Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,958cataloged exploits
36,206CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,460Referência 22,832GitHub PoC 14,991VulnCheck XDB 8,829Nuclei 4,357Metasploit 3,489✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Ol BookMarks Manager 0.7.5 - Local File Inclusion / Remote File Inclusion / SQL Injection
CVE-2008-6409—webappsphp
SQL injection vulnerability in index.php in ol'bookmarks manager 0.7.5 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
CoolPlayer Portable 2.19.1 - '.m3u' Local Buffer Overflow (2)
CVE-2009-1437—localwindows
Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka CoolPlayer+ Portable) 2.19.6 and earlier allows rem
28RISK
open ↗
Referência✓ VexDay Proof
PHP-Fusion Mod recept - 'kat_id' SQL Injection
CVE-2008-4527—webappsphp
SQL injection vulnerability in recept.php in the Recepies (Recept) module 1.1 for PHP-Fusion allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
pPIM 1.01 - 'notes.php' Local File Inclusion
CVE-2008-4528—webappsphp
Directory traversal vulnerability in notes.php in Phlatline's Personal Information Manager (pPIM) 1.01 allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component prayercenter 1.4.9 - 'id' SQL Injection
CVE-2008-6429—webappsphp
SQL injection vulnerability in the PrayerCenter (com_prayercenter) component 1.4.9 and earlier for Joomla! allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Elkagroup Image Gallery 1.0 - Arbitrary File Upload
CVE-2009-1446—webappsphp
Unrestricted file upload vulnerability in upload.php in Elkagroup Image Gallery 1.0 allows remote authenticated users to
23RISK
open ↗
Referência✓ VexDay Proof
asiCMS alpha 0.208 - Multiple Remote File Inclusions
CVE-2008-4529—webappsphp
Multiple PHP remote file inclusion vulnerabilities in asiCMS alpha 0.208 allow remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência✓ VexDay Proof
Dayfox Blog 4 - 'postpost.php' Remote Code Execution
CVE-2007-1525—webappsphp
Direct static code injection vulnerability in postpost.php in Dayfox Blog (dfblog) 4 allows remote attackers to execute
35RISK
open ↗
Referência✓ VexDay Proof
Ayco Okul Portali - 'linkid' SQL Injection
CVE-2008-4574—webappsasp
SQL injection vulnerability in default.asp in Ayco Okul Portali allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
CoolPlayer Portable 2.19.1 - 'Skin' Local Buffer Overflow
CVE-2009-1449—localwindows
Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka CoolPlayer+ Portable) 2.19.1 allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
MKPortal NoBoard Module (Beta) - Remote File Inclusion
CVE-2007-3813—webappsphp
PHP remote file inclusion vulnerability in include/user.php in the NoBoard BETA module for MKPortal allows remote attack
35RISK
open ↗
Referência✓ VexDay Proof
Chilkat FTP ActiveX 2.0 - 'ChilkatCert.dll' Insecure Method
CVE-2008-4583—remotewindows
Insecure method vulnerability in the Chilkat FTP 2.0 ActiveX component (ChilkatCert.dll) allows remote attackers to over
23RISK
open ↗
Referência✓ VexDay Proof
EDraw Office Viewer Component 5.1 - HttpDownloadFile() Insecure Method
CVE-2007-4420—remotewindows
Absolute path traversal vulnerability in a certain ActiveX control in officeviewer.ocx 5.1.199.1 in EDraw Office Viewer
23RISK
open ↗
Referência✓ VexDay Proof
Macrovision FlexNet DownloadManager - Insecure Methods
CVE-2008-4587—remotewindows
Insecure method vulnerability in the MSVNClientDownloadManager61Lib.DownloadManager.1 ActiveX control (ISDM.exe 6.1.100.
