Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,449cataloged exploits

35,552CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,367GitHub PoC 14,225VulnCheck XDB 8,649Nuclei 4,283Metasploit 3,474✓ verified onlyrecent popular risk

24,451 exploits

Exploit-DB✓ VexDay Proof

Property Pro 1.0 - 'vir_Login.asp' Remote Authentication Bypass

CVE-2006-6029—webappsasp13 Nov 2006

SQL injection vulnerability in vir_Login.asp in Property Pro 1.0 allows remote attackers to execute arbitrary SQL comman

23RISK

Exploit-DB✓ VexDay Proof

INFINICART - 'search.asp?search' Cross-Site Scripting

CVE-2006-5958—webappsasp13 Nov 2006

Multiple cross-site scripting (XSS) vulnerabilities in INFINICART allow remote attackers to inject arbitrary web script

23RISK

Exploit-DB✓ VexDay Proof

IBM Websphere 6.0 - 'Faultactor' Cross-Site Scripting

CVE-2006-2431—remotemultiple13 Nov 2006

Cross-site scripting (XSS) vulnerability in the 500 Internal Server Error page on the SOAP port (8880/tcp) in IBM WebSph

23RISK

Exploit-DB✓ VexDay Proof

HP Tru64 4.0/5.1 - POSIX Threads Library Privilege Escalation

CVE-2006-7235—localhp-ux13 Nov 2006

Teamtek Universal FTP Server 1.0.50 allows remote attackers to cause a denial of service (daemon crash or hang) via (1)

23RISK

Exploit-DB✓ VexDay Proof

INFINICART - 'login.asp' Multiple Cross-Site Scripting Vulnerabilities

CVE-2006-5958—webappsasp13 Nov 2006

Multiple cross-site scripting (XSS) vulnerabilities in INFINICART allow remote attackers to inject arbitrary web script

23RISK

Exploit-DB✓ VexDay Proof

INFINICART - 'added_to_cart.asp?ProductID' SQL Injection

CVE-2006-5957—webappsasp13 Nov 2006

Multiple SQL injection vulnerabilities in INFINICART allow remote attackers to execute arbitrary SQL commands via the (1

23RISK

Exploit-DB✓ VexDay Proof

DirectAdmin 1.28/1.29 - 'CMD_FTP_SHOW' Cross-Site Scripting

CVE-2006-5983—webappsphp12 Nov 2006

Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users

23RISK

Exploit-DB✓ VexDay Proof

DirectAdmin 1.28/1.29 - 'CMD_EMAIL_LIST' Cross-Site Scripting

CVE-2006-5983—webappsphp12 Nov 2006

Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users

23RISK

Exploit-DB✓ VexDay Proof

DirectAdmin 1.28/1.29 - 'CMD_TICKET_CREATE' Cross-Site Scripting

CVE-2006-5983—webappsphp12 Nov 2006

Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users

23RISK

Exploit-DB✓ VexDay Proof

DirectAdmin 1.28/1.29 - 'CMD_TICKET' Cross-Site Scripting

CVE-2006-5983—webappsphp12 Nov 2006

Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users

23RISK

Exploit-DB✓ VexDay Proof

DirectAdmin 1.28/1.29 - 'CMD_SHOW_USER' Cross-Site Scripting

CVE-2006-5983—webappsphp12 Nov 2006

Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users

23RISK

Exploit-DB✓ VexDay Proof

DirectAdmin 1.28/1.29 - 'CMD_SHOW_RESELLER' Cross-Site Scripting

CVE-2006-5983—webappsphp12 Nov 2006

Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users

23RISK

Exploit-DB✓ VexDay Proof

DirectAdmin 1.28/1.29 - 'CMD_EMAIL_VACATION_MODIFY' Cross-Site Scripting

CVE-2006-5983—webappsphp12 Nov 2006

Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users

23RISK

Exploit-DB✓ VexDay Proof

DirectAdmin 1.28/1.29 - 'CMD_EMAIL_FORWARDER_MODIFY' Cross-Site Scripting

CVE-2006-5983—webappsphp12 Nov 2006

Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users

23RISK

Exploit-DB✓ VexDay Proof

PHPdebug 1.1 - 'Debug_test.php' Remote File Inclusion

CVE-2006-6581—webappsphp12 Nov 2006

PHP remote file inclusion vulnerability in tests/debug_test.php in Vernet Loic PHP_Debug 1.1.0 allows remote attackers t

