Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,231cataloged exploits
35,420CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
Ktools Photostore 3.5.1 - 'gid' SQL Injection
CVE-2008-6649—webappsphp09 May 2008
SQL injection vulnerability in manager/image_details_editor.php in Ktools PhotoStore 2.5, 2.9.8, 3.1.0, and other versio
23RISK
open ↗
Exploit-DB✓ VexDay Proof
SAP Internet Transaction Server 6200.1017.50954.0 Bu (WGate) - 'wgate.dll?~service' Cross-Site Scripting
CVE-2008-2123—webappscgi08 May 2008
Cross-site scripting (XSS) vulnerability in WGate in SAP Internet Transaction Server (ITS) 6.20 allows remote attackers
23RISK
open ↗
Exploit-DB✓ VexDay Proof
SAP Internet Transaction Server 6200.1017.50954.0 - Bu query String JavaScript Splicing Cross-Site Scripting
CVE-2008-2123—webappscgi08 May 2008
Cross-site scripting (XSS) vulnerability in WGate in SAP Internet Transaction Server (ITS) 6.20 allows remote attackers
23RISK
open ↗
Exploit-DB✓ VexDay Proof
SonicWALL Email Security 6.1.1 - Error Page Cross-Site Scripting
CVE-2008-2162—remotemultiple08 May 2008
Cross-site scripting (XSS) vulnerability in SonicWall Email Security 6.1.1 allows remote attackers to inject arbitrary w
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 2 - UTF-7 HTTP Response Handling
CVE-2008-2168—remotewindows08 May 2008
Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web scr
35RISK
open ↗
Exploit-DB✓ VexDay Proof
ZyWALL 100 HTTP Referer Header - Cross-Site Scripting
CVE-2008-2167—remotemultiple08 May 2008
Cross-site scripting (XSS) vulnerability in ZyXEL ZyWALL 100 allows remote attackers to inject arbitrary web script or H
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Orenosv HTTP/FTP Server 0.8.1 - FTP Commands Remote Buffer Overflow
CVE-2005-1666—doswindows08 May 2008
Multiple buffer overflows in Orenosv HTTP/FTP Server 0.8.1 allow remote authenticated users to cause a denial of service
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Tux CMS 0.1 - Multiple Cross-Site Scripting Vulnerabilities
CVE-2008-2126—webappsphp07 May 2008
Multiple cross-site scripting (XSS) vulnerabilities in Tux CMS 0.1 allow remote attackers to inject arbitrary web script
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Forum Rank System 6 - 'settings['locale']' Multiple Local File Inclusions
CVE-2008-2227—webappsphp07 May 2008
Multiple directory traversal vulnerabilities in PHP-Fusion Forum Rank System 6 allow remote attackers to include and exe
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Yahoo! Assistant 3.6 - 'yNotifier.dll' ActiveX Control Memory Corruption
CVE-2008-2111—doswindows06 May 2008
The ActiveX Control (yNotifier.dll) in Yahoo! Assistant 3.6 and earlier allows remote attackers to execute arbitrary cod
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Sphider 1.3.4 - 'query' Cross-Site Scripting
CVE-2008-5211—webappsphp06 May 2008
Cross-site scripting (XSS) vulnerability in search.php in Sphider 1.3.4, when the search suggestion feature is enabled,
23RISK
open ↗
Exploit-DB✓ VexDay Proof
QTO File Manager 1.0 - 'qtofm.php' Arbitrary File Upload
CVE-2008-2110—webappsphp06 May 2008
Unrestricted file upload vulnerability in qtofm.php in QTOFileManager 1.0 allows remote attackers to execute arbitrary P
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Maian Uploader 4.0 - 'header.php' Cross-Site Scripting
CVE-2008-2202—webappsphp05 May 2008
Multiple cross-site scripting (XSS) vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Maian Uploader 4.0 - 'keywords' Cross-Site Scripting
CVE-2008-2202—webappsphp05 May 2008
Multiple cross-site scripting (XSS) vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web
23RISK
open ↗
Exploit-DB✓ VexDay Proof
BatmanPorTaL - 'profil.asp?id' SQL Injection
