Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,902cataloged exploits
34,597CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,624GitHub PoC 13,727VulnCheck XDB 8,410Nuclei 4,231Metasploit 3,467✓ verified onlyrecentpopularrisk
21,624 exploits
Referência✓ VexDay Proof
Spaminator 1.7 - 'page' Remote File Inclusion
CVE-2006-4158—webappsphp
PHP remote file inclusion vulnerability in Login.php in Spaminator 1.7 and earlier allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
phpBB Journals System Mod 1.0.2 RC2 - Remote File Inclusion
CVE-2006-5306—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the Journals System module 1.0.2 (RC2) and earlier for phpBB allow
23RISK
open ↗
Referência✓ VexDay Proof
MyABraCaDaWeb 1.0.3 - 'base' Remote File Inclusion
CVE-2006-4719—webappsphp
Multiple PHP remote file inclusion vulnerabilities in MyABraCaDaWeb 1.0.3, when register_globals is enabled, allow remot
23RISK
open ↗
Referência✓ VexDay Proof
Formbankserver 1.9 - 'Name' Remote Denial of Service
CVE-2006-6910—doswindows
formbankcgi.exe in Fersch Formbankserver 1.9, when the PATH_INFO begins with Abfrage, allows remote attackers to cause a
23RISK
open ↗
Referência✓ VexDay Proof
PHP 5.2.3 - 'bz2 com_print_typeinfo()' Denial of Service
CVE-2007-3790—dosmultiple
The com_print_typeinfo function in the bz2 extension in PHP 5.2.3 allows context-dependent attackers to cause a denial o
23RISK
open ↗
Referência✓ VexDay Proof
PHP iCalendar 2.24 - Insecure Cookie Handling
CVE-2008-5840—webappsphp
PHP iCalendar 2.24 and earlier allows remote attackers to bypass authentication by setting the phpicalendar and phpicale
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_Projectfork 2.0.10 - Local File Inclusion
CVE-2009-2100—webappsphp
Directory traversal vulnerability in the JoomlaPraise Projectfork (com_projectfork) component 2.0.10 for Joomla! allows
38RISK
open ↗
Referência✓ VexDay Proof
Campsite 3.3.0 RC1 - Multiple Remote File Inclusions
CVE-2009-2182—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Campsite 3.3.0 RC1 allow remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência
CVE-2020-26808
CVE-2020-26808CRITICAL
SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 a
48RISK
open ↗
Referência
CVE-2023-28285
CVE-2023-28285HIGH
Microsoft Office Remote Code Execution Vulnerability
41RISK
open ↗
Referência
CVE-2018-4241
CVE-2018-4241—
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b
23RISK
open ↗
Referência
CVE-2009-4251
CVE-2009-4251—
Stack-based buffer overflow in Jasc Paint Shop Pro 8.10 (aka Corel Paint Shop Pro) allows user-assisted remote attackers
23RISK
open ↗
Referência
CVE-2016-8018
CVE-2016-8018—
Cross-site request forgery (CSRF) vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier)
23RISK
open ↗
Referência
CVE-2010-5025
CVE-2010-5025—
Cross-site scripting (XSS) vulnerability in manage/main.php in CuteSITE CMS 1.2.3 and 1.5.0 allows remote attackers to i
23RISK
open ↗
Referência
CVE-2018-17996
CVE-2018-17996—
LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_
23RISK
open ↗
Referência
CVE-2018-17996
CVE-2018-17996—
LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_
23RISK
open ↗
Referência
CVE-2017-8927
CVE-2017-8927—
Buffer overflow in Larson VizEx Reader 9.7.5 allows attackers to cause a denial of service or possibly have unspecified
23RISK
open ↗
Referência
CVE-2009-4542
CVE-2009-4542—
Cross-site scripting (XSS) vulnerability in newticket.php in IsolSoft Support Center 2.5 allows remote attackers to inje
23RISK
open ↗
Referência✓ VexDay Proof
Cartweaver 2.16.11 - 'ProdID' SQL Injection
CVE-2006-2046—webappscgi
Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote at
23RISK
open ↗
Referência✓ VexDay Proof
OPENi-CMS 1.0.1beta - 'config' Remote File Inclusion
CVE-2006-4750—webappsphp
PHP remote file inclusion vulnerability in openi-admin/base/fileloader.php in OPENi-CMS 1.0.1, and possibly earlier, all
23RISK
open ↗
Referência✓ VexDay Proof
KGB 1.9 - 'sesskglogadmin.php' Local File Inclusion
CVE-2007-0337—webappsphp
Directory traversal vulnerability in sesskglogadmin.php in KGB 1.9 and earlier allows remote attackers to include and ex
23RISK
open ↗
Referência✓ VexDay Proof
Aktueldownload Haber scripti - 'id' SQL Injection
CVE-2007-1015—webappsasp
SQL injection vulnerability in HaberDetay.asp in Aktueldownload Haber script allows remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
F3Site 2.1 - Remote Code Execution
CVE-2007-0763—webappsphp
Cross-site scripting (XSS) vulnerability in the news comment functionality in F3Site 2.1 and earlier allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke Module AddressBook 1.2 - Local File Inclusion
CVE-2007-1720—webappsphp
Directory traversal vulnerability in addressbook.php in the Addressbook 1.2 module for PHP-Nuke allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
public media manager 1.3 - Remote File Inclusion
CVE-2007-5149—webappsphp
PHP remote file inclusion vulnerability in NewsCMS/news/newstopic_inc.php in North Country Public Radio Public Media Man
23RISK
open ↗
Referência✓ VexDay Proof
mxBB Module mx_glance 2.3.3 - Remote File Inclusion
CVE-2007-5178—webappsphp
contrib/mx_glance_sdesc.php in the mx_glance 2.3.3 module for mxBB places a critical security check within a comment bec
23RISK
open ↗
Referência✓ VexDay Proof
IBM Director 5.20.3su2 CIM Server - Remote Denial of Service
CVE-2009-0879—doswindows
The CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to cause a denial of se
23RISK
open ↗
Referência✓ VexDay Proof
Catviz 0.4.0 beta1 - Local File Inclusion / Cross-Site Scripting
CVE-2009-1749—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Catviz 0.4.0 beta 1 allow remote attackers to inject
23RISK
open ↗
Referência
CVE-2008-4141
CVE-2008-4141—
Multiple PHP remote file inclusion vulnerabilities in x10Media x10 Automatic MP3 Script 1.5.5 allow remote attackers to
23RISK
open ↗
Referência
CVE-2009-2325
CVE-2009-2325—
Directory traversal vulnerability in index.php in Clicknet CMS 2.1 allows remote attackers to read arbitrary files via a
23RISK
open ↗
← previouspage 259 / 721next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.