Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,794cataloged exploits
36,057CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,459Referência 22,721GitHub PoC 14,946VulnCheck XDB 8,829Nuclei 4,350Metasploit 3,489✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Cold BBS - Remote Database Disclosure
CVE-2008-5597—webappsasp
Cold BBS stores sensitive information under the web root with insufficient access control, which allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
NCTAudioStudio2 - ActiveX DLL 2.6.1.148 'CreateFile()'/ Insecure Method
CVE-2007-3493—remotewindows
A certain ActiveX control in NCTWavChunksEditor2.dll 2.6.1.148 in NCTAudioStudio (NCTAudioStudio2) 2.7, as used by Sienz
35RISK
open ↗
Referência✓ VexDay Proof
ASPTicker 1.0 - Remote Database Disclosure
CVE-2008-5603—webappsasp
ASPTicker 1.0 stores sensitive information under the web root with insufficient access control, which allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
My Simple Forum 3.0 - Local File Inclusion
CVE-2008-5604—webappsphp
Directory traversal vulnerability in index.php in My Simple Forum 3.0 and 4.1, when magic_quotes_gpc is disabled, allows
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_colorlab 1.0 - Remote File Inclusion
CVE-2007-5451—webappsphp
PHP remote file inclusion vulnerability in admin.color.php in the com_colorlab (aka com_color) 1.0 component for Joomla!
35RISK
open ↗
Referência✓ VexDay Proof
MyCars Automotive - Authentication Bypass
CVE-2009-2018—webappsphp
SQL injection vulnerability in admin/index.php in Jared Eckersley MyCars, when magic_quotes_gpc is disabled, allows remo
23RISK
open ↗
Referência✓ VexDay Proof
Fuzzylime Forum 1.0 - 'low.php?topic' SQL Injection
CVE-2007-3235—webappsphp
Cross-site scripting (XSS) vulnerability in low.php in Fuzzylime Forum 1.0 allows remote attackers to inject arbitrary w
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module horoscope 2.0 - Remote File Inclusion
CVE-2007-3236—webappsphp
PHP remote file inclusion vulnerability in footer.php in the Horoscope 1.0 module for XOOPS allows remote attackers to e
45RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Mobile 6.0 - Device Long Name Remote Reboot (Denial of Service)
CVE-2008-4295—doshardware
Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to esta
35RISK
open ↗
Referência✓ VexDay Proof
Profense Web Application Firewall 2.6.2 - Cross-Site Request Forgery / Cross-Site Scripting
CVE-2009-0467—remotewindows
Cross-site scripting (XSS) vulnerability in proxy.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allows remot
23RISK
open ↗
Referência✓ VexDay Proof
xoops module tinycontent 1.5 - Remote File Inclusion
CVE-2007-3237—webappsphp
PHP remote file inclusion vulnerability in admin/spaw/spaw_control.class.php in the TinyContent 1.5 module for XOOPS all
35RISK
open ↗
Referência✓ VexDay Proof
tbdev 01-01-2008 - Multiple Vulnerabilities
CVE-2009-2138—webappsphp
Multiple open redirect vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to redirect users to arbitrary web s
23RISK
open ↗
Referência✓ VexDay Proof
Roundcube Webmail 0.2-3 Beta - Code Execution
CVE-2008-5619—webappsphp
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail)
35RISK
open ↗
Referência✓ VexDay Proof
XM Easy Personal FTP Server 5.6.0 - Remote Denial of Service
CVE-2008-5626—doswindows
XM Easy Personal FTP Server 5.6.0 allows remote authenticated users to cause a denial of service via a crafted argument
50RISK
open ↗
Referência✓ VexDay Proof
PHPMyInventory 2.8 - 'global.inc.php' Remote File Inclusion
CVE-2007-3270—webappsphp
PHP remote file inclusion vulnerability in Includes/global.inc.php in phpMyInventory 2.8 allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
campus virtual-lms - Cross-Site Scripting / SQL Injection
CVE-2009-2150—webappsphp
Multiple cross-site request forgery (CSRF) vulnerabilities in Campus Virtual-LMS allow (1) remote attackers to hijack th
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component flash fun! 1.0 - Remote File Inclusion
CVE-2007-4955—webappsphp
PHP remote file inclusion vulnerability in admin.joomlaflashfun.php in the Flash Fun! (com_joomlaflashfun) 1.0 component
28RISK
open ↗
Referência✓ VexDay Proof
Active Trade 2 - Authentication Bypass
CVE-2008-5627—webappsasp
SQL injection vulnerability in account.asp in Active Trade 2 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
LiveCMS 3.4 - 'categoria.php?cid' SQL Injection
CVE-2007-3292—webappsphp
Unrestricted file upload vulnerability in LiveCMS 3.4 and earlier allows remote attackers to upload and execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
MiniBill 1.2.5 - 'run_billing.php' Remote File Inclusion
CVE-2007-3306—webappsphp
PHP remote file inclusion vulnerability in crontab/run_billing.php in MiniBill 1.2.5 allows remote attackers to execute
35RISK
open ↗
Referência✓ VexDay Proof
Distinct TFTP 3.10 - Writable Directory Traversal Execution (Metasploit)
CVE-2012-6664CRITICALwebappswindows
Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remo
68RISK
open ↗
Referência✓ VexDay Proof
Turnkey Arcade Script - SQL Injection (1)
CVE-2008-5629—webappsphp
SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
eWebquiz 8 - Authentication Bypass
CVE-2008-5631—webappsasp
SQL injection vulnerability in start.asp in Active eWebquiz 8.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
Active Membership 2 - Authentication Bypass
CVE-2008-5635—webappsasp
SQL injection vulnerability in account.asp in Active Membership 2.0 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
TxtBlog 1.0 Alpha - Local File Inclusion
CVE-2008-5639—webappsphp
Directory traversal vulnerability in index.php in TxtBlog 1.0 Alpha allows remote attackers to read arbitrary files via
23RISK
open ↗
Referência✓ VexDay Proof
patBBcode 1.0 - 'bbcodeSource.php' Remote File Inclusion
CVE-2007-5995—webappsphp
PHP remote file inclusion vulnerability in examples/patExampleGen/bbcodeSource.php in patBBcode 1.0 allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
Campsite 3.3.0 RC1 - Multiple Remote File Inclusions
CVE-2009-2181—webappsphp
Cross-site scripting (XSS) vulnerability in admin-files/templates/list_dir.php in Campsite 3.3.0 RC1 allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
Opera 9.62 - 'file://' Local Heap Overflow
CVE-2008-5178—localwindows
Heap-based buffer overflow in Opera 9.62 on Windows allows remote attackers to execute arbitrary code via a long file://
35RISK
open ↗
Referência✓ VexDay Proof
Active Bids 3.5 - 'itemID' Blind SQL Injection
CVE-2008-5640—webappsphp
SQL injection vulnerability in bidhistory.asp in Active Bids 3.5 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
CMS Made Simple 1.4.1 - Local File Inclusion
CVE-2008-5642—webappsphp
Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary
23RISK
open ↗
← previouspage 4 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.