Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,020cataloged exploits

35,276CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,446Referência 22,166GitHub PoC 14,080VulnCheck XDB 8,604Nuclei 4,251Metasploit 3,473✓ verified onlyrecent popular risk

22,103 exploits

Referência✓ VexDay Proof

AvailScript Jobs Portal Script - (Authenticated) Arbitrary File Upload

CVE-2008-7021—webappsphp

Unrestricted file upload vulnerability in editlogo.php in AvailScript Jobs Portal Script allows remote authenticated use

23RISK

open ↗

Referência✓ VexDay Proof

Popcorn 1.87 - Remote Heap Overflow (PoC)

CVE-2009-1647—doswindows

Heap-based buffer overflow in popcorn.exe in Ultrafunk Popcorn 1.87 allows remote POP3 servers to cause a denial of serv

23RISK

open ↗

Referência

CVE-2009-3151

CVE-2009-3151—

Directory traversal vulnerability in actions/downloadFile.php in Ultrize TimeSheet 1.2.2 allows remote attackers to read

23RISK

open ↗

Referência

CVE-2018-11443

CVE-2018-11443—

The parameter q is affected by Cross-site Scripting in jobcard-ongoing.php in EasyService Billing 1.0.

23RISK

open ↗

Referência

CVE-2017-6331

CVE-2017-6331—

Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a

23RISK

open ↗

Referência

CVE-2009-4748

CVE-2009-4748—

SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows

23RISK

open ↗

Referência

CVE-2009-4748

CVE-2009-4748—

SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows

23RISK

open ↗

Referência✓ VexDay Proof

UBBCentral UBB.Threads 6.4.x < 6.5.2 - 'thispath' Remote File Inclusion

CVE-2006-2568—webappsphp

PHP remote file inclusion vulnerability in addpost_newpoll.php in UBB.threads 6.4 through 6.5.2 and 6.5.1.1 (trial) allo

23RISK

open ↗

Referência

CVE-2015-1517

CVE-2015-1517—

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to

23RISK

open ↗

Referência

CVE-2010-0967

CVE-2010-0967—

Multiple directory traversal vulnerabilities in Geekhelps ADMP 1.01, when magic_quotes_gpc is disabled, allow remote att

23RISK

open ↗

Referência

CVE-2024-27620

CVE-2024-27620HIGH

An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request

41RISK

open ↗

Referência✓ VexDay Proof

Sisfo Kampus 2006 - 'dwoprn.php?f' Arbitrary File Download

CVE-2007-4895—webappsphp

Directory traversal vulnerability in dwoprn.php in Sisfo Kampus 2006 (Semarang 3) allows remote attackers to read arbitr

23RISK

open ↗

Referência✓ VexDay Proof

JShop 1.x < 2.x - 'xPage' Local File Inclusion

CVE-2008-1624—webappsphp

Directory traversal vulnerability in v2demo/page.php in Jshop Server 1.x through 2.x allows remote attackers to include

23RISK

open ↗

Referência

CVE-2010-1475

CVE-2010-1475—

Directory traversal vulnerability in the Preventive & Reservation (com_preventive) component 1.0.5 for Joomla! allows re

38RISK

open ↗

Referência✓ VexDay Proof

VidShare Pro - Arbitrary File Upload

CVE-2009-1750—webappsphp

Unrestricted file upload vulnerability in VidSharePro allows remote authenticated users to execute arbitrary code by upl

23RISK

open ↗

Referência

CVE-2018-5978

CVE-2018-5978—

SQL Injection exists in Facebook Style Php Ajax Chat Zechat 1.5 via the login.php User field.

23RISK

open ↗

Referência✓ VexDay Proof

Star FTP Server 1.10 - 'RETR' Remote Denial of Service

CVE-2006-6643—doswindows

Fightersoft Multimedia Star FTP server 1.10 allows remote attackers to cause a denial of service (crash) via multiple RE

23RISK

open ↗

Referência

CVE-2018-6395

CVE-2018-6395—

SQL Injection exists in the Visual Calendar 3.1.3 component for Joomla! via the id parameter in a view=load action.

23RISK

open ↗

Referência✓ VexDay Proof

photokron 1.7 - Remote Database Disclosure

CVE-2008-0297—webappsphp

PhotoKorn allows remote attackers to obtain database credentials via a direct request to update/update3.php, which inclu

23RISK

open ↗

Referência

CVE-2016-3313

CVE-2016-3313—

Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016, Word 2016 for Mac, and Word Viewer allow remote at

35RISK

open ↗

Referência✓ VexDay Proof

BolinOS 4.6.1 - Local File Inclusion / Cross-Site Scripting

CVE-2008-1557—webappsphp

BolinOS 4.6.1 allows remote attackers to obtain sensitive information via a direct request to system/actionspages/_b/con

23RISK

open ↗

Referência✓ VexDay Proof

phpFullAnnu 5.1 - 'repmod' Remote File Inclusion

CVE-2006-4644—webappsphp

PHP remote file inclusion vulnerability in modules/home.module.php in phpFullAnnu 5.1 and earlier allows remote attacker

23RISK

open ↗

Referência✓ VexDay Proof

Noticeware E-mail Server 5.1.2.2 - 'POP3' Denial of Service

CVE-2008-6185—doswindows

NoticeWare Email Server NG 5.1.2.2 allows remote attackers to cause a denial of service (crash) via multiple POP3 reques

23RISK

open ↗

Referência

CVE-2021-36520

CVE-2021-36520HIGH

A SQL injection vulnerability in I-Tech Trainsmart r1044 exists via a evaluation/assign-evaluation?id= URI.

41RISK

open ↗

Referência

CVE-2016-3357

CVE-2016-3357—

Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 20

35RISK

open ↗

Referência

CVE-2010-1477

CVE-2010-1477—

SQL injection vulnerability in the SermonSpeaker (com_sermonspeaker) component before 3.2.1 for Joomla! allows remote at

23RISK

open ↗

Referência

CVE-2018-8584

CVE-2018-8584—

An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (A

23RISK

open ↗

Referência✓ VexDay Proof

TorrentTrader Classic 1.09 - Multiple Vulnerabilities

CVE-2009-2159—webappsphp

backup-database.php in TorrentTrader Classic 1.09 does not require administrative authentication, which allows remote at

23RISK

open ↗

Referência✓ VexDay Proof

OPT Max 1.2.0 - 'CRM_inc' Remote File Inclusion

CVE-2006-4239—webappsphp

PHP remote file inclusion vulnerability in include/urights.php in Outreach Project Tool (OPT) Max 1.2.6 and earlier allo

23RISK

open ↗

Referência✓ VexDay Proof

HLStats 1.34 - 'hlstats.php' SQL Injection

CVE-2006-6781—webappsphp

HLstats 1.20 through 1.34 allows remote attackers to obtain sensitive information via playinfo mode, with certain values

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.