Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,230cataloged exploits

36,424CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

SoftBB 0.1 - 'cmd' Remote Command Execution

CVE-2006-4633—webappsphp

index.php in SoftBB 0.1, and possibly earlier, allows remote attackers to obtain the installation path via a null or inv

23RISK

open ↗

Referência✓ VexDay Proof

GeekLog 1.4.0sr3 - '_CONF[path]' Remote File Inclusion

CVE-2006-6225—webappsphp

Multiple PHP remote file inclusion vulnerabilities in GeekLog 1.4 allow remote attackers to execute arbitrary code via a

23RISK

open ↗

Referência✓ VexDay Proof

Woltlab Burning Board Lite 1.0.2 - 'decode_cookie()' SQL Injection

CVE-2006-6237—webappsphp

SQL injection vulnerability in the decode_cookie function in thread.php in Woltlab Burning Board Lite 1.0.2 allows remot

23RISK

open ↗

Referência✓ VexDay Proof

Magic News Pro 1.0.3 - 'script_path' Remote File Inclusion

CVE-2006-4823—webappsphp

PHP remote file inclusion vulnerability in scripts/news_page.php in Reamday Enterprises Magic News Pro 1.0.3 and earlier

23RISK

open ↗

Referência✓ VexDay Proof

The Classified Ad System 1.0 - 'main' SQL Injection

CVE-2006-6349—webappsasp

Multiple SQL injection vulnerabilities in PWP Technologies The Classified Ad System allow remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component ChronoForms 2.3.5 - Remote File Inclusion

CVE-2008-0567—webappsphp

Multiple PHP remote file inclusion vulnerabilities in ChronoEngine ChronoForms (com_chronocontact) 2.3.5 component for J

35RISK

open ↗

Referência✓ VexDay Proof

Downstat 1.8 - 'art' Remote File Inclusion

CVE-2006-4827—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Vmist Downstat 1.8 and earlier allow remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

Mindmeld 1.2.0.10 - Multiple Remote File Inclusions

CVE-2008-0572—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Mindmeld 1.2.0.10 allow remote attackers to execute arbitrary PHP

28RISK

open ↗

Referência✓ VexDay Proof

SafeNet 10.4.0.12 - 'IPSecDrv.sys' Local kernel Ring0 SYSTEM

CVE-2008-0573—localwindows

IPSecDrv.sys 10.4.0.12 in SafeNET HighAssurance Remote and SoftRemote allows local users to gain privileges via a crafte

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component Shambo2 - 'itemID' SQL Injection

CVE-2008-0606—webappsphp

SQL injection vulnerability in index.php in the Shambo2 (com_shambo2) component for Mambo and Joomla! allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

Ipswitch WS_FTP Server with SSH 6.1.0.0 - Remote Buffer Overflow (PoC)

CVE-2008-0590—doswindows

Buffer overflow in Ipswitch WS_FTP Server with SSH 6.1.0.0 allows remote authenticated users to cause a denial of servic

28RISK

open ↗

Referência✓ VexDay Proof

Linux Kernel 2.6.17 < 2.6.24.1 - 'vmsplice' Local Privilege Escalation (2)

CVE-2008-0600—locallinux

The vmsplice_to_pipe function in Linux kernel 2.6.17 through 2.6.24.1 does not validate a certain userspace pointer befo

23RISK

open ↗

Referência✓ VexDay Proof

All Club CMS 0.0.2 - 'index.php' SQL Injection

CVE-2008-0601—webappsphp

SQL injection vulnerability in index.php in All Club CMS (ACCMS) 0.0.1f and earlier allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

All Club CMS 0.0.1f - 'index.php' Local File Inclusion

CVE-2008-0602—webappsphp

Directory traversal vulnerability in index.php in All Club CMS (ACCMS) 0.0.1f and earlier allows remote attackers to inc

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component 'com_awesom' 0.3.2 - 'listid' SQL Injection

CVE-2008-0603—webappsphp

SQL injection vulnerability in index.php in the amazOOP Awesom! (com_awesom) 0.3.2component for Mambo and Joomla! allows

