Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,620cataloged exploits

35,647CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,429GitHub PoC 14,270VulnCheck XDB 8,693Nuclei 4,299Metasploit 3,474✓ verified onlyrecent popular risk

24,455 exploits

Exploit-DB✓ VexDay Proof

AWStats 4.0/5.x/6.x - AWStats.pl Multiple Cross-Site Scripting Vulnerabilities

CVE-2006-1945—webappscgi19 Apr 2006

Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbi

23RISK

open ↗

Exploit-DB✓ VexDay Proof

xFlow 5.46.11 - 'index.cgi' Multiple SQL Injections

CVE-2006-1849—webappscgi19 Apr 2006

Multiple SQL injection vulnerabilities in members_only/index.cgi in xFlow 5.46.11 and earlier allow remote attackers to

23RISK

open ↗

Exploit-DB✓ VexDay Proof

otalCalendar - 'about.php?inc_dir' Remote File Inclusion

CVE-2006-1922—webappsphp19 Apr 2006

PHP remote file inclusion vulnerability in (1) about.php or (2) auth.php in TotalCalendar allows remote attackers to exe

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Visale 1.0 - 'pblscg.cgi?catsubno' Cross-Site Scripting

CVE-2006-1946—webappscgi19 Apr 2006

Multiple cross-site scripting (XSS) vulnerabilities in Visale 1.0 and earlier allow remote attackers to inject arbitrary

23RISK

open ↗

Exploit-DB✓ VexDay Proof

xFlow 5.46.11 - 'index.cgi' Multiple Cross-Site Scripting Vulnerabilities

CVE-2006-1850—webappscgi19 Apr 2006

Multiple cross-site scripting (XSS) vulnerabilities in xFlow 5.46.11 and earlier allow remote attackers to inject arbitr

23RISK

open ↗

Exploit-DB✓ VexDay Proof

IntelliLink Pro 5.06 - 'edit.cgi' Multiple Cross-Site Scripting Vulnerabilities

CVE-2006-1943—webappscgi19 Apr 2006

Multiple cross-site scripting (XSS) vulnerabilities in Smarter Scripts IntelliLink Pro 5.06 and earlier allow remote att

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Visale 1.0 - 'pblsmb.cgi?listno' Cross-Site Scripting

CVE-2006-1946—webappscgi19 Apr 2006

Multiple cross-site scripting (XSS) vulnerabilities in Visale 1.0 and earlier allow remote attackers to inject arbitrary

23RISK

open ↗

Exploit-DB✓ VexDay Proof

CommuniMail 1.2 - 'templates.cgi?form_id' Cross-Site Scripting

CVE-2006-1944—webappscgi19 Apr 2006

Multiple cross-site scripting (XSS) vulnerabilities in SibSoft CommuniMail 1.2 and earlier allow remote attackers to inj

23RISK

open ↗

Exploit-DB✓ VexDay Proof

BannerFarm 2.3 - Multiple Cross-Site Scripting Vulnerabilities

CVE-2006-1950—webappscgi19 Apr 2006

Multiple cross-site scripting (XSS) vulnerabilities in banners.cgi in PerlCoders BannerFarm 2.3 and earlier allow remote

23RISK

open ↗

Exploit-DB✓ VexDay Proof

ContentBoxx - 'login.php' Cross-Site Scripting

CVE-2006-1971—webappsphp19 Apr 2006

Cross-site scripting (XSS) vulnerability in login.php in KRANKIKOM ContentBoxX allows remote attackers to inject arbitra

23RISK

open ↗

Exploit-DB✓ VexDay Proof

ThWboard 2.8 - 'showtopic.php' SQL Injection

CVE-2006-1926—webappsphp19 Apr 2006

SQL injection vulnerability in showtopic.php in ThWboard 2.84 beta 3 and earlier allows remote attackers to execute arbi

23RISK

open ↗

Exploit-DB✓ VexDay Proof

IntelliLink Pro 5.06 - 'addlink_lwp.cgi?url' Cross-Site Scripting

CVE-2006-1943—webappscgi19 Apr 2006

Multiple cross-site scripting (XSS) vulnerabilities in Smarter Scripts IntelliLink Pro 5.06 and earlier allow remote att

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Plexum PlexCart X5 - Multiple SQL Injections

CVE-2006-1947—webappsphp19 Apr 2006

Multiple SQL injection vulnerabilities in plexum.php in NicPlex Plexum X5 and earlier allow remote attackers to execute

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Cisco Wireless Lan Solution Engine - ArchiveApplyDisplay.jsp Cross-Site Scripting

CVE-2006-1960—webappsjsp19 Apr 2006

Cross-site scripting (XSS) vulnerability in the appliance web user interface in Cisco CiscoWorks Wireless LAN Solution E

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Visale 1.0 - 'pbpgst.cgi?keyval' Cross-Site Scripting

