Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,772cataloged exploits

35,760CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,523GitHub PoC 14,289VulnCheck XDB 8,710Nuclei 4,319Metasploit 3,476✓ verified onlyrecent popular risk

24,455 exploits

Exploit-DB✓ VexDay Proof

Cyphor 0.19 - 'lostpwd.php?nick' SQL Injection

CVE-2005-3236—webappsphp08 Oct 2005

Multiple SQL injection vulnerabilities in Cyphor 0.19 allow remote attackers to execute arbitrary SQL and obtain adminis

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Cyphor 0.19 - Board Takeover (SQL Injection)

CVE-2005-3575—webappsphp08 Oct 2005

SQL injection vulnerability in show.php in Cyphor 0.19 and earlier allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Cyphor 0.19 - 'newmsg.php?fid' SQL Injection

CVE-2005-3236—webappsphp08 Oct 2005

Multiple SQL injection vulnerabilities in Cyphor 0.19 allow remote attackers to execute arbitrary SQL and obtain adminis

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Cyphor 0.19 - 'footer.php?t_login' Cross-Site Scripting

CVE-2005-3237—webappsphp08 Oct 2005

Cross-site scripting (XSS) vulnerability in Cyphor 0.19 allows remote attackers to inject arbitrary web script or HTML v

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Oracle 9 - XML DB Cross-Site Scripting

CVE-2005-3204—remotemultiple07 Oct 2005

Cross-site scripting (XSS) vulnerability in Oracle XML DB 9iR2 allows remote attackers to inject arbitrary web script or

28RISK

open ↗

Exploit-DB✓ VexDay Proof

Oracle HTML DB 1.5/1.6 - 'wwv_flow.accept?p_t02' Cross-Site Scripting

CVE-2005-3202—remotemultiple07 Oct 2005

Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTML DB (HTMLDB) 1.3 through 1.3.6 allow remote attackers

28RISK

open ↗

Exploit-DB✓ VexDay Proof

Aenovo - '/incs/searchdisplay.asp?strSQL' SQL Injection

CVE-2005-3208—webappsasp07 Oct 2005

Multiple SQL injection vulnerabilities in (1) aeNovo, (2) aeNovoShop and (3) aeNovoWYSI allow remote attackers to execut

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Aenovo - '/Password/default.asp?Password' SQL Injection

CVE-2005-3208—webappsasp07 Oct 2005

Multiple SQL injection vulnerabilities in (1) aeNovo, (2) aeNovoShop and (3) aeNovoWYSI allow remote attackers to execut

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Utopia News Pro 1.1.3 - 'footer.php' Multiple Cross-Site Scripting Vulnerabilities

CVE-2005-3200—webappsphp07 Oct 2005

Multiple cross-site scripting (XSS) vulnerabilities in Utopia News Pro (UNP) 1.1.3 and 1.1.4 allow remote attackers to i

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Oracle Forms - Servlet TLS Listener Remote Denial of Service

CVE-2005-3207—dosmultiple07 Oct 2005

The forms servlet (f90servlet) in Oracle Forms 4.5.10.22 allows remote attackers to cause a denial of service (TNS liste

28RISK

open ↗

Exploit-DB✓ VexDay Proof

Oracle HTML DB 1.5/1.6 - 'f?p=' Cross-Site Scripting

CVE-2005-3202—remotemultiple07 Oct 2005

Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTML DB (HTMLDB) 1.3 through 1.3.6 allow remote attackers

28RISK

open ↗

Exploit-DB✓ VexDay Proof

Utopia News Pro 1.1.3 - 'header.php?sitetitle' Cross-Site Scripting

CVE-2005-3200—webappsphp07 Oct 2005

Multiple cross-site scripting (XSS) vulnerabilities in Utopia News Pro (UNP) 1.1.3 and 1.1.4 allow remote attackers to i

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Oracle 9.0 iSQL*Plus - TLS Listener Remote Denial of Service

CVE-2005-3206—dosmultiple07 Oct 2005

iSQL*Plus (isqlplus) for Oracle9i Database Server Release 2 9.0.2.4 allows remote attackers to cause a denial of service

28RISK

open ↗

Exploit-DB✓ VexDay Proof

Utopia News Pro 1.1.3 - 'news.php' SQL Injection

CVE-2005-3201—webappsphp06 Oct 2005

SQL injection vulnerability in news.php for Utopia News Pro (UNP) 1.1.3, when magic_quotes_gpc is disabled and register_