23RISK

Exploit-DB✓ VexDay Proof

ExoPHPDesk 1.2 - 'Pipe.php' Remote File Inclusion

CVE-2006-5951—webappsphp11 Nov 2006

PHP remote file inclusion vulnerability in pipe.php in Exophpdesk 1.2 allows remote attackers to execute arbitrary PHP c

23RISK

Exploit-DB✓ VexDay Proof

Bitweaver 1.x - '/fisheye/index.php?sort_mode' SQL Injection

CVE-2006-6924—webappsphp10 Nov 2006

bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to

23RISK

Exploit-DB✓ VexDay Proof

Bitweaver 1.x - '/wiki/list_pages.php?sort_mode' SQL Injection

CVE-2006-6924—webappsphp10 Nov 2006

bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to

23RISK

Exploit-DB✓ VexDay Proof

Bitweaver 1.x - '/wiki/orphan_pages.php?sort_mode' SQL Injection

CVE-2006-6924—webappsphp10 Nov 2006

bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to

23RISK

Exploit-DB✓ VexDay Proof

Microsoft Internet Explorer 6/7 - XML Core Services Remote Code Execution (2)

CVE-2006-5745—remotewindows10 Nov 2006

Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML

60RISK

Exploit-DB✓ VexDay Proof

Bitweaver 1.x - '/blogs/list_blogs.php?sort_mode' SQL Injection

CVE-2006-6924—webappsphp10 Nov 2006

bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to

23RISK

Exploit-DB✓ VexDay Proof

Microsoft Internet Explorer 6/7 - XML Core Services Remote Code Execution (3)

CVE-2006-5745—remotewindows10 Nov 2006

Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML

60RISK

Exploit-DB✓ VexDay Proof

Bitweaver 1.x - '/fisheye/list_galleries.php?sort_mode' SQL Injection

CVE-2006-6925—webappsphp10 Nov 2006

Multiple cross-site scripting (XSS) vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbi

23RISK

Exploit-DB✓ VexDay Proof

Apple Mac OSX 10.x - FPathConf System Call Local Denial of Service

CVE-2006-5836—dososx09 Nov 2006

The fpathconf syscall function in bsd/kern/kern_descrip.c in the Darwin kernel (XNU) 8.8.1 in Apple Mac OS X allows loca

23RISK

Exploit-DB✓ VexDay Proof

LandShop 0.6.3 - 'ls.php' Multiple SQL Injections

CVE-2006-5914—webappsphp09 Nov 2006

SQL injection vulnerability in ls.php in SAMEDIA LandShop allows remote attackers to execute arbitrary SQL commands via

23RISK

Exploit-DB✓ VexDay Proof

bitweaver 1.x - '/newsletters/edition.php?tk' SQL Injection

CVE-2006-6923—webappsphp09 Nov 2006

SQL injection vulnerability in newsletters/edition.php in bitweaver 1.3.1 and earlier allows remote attackers to execute

23RISK

Exploit-DB✓ VexDay Proof

LandShop 0.6.3 - 'ls.php' Multiple Cross-Site Scripting Vulnerabilities

CVE-2006-5915—webappsphp09 Nov 2006

Multiple cross-site scripting (XSS) vulnerabilities in ls.php in SAMEDIA LandShop allow remote attackers to inject arbit

23RISK

Exploit-DB✓ VexDay Proof

LetterIt 2.0 - 'session.php' Remote File Inclusion

CVE-2006-5863—webappsphp09 Nov 2006

PHP remote file inclusion vulnerability in inc/session.php for LetterIt 2 allows remote attackers to execute arbitrary P

23RISK

Exploit-DB✓ VexDay Proof

Immediacy .NET CMS 5.2 - 'Logon.aspx' Cross-Site Scripting

CVE-2006-5853—webappsasp08 Nov 2006

Cross-site scripting (XSS) vulnerability in logon.aspx in Immediacy CMS (Immediacy .NET CMS) 5.2 allows remote attackers

23RISK

Exploit-DB✓ VexDay Proof

FreeWebShop 2.1/2.2 - 'index.php?cat' Cross-Site Scripting

CVE-2006-5847—webappsphp08 Nov 2006

Cross-site scripting (XSS) vulnerability in index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to inject

23RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.