23RISK

open ↗

Referência✓ VexDay Proof

RMSOFT Gallery System 2.0 - 'id' SQL Injection

CVE-2008-0611—webappsphp

SQL injection vulnerability in rmgs/images.php in the RMSOFT Gallery System 2.0 module for XOOPS allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

phpunity.postcard - 'gallery_path' Remote File Inclusion

CVE-2006-4869—webappsphp

PHP remote file inclusion vulnerability in phpunity-postcard.php in phpunity.postcard allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

Linux Kernel 2.6.x - 'sys_timer_create()' Local Denial of Service

CVE-2006-7051—doslinux

The sys_timer_create function in posix-timers.c for Linux kernel 2.6.x allows local users to cause a denial of service (

23RISK

open ↗

Referência✓ VexDay Proof

Ipswitch WS_FTP LE 5.08 - PASV Response Remote Buffer Overflow

CVE-2006-4974—remotewindows

Buffer overflow in Ipswitch WS_FTP Limited Edition (LE) 5.08 allows remote FTP servers to execute arbitrary code via a l

23RISK

open ↗

Referência✓ VexDay Proof

phpQuiz 0.1.2 - SQL Injection / Code Execution

CVE-2006-4977—webappsphp

Multiple unrestricted file upload vulnerabilities in (1) back/upload_img.php and (2) admin/upload_img.php in Walter Besc

23RISK

open ↗

Referência✓ VexDay Proof

phpBB Prillian French Mod 0.8.0 - Remote File Inclusion

CVE-2006-5309—webappsphp

PHP remote file inclusion vulnerability in language/lang_french/lang_prillian_faq.php in the Prillian French 0.8.0 and e

23RISK

open ↗

Referência✓ VexDay Proof

PHPMyConferences 8.0.2 - 'menu.inc.php' File Inclusion

CVE-2006-5310—webappsphp

PHP remote file inclusion vulnerability in common/visiteurs/include/menus.inc.php in J-Pierre DEZELUS Les Visiteurs 2.0.

23RISK

open ↗

Referência✓ VexDay Proof

phpBB News Defilante Horizontale 4.1.1 - Remote File Inclusion

CVE-2006-5415—webappsphp

PHP remote file inclusion vulnerability in includes/functions_newshr.php in the News Defilante Horizontale 4.1.1 and ear

23RISK

open ↗

Referência✓ VexDay Proof

phpBB SearchIndexer Mod - 'archive_topic.php' Remote File Inclusion

CVE-2006-5418—webappsphp

PHP remote file inclusion vulnerability in archive/archive_topic.php in pbpbb archive for search engines (SearchIndexer)

23RISK

open ↗

Referência✓ VexDay Proof

Specimen Image Database - 'client.php' Remote File Inclusion

CVE-2006-5419—webappsphp

PHP remote file inclusion vulnerability in client.php in University of Glasgow Specimen Image Database (SID), when regis

23RISK

open ↗

Referência✓ VexDay Proof

Acunetix WVS 4.0 20060717 - HTTP Sniffer Component Remote Denial of Service

CVE-2007-0120—doswindows

Acunetix Web Vulnerability Scanner (WVS) 4.0 Build 20060717 and earlier allows remote attackers to cause a denial of ser

23RISK

open ↗

Referência✓ VexDay Proof

PHP Classifieds 7.1 - 'detail.php' SQL Injection

CVE-2006-5828—webappsphp

SQL injection vulnerability in detail.php in DeltaScripts PHP Classifieds 7.1 and earlier allows remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

L2J Statistik Script 0.09 - 'index.php' Local File Inclusion

CVE-2007-0173—webappsphp

Directory traversal vulnerability in index.php in L2J Statistik Script 0.09 and earlier, when register_globals is enable

23RISK

open ↗

Referência✓ VexDay Proof

vp-asp shopping cart 6.09 - SQL Injection / Cross-Site Scripting

CVE-2007-0225—webappsasp

Cross-site scripting (XSS) vulnerability in shopcustadmin.asp in VP-ASP Shopping Cart 6.09 and earlier allows remote att

23RISK

open ↗

Referência✓ VexDay Proof

Astanda Directory Project 1.2 - 'link_id' SQL Injection

CVE-2008-0649—webappsphp

SQL injection vulnerability in detail.php in Astanda Directory Project (ADP) 1.2 and 1.3 allows remote attackers to exec

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.