Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,008cataloged exploits

34,638CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,662GitHub PoC 13,743VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecent popular risk

21,662 exploits

Referência

CVE-2012-3837

CVE-2012-3837—

Multiple cross-site scripting (XSS) vulnerabilities in apps/users/registration.template.php in Baby Gekko 1.2.0 and earl

23RISK

open ↗

Referência✓ VexDay Proof

Extreme phpBB 3.0.1 - 'functions.php' Remote File Inclusion

CVE-2007-1105—webappsphp

PHP remote file inclusion vulnerability in functions.php in Extreme phpBB (aka phpBB Extreme) 3.0.1 allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

Smeego 1.0 - 'Cookie lang' Local File Inclusion

CVE-2008-2352—webappsphp

Directory traversal vulnerability in index.php in Smeego 1.0, when magic_quotes_gpc is disabled, allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Docebo 3.5.0.3 - '/lib.regset.php/non-blind' SQL Injection

CVE-2008-7153—webappsphp

SQL injection vulnerability in the autoDetectRegion function in doceboCore/lib/lib.regset.php in Docebo 3.5.0.3 and earl

23RISK

open ↗

Referência✓ VexDay Proof

Docebo 3.5.0.3 - 'lib.regset.php' Command Execution

CVE-2008-7153—webappsphp

SQL injection vulnerability in the autoDetectRegion function in doceboCore/lib/lib.regset.php in Docebo 3.5.0.3 and earl

23RISK

open ↗

Referência✓ VexDay Proof

Pixie CMS - Cross-Site Scripting / SQL Injection

CVE-2009-1066—webappsphp

SQL injection vulnerability in the referral function in admin/lib/lib_logs.php in Pixie CMS 1.01a allows remote attacker

23RISK

open ↗

Referência✓ VexDay Proof

ASPThai.Net WebBoard 6.0 - SQL Injection

CVE-2009-0703—webappsphp

SQL injection vulnerability in bview.asp in ASPThai.Net Webboard 6.0 allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

WSN Guest 1.23 - 'Search' SQL Injection

CVE-2009-0704—webappsphp

SQL injection vulnerability in search.php in WSN Guest 1.23 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

PowerNews 2.5.4 - 'newsid' SQL Injection

CVE-2009-0705—webappsphp

SQL injection vulnerability in news.php in PowerScripts PowerNews 2.5.4, when magic_quotes_gpc is disabled, allows remot

23RISK

open ↗

Referência✓ VexDay Proof

MDPro Module My_eGallery - 'pid' SQL Injection

CVE-2009-0728—webappsphp

SQL injection vulnerability in the My_eGallery module for MAXdev MDPro (MD-Pro) and Postnuke allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

Free Arcade Script 1.0 - Local File Inclusion Command Execution

CVE-2009-0731—webappsphp

Directory traversal vulnerability in pages/play.php in Free Arcade Script 1.0 allows remote attackers to include and exe

23RISK

open ↗

Referência✓ VexDay Proof

Kipper 2.01 - Cross-Site Scripting / Local File Inclusion / File Disclosure

CVE-2009-0763—webappsphp

Cross-site scripting (XSS) vulnerability in default.php in Kipper 2.01 allows remote attackers to inject arbitrary web s

23RISK

open ↗

Referência✓ VexDay Proof

Kipper 2.01 - Cross-Site Scripting / Local File Inclusion / File Disclosure

CVE-2009-0767—webappsphp

Kipper 2.01 stores sensitive information under the web root with insufficient access control, which allows remote attack

23RISK

open ↗

Referência

CVE-2011-5183

CVE-2011-5183—

Multiple SQL injection vulnerabilities in OrderSys 1.6.4 and earlier allow remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

YapBB 1.2 - 'forumID' Blind SQL Injection

CVE-2009-0768—webappsphp

SQL injection vulnerability in forumhop.php in YapBB 1.2 and earlier allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

XGuestBook 2.0 - Authentication Bypass

CVE-2009-0810—webappsphp

SQL injection vulnerability in login.php in xGuestbook 2.0 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

Hex Workshop 6.0 - '.hex' Local Code Execution

CVE-2009-0812—localwindows

Stack-based buffer overflow in BreakPoint Software Hex Workshop 4.23, 6.0.1.4603, and other 6.x and earlier versions all

23RISK

open ↗

Referência✓ VexDay Proof

BlogHelper - Remote Configuration File Disclosure

CVE-2009-0826—webappsphp

BlogHelper stores common_db.inc under the web root with insufficient access control, which allows remote attackers to do

23RISK

open ↗

Referência✓ VexDay Proof

PHP-Fusion Mod Members CV (job) 1.0 - SQL Injection

CVE-2009-0831—webappsphp

SQL injection vulnerability in members.php in the Members CV (job) module 1.0 for PHP-Fusion, when magic_quotes_gpc is d

23RISK

open ↗

Referência✓ VexDay Proof

isiAJAX 1 - 'praises.php?id' SQL Injection

CVE-2009-0881—webappsphp

SQL injection vulnerability in ejemplo/paises.php in isiAJAX 1 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

Blue Eye CMS 1.0.0 - Remote Cookie SQL Injection

CVE-2009-0883—webappsphp

SQL injection vulnerability in Blue Eye CMS 1.0.0 and earlier, when magic_quotes_gpc is disabled, allows remote attacker

23RISK

open ↗

Referência✓ VexDay Proof

Media Commands - '.m3u' / '.m3l' / '.TXT' / '.LRC' Local Heap Overflow (PoC)

CVE-2009-0885—doswindows

Multiple heap-based buffer overflows in Media Commands 1.0 allow remote attackers to execute arbitrary code or cause a d

23RISK

open ↗

Referência✓ VexDay Proof

Apple iTunes 8.1.1 - 'ITMS' Multiple Protocol Handler Buffer Overflow (Metasploit)

CVE-2009-0950—remoteosx

Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a deni

43RISK

open ↗

Referência✓ VexDay Proof

Apple iTunes 8.1.1.10 (Windows) - 'itms/itcp' Remote Buffer Overflow

CVE-2009-0950—remotewindows

Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a deni

43RISK

open ↗

Referência✓ VexDay Proof

GDL 4.x - 'node' SQL Injection

CVE-2009-0965—webappsphp

SQL injection vulnerability in functions/browse.php in Ganesha Digital Library (GDL) 4.0 and 4.2 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

WordPress Plugin fMoblog 2.1 - 'id' SQL Injection

CVE-2009-0968—webappsphp

SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

Oracle APEX 3.2 - Unprivileged DB users can see APEX Password hashes

CVE-2009-0981—localmultiple

Unspecified vulnerability in the Application Express component in Oracle Database 11.1.0.7 allows remote authenticated u

23RISK

open ↗

Referência✓ VexDay Proof

Beerwin's PHPLinkAdmin 1.0 - Remote File Inclusion / SQL Injection

CVE-2009-1024—webappsphp

Multiple SQL injection vulnerabilities in Beerwin PHPLinkAdmin 1.0 allow remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

Beerwin's PHPLinkAdmin 1.0 - Remote File Inclusion / SQL Injection

CVE-2009-1025—webappsphp

PHP remote file inclusion vulnerability in linkadmin.php in Beerwin PHPLinkAdmin 1.0 allows remote attackers to execute

28RISK

open ↗

Referência✓ VexDay Proof

Kim Websites 1.0 - Authentication Bypass

CVE-2009-1026—webappsphp

Multiple SQL injection vulnerabilities in login.php in Kim Websites 1.0 allow remote attackers to execute arbitrary SQL

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.