CVE-2008-6640—webappsphp05 May 2008
Multiple SQL injection vulnerabilities in BatmanPorTaL allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Miniweb 2.0 - 'historymonth' SQL Injection
CVE-2008-6582—webappsphp05 May 2008
SQL injection vulnerability in index.php in Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Exploit-DB✓ VexDay Proof
BatmanPorTaL - 'uyeadmin.asp?id' SQL Injection
CVE-2008-6640—webappsphp05 May 2008
Multiple SQL injection vulnerabilities in BatmanPorTaL allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Exploit-DB✓ VexDay Proof
iGaming CMS 1.5 - 'poll_vote.php' SQL Injection
CVE-2008-2130—webappsphp05 May 2008
SQL injection vulnerability in poll_vote.php in iGaming CMS 1.5 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
GEDCOM_TO_MYSQL - '/PHP/prenom.php' Multiple Cross-Site Scripting Vulnerabilities
CVE-2008-6655—webappsphp05 May 2008
Multiple cross-site scripting (XSS) vulnerabilities in GEDCOM_TO_MYSQL 2 allow remote attackers to inject arbitrary web
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Maian Uploader 4.0 - 'index.php' Cross-Site Scripting
CVE-2008-2202—webappsphp05 May 2008
Multiple cross-site scripting (XSS) vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web
23RISK
open ↗
Exploit-DB✓ VexDay Proof
LifeType 1.2.8 - 'admin.php' Cross-Site Scripting
CVE-2008-2196—webappsphp05 May 2008
Cross-site scripting (XSS) vulnerability in admin.php in LifeType 1.2.8 allows remote attackers to inject arbitrary web
23RISK
open ↗
Exploit-DB✓ VexDay Proof
GEDCOM_TO_MYSQL - '/PHP/info.php' Multiple Cross-Site Scripting Vulnerabilities
CVE-2008-6655—webappsphp05 May 2008
Multiple cross-site scripting (XSS) vulnerabilities in GEDCOM_TO_MYSQL 2 allow remote attackers to inject arbitrary web
23RISK
open ↗
Exploit-DB✓ VexDay Proof
GEDCOM_TO_MYSQL - '/PHP/index.php?nom_branche' Cross-Site Scripting
CVE-2008-6655—webappsphp05 May 2008
Multiple cross-site scripting (XSS) vulnerabilities in GEDCOM_TO_MYSQL 2 allow remote attackers to inject arbitrary web
23RISK
open ↗
Exploit-DB✓ VexDay Proof
SiteXS CMS 0.1.1 - 'upload.php' Arbitrary File Upload
CVE-2008-6617—webappsphp03 May 2008
Unrestricted file upload vulnerability in adm/visual/upload.php in SiteXS CMS 0.1.1 allows remote attackers to execute a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
SmartBlog 1.3 - 'index.php' SQL Injection
CVE-2008-2184—webappsphp03 May 2008
Multiple SQL injection vulnerabilities in SMartBlog (aka SMBlog) 1.3 allow remote attackers to execute arbitrary SQL com
23RISK
open ↗
Exploit-DB✓ VexDay Proof
SmartBlog 1.3 - 'index.php' SQL Injection
CVE-2008-2185—webappsphp03 May 2008
Directory traversal vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to include arbitrar
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Alumni 1.0.8/1.0.9 - 'info.php?id' SQL Injection
CVE-2008-2118—webappsphp02 May 2008
SQL injection vulnerability in info.php in Project Alumni 1.0.9 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Zen Cart 2008 - 'index.php?keyword' SQL Injection
CVE-2008-6615—webappsphp02 May 2008
SQL injection vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Exploit-DB✓ VexDay Proof
EJ3 BlackBook 1.0 - 'footer.php' Multiple Cross-Site Scripting Vulnerabilities
CVE-2008-2188—webappsphp02 May 2008
Multiple cross-site scripting (XSS) vulnerabilities in EJ3 BlackBook 1.0 allow remote attackers to inject arbitrary web
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Zen Cart 2008 - 'index.php?keyword' Cross-Site Scripting
CVE-2008-6616—webappsphp02 May 2008
Cross-site scripting (XSS) vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to inject ar
23RISK
open ↗
← previouspage 486 / 816next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.