Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,151cataloged exploits

35,370CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecent popular risk

22,233 exploits

Referência✓ VexDay Proof

OtomiGen.x 2.2 - 'lang' Local File Inclusion

CVE-2008-2782—webappsphp

Multiple directory traversal vulnerabilities in OtomiGenX 2.2 allow remote attackers to include and execute arbitrary lo

23RISK

open ↗

Referência

CVE-2018-7203

CVE-2018-7203—

Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary

23RISK

open ↗

Referência

CVE-2018-7203

CVE-2018-7203—

Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary

23RISK

open ↗

Referência

CVE-2012-5908

CVE-2012-5908—

Cross-site scripting (XSS) vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remo

23RISK

open ↗

Referência

CVE-2012-2914

CVE-2012-2914—

Cross-site scripting (XSS) vulnerability in captchademo.php in Unijimpe Captcha allows remote attackers to inject arbitr

23RISK

open ↗

Referência✓ VexDay Proof

ezcms 1.2 - Blind SQL Injection / Authentication Bypass

CVE-2008-2920—webappsphp

admin/filemanager/ (aka the File Manager) in EZTechhelp EZCMS 1.2 and earlier does not require authentication, which all

23RISK

open ↗

Referência✓ VexDay Proof

Boite de News 4.0.1 - 'index.php' Remote File Inclusion

CVE-2006-4123—webappsphp

PHP remote file inclusion vulnerability in boitenews4/index.php in Boite de News 4.0.1 allows remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

phpAtm 1.21 - 'include_location' Remote File Inclusion

CVE-2006-4594—webappsphp

Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpAtm) 1.21 and earlier allow remo

23RISK

open ↗

Referência✓ VexDay Proof

syzygyCMS 0.3 - 'index.php' Local File Inclusion

CVE-2008-3593—webappsphp

Directory traversal vulnerability in index.php in SyzygyCMS 0.3 allows remote attackers to include and execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

e107 < 0.75 - 'e107language_e107cookie' Local File Inclusion

CVE-2006-5786—webappsphp

Directory traversal vulnerability in class2.php in e107 0.7.5 and earlier allows remote attackers to read and execute PH

23RISK

open ↗

Referência✓ VexDay Proof

Mini-CMS 1.0.1 - 'index.php' Local File Inclusion

CVE-2008-5593—webappsphp

Multiple directory traversal vulnerabilities in index.php in Mini CMS 1.0.1 allow remote attackers to include and execut

23RISK

open ↗

Referência✓ VexDay Proof

KTP Computer Customer Database CMS 1.0 - Local File Inclusion

CVE-2008-5953—webappsphp

Directory traversal vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, all

23RISK

open ↗

Referência✓ VexDay Proof

Absolute Form Processor XE-V 1.5 - Insecure Cookie Handling

CVE-2009-1504—webappsasp

Absolute Form Processor XE 1.5 allows remote attackers to bypass authentication and gain administrative access by settin

23RISK

open ↗

Referência✓ VexDay Proof

Bitweaver 2.6 - 'saveFeed()' Remote Code Execution

CVE-2009-1678—webappsphp

Directory traversal vulnerability in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier all

23RISK

open ↗

Referência

CVE-2010-2860

CVE-2010-2860—

The EMC Celerra Network Attached Storage (NAS) appliance accepts external network traffic to IP addresses intended for a

23RISK

open ↗

Referência

CVE-2015-4137

CVE-2015-4137—

SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2015-4137

CVE-2015-4137—

SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Cahier de texte 2.2 - Bypass General Access Protection

CVE-2006-6849—webappsphp

administration/index.php in Cahier de texte (CDT) 2.2 does not properly exit when authentication fails, which allows rem

23RISK

open ↗

Referência

CVE-2012-1027

CVE-2012-1027—

Cross-site scripting (XSS) vulnerability in account-closed.tcl in ]project-open[ (aka ]po[) 3.4.x, 3.5.0.1-2, and possib

23RISK

open ↗

Referência

CVE-2018-1204

CVE-2018-1204—

Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, an

23RISK

open ↗

Referência

CVE-2015-1400

CVE-2015-1400—

SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

Shop-Script FREE 2.0 - Remote Command Execution

CVE-2007-4933—webappsphp

Direct static code injection vulnerability in includes/admin/sub/conf_appearence.php in Shop-Script FREE 2.0 and earlier

23RISK

open ↗

Referência✓ VexDay Proof

GEPI 1.4.0 - '/gestion/savebackup.php' Remote File Inclusion

CVE-2006-5669—webappsphp

PHP remote file inclusion vulnerability in gestion/savebackup.php in Gepi 1.4.0 and earlier, and possibly other versions

23RISK

open ↗

Referência✓ VexDay Proof

iziContents rc6 - Local/Remote File Inclusion

CVE-2007-5055—webappsphp

Multiple directory traversal vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to include and exec

23RISK

open ↗

Referência✓ VexDay Proof

Flat PHP Board 1.2 - Multiple Vulnerabilities

CVE-2007-6396—webappsphp

Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inj

23RISK

open ↗

Referência✓ VexDay Proof

X7 Chat 2.0.5 - 'day' SQL Injection

CVE-2008-0278—webappsphp

SQL injection vulnerability in index.php in X7 Chat 2.0.5 and possibly earlier allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal (PoC)

CVE-2008-2938—remotemultiple

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16,

60RISK

open ↗

Referência

CVE-2012-4871

CVE-2012-4871—

Cross-site scripting (XSS) vulnerability in service/graph_html.php in the administrator panel in LiteSpeed Web Server 4.

23RISK

open ↗

Referência

CVE-2010-2906

CVE-2010-2906—

SQL injection vulnerability in articlesdetails.php in ScriptsFeed and BrotherScripts (BS) Scripts Directory allows remot

23RISK

open ↗

Referência

CVE-2018-6563

CVE-2018-6563—

Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.