Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,958cataloged exploits
36,206CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,460Referência 22,832GitHub PoC 14,991VulnCheck XDB 8,829Nuclei 4,357Metasploit 3,489✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Youtuber Clone - SQL Injection
CVE-2008-3419—webappsphp
SQL injection vulnerability in ugroups.php in Youtuber Clone allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Mobius 1.4.4.1 - SQL Injection
CVE-2008-3420—webappsphp
Multiple SQL injection vulnerabilities in Mobius for Mimsy XG 1 1.4.4.1 and earlier allow remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
phpMyRealty 2.0.0 - 'location' SQL Injection
CVE-2008-3445—webappsphp
SQL injection vulnerability in index.php in phpMyRealty (PMR) 2.0.0 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
IPNPro3 < 1.44 - Admin Password Changing
CVE-2008-5568—webappsphp
Cross-site request forgery (CSRF) vulnerability in admin/settings.php in IPN Pro 3 1.44 and earlier allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
AdaptCMS Lite 1.4 - Cross-Site Scripting / Remote File Inclusion
CVE-2009-0526—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in index.php in AdaptCMS Lite 1.4 allow remote attackers to inject a
23RISK
open ↗
Referência✓ VexDay Proof
LetterIt 2 - 'Language' Local File Inclusion
CVE-2008-3446—webappsphp
Directory traversal vulnerability in inc/wysiwyg.php in LetterIt 2 allows remote attackers to include and execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
F-PROT AntiVirus 6.2.1.4252 - Malformed Archive Infinite Loop Denial of Service
CVE-2008-3447—dosmultiple
The scanning engine in F-Prot Antivirus 6.2.1 4252 allows remote attackers to cause a denial of service (infinite loop)
23RISK
open ↗
Referência✓ VexDay Proof
eNdonesia 8.4 (Calendar Module) - SQL Injection
CVE-2008-3452—webappsphp
SQL injection vulnerability in the Calendar module in eNdonesia 8.4 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
PHP Hosting Directory 2.0 - Insecure Cookie Handling
CVE-2008-3454—webappsphp
JnSHosts PHP Hosting Directory 2.0 allows remote attackers to bypass authentication and gain administrative access by se
23RISK
open ↗
Referência✓ VexDay Proof
WebMaster Marketplace - SQL Injection
CVE-2008-5574—webappsphp
SQL injection vulnerability in member.php in Webmaster Marketplace allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
PHP Hosting Directory 2.0 - Remote File Inclusion
CVE-2008-3455—webappsphp
PHP remote file inclusion vulnerability in include/admin.php in JnSHosts PHP Hosting Directory 2.0 allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
Vistered Little 1.6a - 'skin' Remote File Disclosure
CVE-2007-2934—webappsphp
Directory traversal vulnerability in skins/common.css.php in Vistered Little 1.6a allows remote attackers to read arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Server 2000 SP4 (Advanced Server) - Message Queue (MS07-065)
CVE-2007-3039—remotewindows
Stack-based buffer overflow in the Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4, Window
50RISK
open ↗
Referência✓ VexDay Proof
Anzio Web Print Object 3.2.30 - ActiveX Buffer Overflow
CVE-2008-3480—remotewindows
Stack-based buffer overflow in the Anzio Web Print Object (WePO) ActiveX control 3.2.19 and 3.2.24, as used in Anzio Pri
28RISK
open ↗
Referência✓ VexDay Proof
eStoreAff 0.1 - 'cid' SQL Injection
CVE-2008-3484—webappsphp
SQL injection vulnerability in eStoreAff 0.1 allows remote attackers to execute arbitrary SQL commands via the cid param
23RISK
open ↗
Referência✓ VexDay Proof
TROforum 0.1 - 'admin.php?site_url' Remote File Inclusion
CVE-2007-2937—webappsphp
PHP remote file inclusion vulnerability in admin/admin.php in TROforum 0.1 allows remote attackers to execute arbitrary
35RISK
open ↗
Referência✓ VexDay Proof
ASPThai.Net WebBoard 6.0 - SQL Injection
CVE-2009-0703—webappsphp
SQL injection vulnerability in bview.asp in ASPThai.Net Webboard 6.0 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
E-topbiz Dating 3 PHP Script - 'mail_id' SQL Injection
CVE-2008-3490—webappsphp
SQL injection vulnerability in members/mail.php in E-topbiz Online Dating 3 1.0 allows remote authenticated users to exe
23RISK
open ↗
Referência✓ VexDay Proof
Mercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (3)
CVE-2004-2513—remotewindows
Buffer overflow in the IMAP service of Mercury (Pegasus) Mail 4.01 allows remote attackers to execute arbitrary code via
23RISK
open ↗
Referência✓ VexDay Proof
Scripts24 iPost 1.0.1 - 'id' SQL Injection
CVE-2008-3491—webappsphp
SQL injection vulnerability in go.php in Scripts24 iPost 1.0.1 and iTGP 1.0.4 allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
QMail Mailing List Manager 1.2 - Database Disclosure
CVE-2008-5606—webappsasp
Gazatem QMail Mailing List Manager 1.2 stores sensitive information under the web root with insufficient access control,
23RISK
open ↗
Referência✓ VexDay Proof
BlueBird Pre-Release - Authentication Bypass
CVE-2009-0740—webappsphp
SQL injection vulnerability in login.php in BlueBird Prelease allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
smNews 1.0 - Authentication Bypass / Column Truncation
CVE-2009-0750—webappsphp
SQL injection vulnerability in login.php in the smNews example script for txtSQL 2.2 Final allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
Scripts24 iTGP 1.0.4 - 'id' SQL Injection
CVE-2008-3491—webappsphp
SQL injection vulnerability in go.php in Scripts24 iPost 1.0.1 and iTGP 1.0.4 allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
RealVNC Windows Client 4.1.2 - Remote Denial of Service Crash (PoC)
CVE-2008-3493—doswindows
vncviewer.exe in RealVNC Windows Client 4.1.2.0 allows remote VNC servers to cause a denial of service (application cras
23RISK
open ↗
Referência✓ VexDay Proof
MyPHP CMS 0.3.1 - 'pid' SQL Injection
CVE-2008-3497—webappsphp
SQL injection vulnerability in pages.php in MyPHP CMS 0.3.1 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
polypager 1.0rc2 - SQL Injection / Cross-Site Scripting
CVE-2008-3505—webappsphp
Cross-site scripting (XSS) vulnerability in PolyPager 1.0 rc2 and earlier allows remote attackers to inject arbitrary we
23RISK
open ↗
Referência✓ VexDay Proof
AdminBot 9.0.5 - 'live_status.lib.php' Remote File Inclusion
CVE-2007-2986—webappsphp
PHP remote file inclusion vulnerability in lib/live_status.lib.php in AdminBot MX 9.0.5 allows remote attackers to execu
35RISK
open ↗
Referência✓ VexDay Proof
LiteNews 0.1 - 'id' SQL Injection
CVE-2008-3507—webappsphp
SQL injection vulnerability in index.php in LiteNews 0.1 (aka 01), and possibly 1.2 and earlier, allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
MDPro Module My_eGallery - 'pid' SQL Injection
CVE-2009-0728—webappsphp
SQL injection vulnerability in the My_eGallery module for MAXdev MDPro (MD-Pro) and Postnuke allows remote attackers to
23RISK
open ↗
← previouspage 16 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.