Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,107cataloged exploits
36,322CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,464Referência 22,936GitHub PoC 15,010VulnCheck XDB 8,846Nuclei 4,361Metasploit 3,490✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
TinyFTPD 1.4 - 'USER' Remote Buffer Overflow (Denial of Service) (PoC)
CVE-2006-7007—doswindows
Buffer overflow in Tiny FTPd 1.4 and earlier allows remote attackers to cause a denial of service (daemon crash) via a l
23RISK
open ↗
Referência✓ VexDay Proof
HispaH Model Search - 'cat.php?cat' SQL Injection
CVE-2008-2537—webappsphp
SQL injection vulnerability in cat.php in HispaH Model Search allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Battle Blog 1.25 - 'uploadform.asp' Arbitrary File Upload
CVE-2009-1609—webappsphp
Unrestricted file upload vulnerability in admin/uploadform.asp in Battle Blog 1.25 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
XCMS 1.82 - Local/Remote File Inclusion
CVE-2007-6604—webappsphp
Multiple directory traversal vulnerabilities in index.php in XCMS 1.82 and earlier allow remote attackers to read arbitr
23RISK
open ↗
Referência✓ VexDay Proof
427bb 2.3.1 - SQL Injection / Cross-Site Scripting
CVE-2008-2560—webappsphp
SQL injection vulnerability in showpost.php in 427BB 2.3.1 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
GeBlog 0.1 (Windows) - GLOBALS[tplname] Local File Inclusion
CVE-2007-1577—webappsphp
Directory traversal vulnerability in index.php in GeBlog 0.1 allows remote attackers to include and execute arbitrary lo
23RISK
open ↗
Referência✓ VexDay Proof
PostNuke pnFlashGames Module 1.5 - SQL Injection
CVE-2007-2427—webappsphp
SQL injection vulnerability in index.php in the pnFlashGames 1.5 module for PostNuke allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
YouTube blog 0.1 - Remote File Inclusion / SQL Injection / Cross-Site Scripting
CVE-2008-3305—webappsphp
Cross-site scripting (XSS) vulnerability in mensaje.php in C. Desseno YouTube Blog (ytb) 0.1 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Libc - 'libc:fts_*()' Local Denial of Service
CVE-2009-0537—dosbsd
Integer overflow in the fts_build function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0
23RISK
open ↗
Referência✓ VexDay Proof
TLM CMS 3.2 - Multiple SQL Injections
CVE-2007-4808—webappsphp
Multiple SQL injection vulnerabilities in TLM CMS 3.2 allow remote attackers to execute arbitrary SQL commands via (1) t
23RISK
open ↗
Referência✓ VexDay Proof
FrontAccounting 1.13 - Remote File Inclusion
CVE-2007-5117—webappsphp
Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.13, when register_globals is enabled, allow
23RISK
open ↗
Referência✓ VexDay Proof
Creator CMS 5.0 - 'sideid' SQL Injection
CVE-2008-7001—webappsasp
Unrestricted file upload vulnerability in the file manager in Creative Mind Creator CMS 5.0 allows remote attackers to e
23RISK
open ↗
Referência✓ VexDay Proof
MailBee Objects 5.5 - 'MailBee.dll' Remote Insecure Method
CVE-2008-0631—remotewindows
Multiple ActiveX controls in MailBee.dll in MailBee Objects 5.5 allow remote attackers to (1) overwrite arbitrary files
23RISK
open ↗
Referência✓ VexDay Proof
cattaDoc 2.21 - 'download2.php?fn1' Remote File Disclosure
CVE-2007-1930—webappsphp
Directory traversal vulnerability in download2.php in cattaDoc 2.21, and possibly other versions including 3.0, allows r
23RISK
open ↗
Referência✓ VexDay Proof
ErfurtWiki R1.02b - Local File Inclusion
CVE-2008-2672—webappsphp
Multiple directory traversal vulnerabilities in ErfurtWiki R1.02b and earlier, when register_globals is enabled, allow r