23RISK

open ↗

Exploit-DB✓ VexDay Proof

TellMe 1.2 - Multiple Cross-Site Scripting Vulnerabilities

CVE-2005-4698—webappsphp05 Oct 2005

Cross-site scripting (XSS) vulnerability in TellMe 1.2 and earlier allows remote attackers to inject arbitrary web scrip

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Mozilla Firefox 1.0.6/1.0.7 - iFrame Handling Denial of Service

CVE-2005-4720—dosmultiple05 Oct 2005

Mozilla Firefox 1.0.7 and earlier on Linux allows remote attackers to cause a denial of service (client crash) via an IF

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Microsoft Windows XP - Wireless Zero Configuration Service Information Disclosure

CVE-2005-4696—localwindows04 Oct 2005

The Microsoft Wireless Zero Configuration system (WZCS) stores WEP keys and pair-wise Master Keys (PMK) of the WPA pre-s

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Gnome-PTY-Helper UTMP - Hostname Spoofing

CVE-2005-0023—locallinux03 Oct 2005

gnome-pty-helper in GNOME libzvt2 and libvte4 allows local users to spoof the logon hostname via a modified DISPLAY envi

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Prozilla 1.3.7.4 - 'ftpsearch' Results Handling Buffer Overflow

CVE-2005-2961—remotelinux02 Oct 2005

Buffer overflow in the get_string_ahref function for ProZilla 1.3.7.4 and possibly earlier, with the -ftpsearch option e

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Virtools Web Player 3.0.0.100 - Buffer Overflow (Denial of Service) (PoC)

CVE-2005-3135—doswindows02 Oct 2005

Buffer overflow in Virtools Web Player 3.0.0.100 and earlier allows remote attackers to execute arbitrary code via a lon

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Merak Mail Server 8.2.4 r - Arbitrary File Deletion

CVE-2005-3133—webappsphp30 Sep 2005

Multiple directory traversal vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earli

23RISK

open ↗

Exploit-DB✓ VexDay Proof

IceWarp Web Mail 5.5.1 - 'blank.html?id' Cross-Site Scripting

CVE-2005-3131—webappsphp30 Sep 2005

Multiple cross-site scripting (XSS) vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibl

23RISK

open ↗

Exploit-DB✓ VexDay Proof

IceWarp Web Mail 5.5.1 - 'calendar_d.html?createdataCX' Cross-Site Scripting

CVE-2005-3131—webappsphp30 Sep 2005

Multiple cross-site scripting (XSS) vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibl

23RISK

open ↗

Exploit-DB✓ VexDay Proof

IceWarp Web Mail 5.5.1 - 'calendar_m.html?createdataCX' Cross-Site Scripting

CVE-2005-3131—webappsphp30 Sep 2005

Multiple cross-site scripting (XSS) vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibl

23RISK

open ↗

Exploit-DB✓ VexDay Proof

IceWarp Web Mail 5.5.1 - 'calendar_w.html?createdataCX' Cross-Site Scripting

CVE-2005-3131—webappsphp30 Sep 2005

Multiple cross-site scripting (XSS) vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibl

23RISK

open ↗

Exploit-DB✓ VexDay Proof

LucidCMS 2.0 - Login SQL Injection

CVE-2005-3130—webappsphp29 Sep 2005

SQL injection vulnerability in lucidCMS 1.0.11 allows remote attackers to execute arbitrary SQL commands via the login f

23RISK

open ↗

Exploit-DB✓ VexDay Proof

SquirrelMail 1.4.2 Address Add Plugin - 'add.php' Cross-Site Scripting

CVE-2005-3128—webappsphp29 Sep 2005

Cross-site scripting (XSS) vulnerability in add.php in Address Add Plugin 1.9 and 2.0 for Squirrelmail allows remote att

38RISK

open ↗

Exploit-DB✓ VexDay Proof

TWiki TWikiUsers - INCLUDE Function Arbitrary Command Execution

CVE-2005-2877—webappsphp28 Sep 2005

The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary co

60RISK

open ↗

Exploit-DB✓ VexDay Proof

PHP-Fusion 6.00.109 - 'msg_send' SQL Injection

CVE-2005-3157—webappsphp28 Sep 2005

SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Exploit-DB✓ VexDay Proof

CubeCart 3.0.3 - 'cart.php?redir' Cross-Site Scripting

CVE-2005-3152—webappsphp28 Sep 2005

Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.3 allow remote attackers to inject arbitrary web scr

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.