CVE-2006-1946—webappscgi19 Apr 2006

Multiple cross-site scripting (XSS) vulnerabilities in Visale 1.0 and earlier allow remote attackers to inject arbitrary

23RISK

open ↗

Exploit-DB✓ VexDay Proof

ModernBill 4.3 - 'user.php' SQL Injection

CVE-2006-1853—webappsphp19 Apr 2006

Multiple SQL injection vulnerabilities in ModernBill 4.3.2 and earlier allow remote attackers or administrators to execu

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Article Publisher 1.0.1 Pro - Multiple SQL Injections

CVE-2006-1852—webappsphp19 Apr 2006

SQL injection vulnerability in category.php in Article Publisher Pro 1.0.1 and earlier allows remote attackers to execut

23RISK

open ↗

Exploit-DB✓ VexDay Proof

CutePHP CuteNews 1.4.1 Editnews Module - Cross-Site Scripting

CVE-2006-1925—webappsphp19 Apr 2006

Directory traversal vulnerability in the editnews module (inc/editnews.mdu) in index.php in CuteNews 1.4.1 allows remote

23RISK

open ↗

Exploit-DB✓ VexDay Proof

CommuniMail 1.2 - 'mailadmin.cgi?list_id' Cross-Site Scripting

CVE-2006-1944—webappscgi19 Apr 2006

Multiple cross-site scripting (XSS) vulnerabilities in SibSoft CommuniMail 1.2 and earlier allow remote attackers to inj

23RISK

open ↗

Exploit-DB✓ VexDay Proof

PHPLister 0.4.1 - 'index.php' Cross-Site Scripting

CVE-2006-1906—webappsphp18 Apr 2006

Cross-site scripting (XSS) vulnerability in index.php in jjgan852 phpLister 0.4.1 allows remote attackers to inject arbi

23RISK

open ↗

Exploit-DB✓ VexDay Proof

RechnungsZentrale 2 1.1.3 - 'Authent.php4' SQL Injection

CVE-2006-1954—webappsphp18 Apr 2006

SQL injection vulnerability in authent.php4 in Nicolas Fischer (aka NFec) RechnungsZentrale V2 1.1.3, and possibly earli

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Xine 0.9/1.0 - Playlist Handling Remote Format String

CVE-2006-1905—doslinux18 Apr 2006

Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.3 allow remote attackers to execute arbitrary

28RISK

open ↗

Exploit-DB✓ VexDay Proof

PHPLinks 2.1.2/2.1.3 - 'index.php' Cross-Site Scripting

CVE-2006-1825—webappsphp18 Apr 2006

Cross-site scripting (XSS) vulnerability in index.php in phpLinks 2.1.3.1 and earlier allows remote attackers to inject

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Calendarix 0.7 - 'YearCal.php' Cross-Site Scripting

CVE-2006-1835—webappsphp17 Apr 2006

Cross-site scripting (XSS) vulnerability in yearcal.php in Calendarix allows remote attackers to inject arbitrary web sc

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Jax Guestbook 3.50 - 'Page' Cross-Site Scripting

CVE-2006-1913—webappsphp17 Apr 2006

Cross-site scripting (XSS) vulnerability in jax_guestbook.php in Jax Guestbook 3.1, 3.31, and 3.50 allows remote attacke

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Monster Top List 1.4 - 'functions.php' Remote File Inclusion

CVE-2006-1781—webappsphp17 Apr 2006

PHP remote file inclusion vulnerability in functions.php in Circle R Monster Top List (MTL) 1.4 allows remote attackers

23RISK

open ↗

Exploit-DB✓ VexDay Proof

MyBB 1.1 - Global Variable Overwrite

CVE-2006-1912—webappsphp17 Apr 2006

MyBB (MyBulletinBoard) 1.1.0 does not set the constant KILL_GLOBAL variable in (1) global.php and (2) inc/init.php, whic

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Coppermine 1.4.4 - 'index.php' Local File Inclusion

CVE-2006-1909—webappsphp17 Apr 2006

Directory traversal vulnerability in index.php in Coppermine 1.4.4 allows remote attackers to read arbitrary files via a

23RISK

open ↗

Exploit-DB✓ VexDay Proof

DbbS 2.0 - Multiple Input Validation Vulnerabilities

CVE-2006-1916—webappsphp17 Apr 2006

Multiple cross-site scripting (XSS) vulnerabilities in profile.php in DbbS 2.0-alpha and earlier allow remote attackers

23RISK

open ↗

Exploit-DB✓ VexDay Proof

PHPFaber TopSites - 'index.php' Cross-Site Scripting

CVE-2006-1878—webappsphp17 Apr 2006

Cross-site scripting (XSS) vulnerability in index.php in phpFaber TopSites allows remote attackers to inject arbitrary w

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.