28RISK
open ↗
Referência✓ VexDay Proof
Shop Script Pro 2.12 - SQL Injection
CVE-2009-2023—webappsphp
SQL injection vulnerability in index.php in Shop-Script Pro 2.12, when magic_quotes_gpc is disabled, allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
yogurt 0.3 - Cross-Site Scripting / SQL Injection
CVE-2009-2034—webappsphp
SQL injection vulnerability in writemessage.php in Yogurt 0.3, when register_globals is enabled, allows remote authentic
23RISK
open ↗
Referência✓ VexDay Proof
PHPWebGallery 1.3.4 - Cross-Site Scripting / Local File Inclusion
CVE-2008-4591—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in admin/include/isadmin.inc.php in PhpWebGallery 1.3.4 allow remote
23RISK
open ↗
Referência✓ VexDay Proof
Sports Clubs Web Panel 0.0.1 - 'p' Local File Inclusion
CVE-2008-4592—webappsphp
Directory traversal vulnerability in index.php in Sports Clubs Web Panel 0.0.1 allows remote attackers to include and ex
23RISK
open ↗
Referência✓ VexDay Proof
EasyMail - ActiveX 'emmailstore.dll 6.5.0.3' Remote Buffer Overflow
CVE-2008-6447—remotewindows
Buffer overflow in emmailstore.dll 6.5.0.3 in the QuikSoft EasyMail MailStore ActiveX control allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
IBM Domino Web Access 7.0 Upload Module - 'inotes6.dll' Remote Buffer Overflow
CVE-2007-4474—remotewindows
Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, in
50RISK
open ↗
Referência✓ VexDay Proof
IBM Domino Web Access Upload Module - Overwrite (SEH)
CVE-2007-4474—remotewindows
Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, in
50RISK
open ↗
Referência✓ VexDay Proof
iGaming CMS 2.0 Alpha 1 - 'search.php' SQL Injection
CVE-2008-4603—webappsphp
SQL injection vulnerability in search.php in iGaming CMS 2.0 Alpha 1 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
CafeEngine - Multiple SQL Injections
CVE-2008-4605—webappsphp
SQL injection vulnerability in CafeEngine allows remote attackers to execute arbitrary SQL commands via the id parameter
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component EventList 0.8 - 'did' SQL Injection
CVE-2007-4509—webappsphp
SQL injection vulnerability in index.php in the EventList component (com_eventlist) 0.8 and earlier for Joomla! allows r
23RISK
open ↗
Referência✓ VexDay Proof
HP Virtual Rooms WebHPVCInstall Control - Remote Buffer Overflow
CVE-2008-0437—remotewindows
Multiple buffer overflows in the WebHPVCInstall.HPVirtualRooms14 ActiveX control in HPVirtualRooms14.dll 1.0.0.100, as u
35RISK
open ↗
Referência✓ VexDay Proof
Diesel Job Site - 'job_id' Blind SQL Injection
CVE-2008-6467—webappsphp
SQL injection vulnerability in jobs/jobseekers/job-info.php in Diesel Job Site allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
fungamez rc1 - Authentication Bypass / Local File Inclusion
CVE-2009-1487—webappsphp
SQL injection vulnerability in pages/login.php in FunGamez RC1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_iJoomla_rss - Blind SQL Injection
CVE-2009-2099—webappsphp
SQL injection vulnerability in the iJoomla RSS Feeder (com_ijoomla_rss) component for Joomla! allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
PortalApp 4.0 - SQL Injection / Cross-Site Scripting / Authentication Bypass
CVE-2008-4614—webappsasp
PortalApp 4.0 does not require authentication for (1) forums.asp and (2) content.asp, which allows remote attackers to c
23RISK
open ↗
Referência✓ VexDay Proof
phpFastNews 1.0.0 - Insecure Cookie Handling
CVE-2008-4622—webappsphp
The isLoggedIn function in fastnews-code.php in phpFastNews 1.0.0 allows remote attackers to bypass authentication and g
23RISK
open ↗
← previouspage 24 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.