23RISK
open ↗
Referência✓ VexDay Proof
FireConfig 0.5 - 'dl.php' Remote File Disclosure
CVE-2007-5782—webappsphp
Directory traversal vulnerability in dl.php in FireConfig 0.5 allows remote attackers to read arbitrary files via a .. (
23RISK
open ↗
Referência✓ VexDay Proof
ZeeBuddy 2.1 - 'adid' SQL Injection
CVE-2008-3604—webappsphp
SQL injection vulnerability in bannerclick.php in ZeeBuddy 2.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
EZContents 1.4.5 - 'index.php?link' Remote File Disclosure
CVE-2007-6368—webappsphp
Directory traversal vulnerability in index.php in ezContents 1.4.5 allows remote attackers to read arbitrary files via a
23RISK
open ↗
Referência✓ VexDay Proof
UploadImage/UploadScript 1.0 - Remote Change Admin Password
CVE-2008-0246—webappsphp
admin.php in UploadScript 1.0 does not check for the original password before making a change to a new password, which a
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component acctexp 0.12.x - Blind SQL Injection
CVE-2008-2632—webappsphp
SQL injection vulnerability in the acctexp (com_acctexp) component 0.12.x and earlier for Joomla! allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
Pre News Manager 1.0 - 'id' SQL Injection
CVE-2006-2763—webappsphp
SQL injection vulnerability in Pre News Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the (1
23RISK
open ↗
Referência✓ VexDay Proof
SAPID 1.2.3.05 - 'ROOT_PATH' Remote File Inclusion
CVE-2006-4026—webappsphp
PHP remote file inclusion vulnerability in SAPID CMS 123 rc3 allows remote attackers to execute arbitrary PHP code via a
23RISK
open ↗
Referência✓ VexDay Proof
phpCMS 1.2.2 - 'file' Remote File Disclosure
CVE-2008-0513—webappsphp
Directory traversal vulnerability in parser/include/class.cache_phpcms.php in phpCMS 1.2.2 allows remote attackers to re
23RISK
open ↗
Referência✓ VexDay Proof
mebiblio 0.4.7 - SQL Injection / Arbitrary File Upload / Cross-Site Scripting
CVE-2008-2646—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in meBiblio 0.4.7 allow remote attackers to inject arbitrary web scr
23RISK
open ↗
Referência✓ VexDay Proof
Megabbs Forum 2.2 - SQL Injection / Cross-Site Scripting
CVE-2008-2022—webappsasp
Mulatiple cross-site scripting (XSS) vulnerabilities in PD9 Software MegaBBS 2.2 allow remote attackers to inject arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Minerva 2.0.21 build 238a - 'phpbb_root_path' File Inclusion
CVE-2006-5077—webappsphp
PHP remote file inclusion vulnerability in admin/admin_topic_action_logging.php in Chris Smith Minerva Build 238 and ear
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component JooBB 0.5.9 - Blind SQL Injection
CVE-2008-2651—webappsphp
SQL injection vulnerability in the Joomla! Bulletin Board (aka Joo!BB or com_joobb) component 0.5.9 for Joomla! allows r
23RISK
open ↗
Referência✓ VexDay Proof
LightNEasy sqlite / no database 1.2.2 - Multiple Vulnerabilities
CVE-2008-6593—webappsphp
SQL injection vulnerability in LightNEasy/lightneasy.php in LightNEasy SQLite 1.2.2 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
MemHT Portal 4.0.1 - Remote Code Execution
CVE-2009-0372—webappsphp
Unrestricted file upload vulnerability in index.php in Miltenovik Manojlo MemHT Portal 4.0.1 and earlier allows remote a
23RISK
open ↗
Referência✓ VexDay Proof
Company WebSite Builder PRO 1.9.8 - 'INCLUDE_PATH' Remote File Inclusion
CVE-2007-1513—webappsphp
PHP remote file inclusion vulnerability in comanda.php in GraFX Company WebSite Builder (CWB) PRO 1.9.8, when register_g
23RISK
open ↗
← previouspage 65 / 188next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.