Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,449cataloged exploits

35,552CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,367GitHub PoC 14,225VulnCheck XDB 8,649Nuclei 4,283Metasploit 3,474✓ verified onlyrecent popular risk

22,367 exploits

Referência

CVE-2023-4113

CVE-2023-4113MEDIUM

PHP Jabbers Service Booking Script index.php cross site scripting

48RISK

open ↗

Referência✓ VexDay Proof

PHPStore Complete Classifieds Script - Arbitrary File Upload

CVE-2008-6928—webappsphp

Unrestricted file upload vulnerability in PHPStore Complete Classifieds allows remote authenticated users to execute arb

23RISK

open ↗

Referência

CVE-2023-4116

CVE-2023-4116MEDIUM

PHP Jabbers Taxi Booking index.php cross site scripting

48RISK

open ↗

Referência✓ VexDay Proof

PHPStore PHP Job Search Script - Arbitrary File Upload

CVE-2008-6931—webappsphp

Unrestricted file upload vulnerability in PHPStore Job Search (aka PHPCareers) allows remote authenticated users to exec

23RISK

open ↗

Referência✓ VexDay Proof

Alstrasoft SendIt Pro - Arbitrary File Upload

CVE-2008-6932—webappsphp

Unrestricted file upload vulnerability in submit_file.php in AlstraSoft SendIt Pro allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

Exodus 0.10 - URI Handler Arbitrary Parameter Injection (2)

CVE-2008-6935—remotewindows

Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, over

23RISK

open ↗

Referência✓ VexDay Proof

Pi3Web 2.0.3 - 'ISAPI' Remote Denial of Service

CVE-2008-6938—doswindows

Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi

43RISK

open ↗

Referência✓ VexDay Proof

ScriptsFeed (SF) Real Estate Classifieds Software - Arbitrary File Upload

CVE-2008-6942—webappsphp

Unrestricted file upload vulnerability in ScriptsFeed Realtor Classifieds System (aka Real Estate Classifieds) allows re

23RISK

open ↗

Referência✓ VexDay Proof

Discuz! 6.x/7.x - Remote Code Execution

CVE-2008-6958—webappsphp

wap/index.php in Crossday Discuz! Board 6.x and 7.x allows remote authenticated users to execute arbitrary PHP code via

23RISK

open ↗

Referência

WonderCMS 3.4.2 - Remote Code Execution (RCE)

CVE-2023-41425MEDIUMremotephp

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code

60RISK

open ↗

Referência✓ VexDay Proof

X7 Chat 2.0.5 - Authentication Bypass

CVE-2008-6964—webappsphp

SQL injection vulnerability in the login page in X7 Chat 2.0.5 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2023-4174

CVE-2023-4174LOW

mooSocial mooStore cross site scripting

43RISK

open ↗

Referência

CVE-2015-2080

CVE-2015-2080—

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive informat

60RISK

open ↗

Referência

CVE-2012-2156

CVE-2012-2156—

Multiple cross-site scripting (XSS) vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbi

23RISK

open ↗

Referência

CVE-2009-2276

CVE-2009-2276—

SQL injection vulnerability in voteforus.php in the Vote For Us extension 1.0.1 and earlier for PunBB allows remote atta

23RISK

open ↗

Referência

CVE-2004-2466

CVE-2004-2466—

chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username

60RISK

open ↗

Referência

CVE-2004-2466

CVE-2004-2466—

chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username

60RISK

open ↗

Referência✓ VexDay Proof

aspwebalbum 3.2 - Multiple Vulnerabilities

CVE-2008-6978—webappsasp

Unrestricted file upload vulnerability in Full Revolution aspWebAlbum 3.2 allows remote attackers to execute arbitrary c

23RISK

open ↗

Referência✓ VexDay Proof

XAMPP for Windows 1.6.0a - 'mssql_connect()' Remote Buffer Overflow

CVE-2007-2080—remotewindows

Multiple SQL injection vulnerabilities in XAMPP 1.6.0a for Windows allow remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

aspwebalbum 3.2 - Arbitrary File Upload / SQL Injection / Cross-Site Scripting

CVE-2008-6978—webappsphp

Unrestricted file upload vulnerability in Full Revolution aspWebAlbum 3.2 allows remote attackers to execute arbitrary c

23RISK

open ↗

Referência

CVE-2016-1542

CVE-2016-1542—

The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and U

60RISK

open ↗

Referência

CVE-2016-1542

CVE-2016-1542—

The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and U

60RISK

open ↗

Referência

CVE-2016-1542

CVE-2016-1542—

The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and U

60RISK

open ↗

Referência✓ VexDay Proof

Joomla! / Mambo Component New Article 1.1 - Remote File Inclusion

CVE-2007-2089—webappsphp

Multiple PHP remote file inclusion vulnerabilities in the Jx Development Article 1.1 and earlier component for Mambo and

23RISK

open ↗

Referência

CVE-2021-24762

CVE-2021-24762—

Perfect Survey < 1.5.2 - Unauthenticated SQL Injection

60RISK

open ↗

Referência✓ VexDay Proof

LogMeIn Remote Access Utility - ActiveX Memory Corruption (Denial of Service)

CVE-2008-7053—doswindows

LogMeIn Remote Access Utility ActiveX control (RACtrl.dll) allows remote attackers to cause a denial of service (crash)

23RISK

open ↗

Referência✓ VexDay Proof

EZContents CMS 2.0.3 - Multiple Local File Inclusions

CVE-2008-7055—webappsphp

module.php in ezContents 2.0.3 allows remote attackers to bypass the directory traversal protection mechanism to include

23RISK

open ↗

Referência✓ VexDay Proof

BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery

CVE-2008-7056—webappsphp

BandSite CMS 1.1.4 does not perform access control for adminpanel/phpmydump.php, which allows remote attackers to obtain

23RISK

open ↗

Referência✓ VexDay Proof

BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery

CVE-2008-7057—webappsphp

Cross-site scripting (XSS) vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbi

23RISK

open ↗

Referência

CVE-2018-1160

CVE-2018-1160CRITICAL

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking

70RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.