBX) 2.0 BETA allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
mxBB Module mx_blogs 2.0.0-beta - Remote File Inclusion
CVE-2008-1712—webappsphp
PHP remote file inclusion vulnerability in includes/functions_weblog.php in mxBB mx_blogs 2.0.0 beta allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
YapBB 1.2 Beta2 - 'yapbb_session.php' Remote File Inclusion
CVE-2006-6633—webappsphp
PHP remote file inclusion vulnerability in include/yapbb_session.php in YapBB 1.2 Beta2 and earlier allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
Orlando CMS 0.6 - Remote File Inclusion
CVE-2008-2854—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Orlando CMS 0.6 allow remote attackers to execute arbitrary PHP co
23RISK
open ↗
Referência✓ VexDay Proof
MiNBank 1.5.0 - Multiple Remote File Inclusions
CVE-2008-6006—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Micronation Banking System (minba) 1.5.0 allow remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Sofi WebGui 0.6.3 PRE - 'mod_dir' Remote File Inclusion
CVE-2008-6402—webappsphp
PHP remote file inclusion vulnerability in hu/modules/reg-new/modstart.php in Sofi WebGui 0.6.3 PRE and earlier allows r
23RISK
open ↗
Referência✓ VexDay Proof
pagetree CMS 0.0.2 Beta 0001 - Remote File Inclusion
CVE-2008-7067—webappsphp
PHP remote file inclusion vulnerability in admin/plugins/Online_Users/main.php in PageTree CMS 0.0.2 BETA 0001 allows re
23RISK
open ↗
Referência✓ VexDay Proof
webframe 0.76 - Multiple File Inclusions
CVE-2009-0514—webappsphp
Multiple directory traversal vulnerabilities in WebFrame 0.76 allow remote attackers to include and execute arbitrary lo
23RISK
open ↗
← previouspage 158 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.