Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,772cataloged exploits

35,760CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,523GitHub PoC 14,289VulnCheck XDB 8,710Nuclei 4,319Metasploit 3,476✓ verified onlyrecent popular risk

24,455 exploits

Exploit-DB✓ VexDay Proof

TWiki TWikiUsers - INCLUDE Function Arbitrary Command Execution

CVE-2005-2877—webappsphp28 Sep 2005

The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary co

60RISK

open ↗

Exploit-DB✓ VexDay Proof

LucidCMS 2.0 - 'index.php' Cross-Site Scripting

CVE-2005-3127—webappsphp27 Sep 2005

Cross-site scripting (XSS) vulnerability in index.php in lucidCMS 1.0.11 allows remote attackers to inject arbitrary web

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Novell Groupwise Client 6.5.3 - Local Integer Overflow

CVE-2005-2804—doswindows27 Sep 2005

Integer overflow in the registry parsing code in GroupWise 6.5.3, and possibly earlier version, allows remote attackers

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Barracuda Spam Firewall < 3.1.18 - Command Execution (Metasploit)

CVE-2005-2848—webappscgi27 Sep 2005

Directory traversal vulnerability in img.pl in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Barracuda Spam Firewall < 3.1.18 - Command Execution (Metasploit)

CVE-2005-2847—webappscgi27 Sep 2005

img.pl in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to execute arbitrary comman

50RISK

open ↗

Exploit-DB✓ VexDay Proof

MultiTheftAuto 0.5 patch 1 - Server Crash / MOTD Deletion

CVE-2005-3064—doswindows26 Sep 2005

MultiTheftAuto 0.5 patch 1 and earlier does not properly verify client privileges when running command 40, which allows

23RISK

open ↗

Exploit-DB✓ VexDay Proof

GNU Mailutils imap4d 0.6 (FreeBSD) - 'Search' Remote Format String

CVE-2005-2878—remotebsd26 Sep 2005

Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to e

28RISK

open ↗

Exploit-DB✓ VexDay Proof

RealPlayer/Helix Player (Linux) - Remote Format String

CVE-2005-2710—remotelinux26 Sep 2005

Format string vulnerability in Real HelixPlayer and RealPlayer 10 allows remote attackers to execute arbitrary code via

28RISK

open ↗

Exploit-DB✓ VexDay Proof

CMS Made Simple 0.10 - 'index.php' Cross-Site Scripting

CVE-2005-3083—webappsphp26 Sep 2005

Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 0.10 allows remote attackers to inject arbitrar

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Qpopper 4.0.8 (FreeBSD) - Local Privilege Escalation

CVE-2005-3098—localbsd24 Sep 2005

poppassd in Qualcomm qpopper 4.0.8 allows local users to modify arbitrary files and gain privileges via the -t (trace fi

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Qpopper 4.0.8 (Linux) - 'poppassd' Local Privilege Escalation

CVE-2005-3098—locallinux24 Sep 2005

poppassd in Qualcomm qpopper 4.0.8 allows local users to modify arbitrary files and gain privileges via the -t (trace fi

23RISK

open ↗

Exploit-DB✓ VexDay Proof

MailGust 1.9 - Board Takeover (SQL Injection)

CVE-2005-3063—webappsphp24 Sep 2005

SQL injection vulnerability in MailGust 1.9 allows remote attackers to execute arbitrary SQL commands via the email fiel

23RISK

open ↗

Exploit-DB✓ VexDay Proof

WzdFTPD 0.5.4 - Remote Command Execution

CVE-2005-3081—remotelinux24 Sep 2005

wzdftpd 0.5.4 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the SITE comma

45RISK

open ↗

Exploit-DB✓ VexDay Proof

Nokia Symbian 60 - 'BlueTooth Nickname' Remote Restart (2)

CVE-2005-0681—doshardware23 Sep 2005

Nokia Symbian 60 allows remote attackers to cause a denial of service (phone restart) via a Bluetooth nickname.

23RISK

open ↗

Exploit-DB✓ VexDay Proof

phpMyFAQ 1.5.1 - 'User-Agent' Remote Shell Injection

CVE-2005-3048—webappsphp23 Sep 2005

Directory traversal vulnerability in index.php in PhpMyFaq 1.5.1 allows remote attackers to read arbitrary files or incl

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Mozilla Browsers - 0xAD (HOST:) Remote Heap Buffer Overrun (2)

CVE-2005-2871—remotewindows22 Sep 2005

Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.

28RISK

open ↗

Exploit-DB✓ VexDay Proof

My Little Forum 1.5 - 'SearchString' SQL Injection

CVE-2005-3045—webappsphp22 Sep 2005

SQL injection vulnerability in search.php in My Little Forum 1.5 and 1.6 beta allows remote attackers to execute arbitra

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Mercury/32 Mail Server 4.01a (Pegasus) - IMAP Buffer Overflow

CVE-2007-1373—remotewindows20 Sep 2005

Stack-based buffer overflow in Mercury/32 (aka Mercury Mail Transport System) 4.01b and earlier allows remote attackers

50RISK

open ↗

Exploit-DB✓ VexDay Proof

Hesk 0.92/0.93 - Session ID Authentication Bypass

CVE-2005-3005—webappsphp20 Sep 2005

Helpdesk Software Hesk allows remote attackers to bypass authentication for (1) admin.php and (2) admin_main.php by modi

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Mercury/32 Mail Server 4.01a (Pegasus) - IMAP Buffer Overflow

CVE-2006-5961—remotewindows20 Sep 2005

Buffer overflow in Mercury Mail Transport System 4.01b for Windows has unknown impact and attack vectors, as originally

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Mozilla Browser/Firefox - Arbitrary Command Execution

CVE-2005-2968—remotelinux20 Sep 2005

Firefox 1.0.6 and Mozilla 1.7.10 allows attackers to execute arbitrary commands via shell metacharacters in a URL that i

28RISK

open ↗

Exploit-DB✓ VexDay Proof

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/usertitle.php?usertitleid' SQL Injection

CVE-2005-3019—webappsphp19 Sep 2005

Multiple SQL injection vulnerabilities in vBulletin before 3.0.9 allow remote attackers to execute arbitrary SQL command

23RISK

open ↗

Exploit-DB✓ VexDay Proof

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/index.php' Multiple Cross-Site Scripting Vulnerabilities

CVE-2005-3020—webappsphp19 Sep 2005

Multiple cross-site scripting (XSS) vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary

23RISK

open ↗

Exploit-DB✓ VexDay Proof

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/user.php?email' Cross-Site Scripting

CVE-2005-3020—webappsphp19 Sep 2005

Multiple cross-site scripting (XSS) vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary

23RISK

open ↗

Exploit-DB✓ VexDay Proof

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/modlog.php?orderby' Cross-Site Scripting

CVE-2005-3020—webappsphp19 Sep 2005

Multiple cross-site scripting (XSS) vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary

23RISK

open ↗

Exploit-DB✓ VexDay Proof

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/language.php?goto' Cross-Site Scripting

CVE-2005-3020—webappsphp19 Sep 2005

Multiple cross-site scripting (XSS) vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary

23RISK

open ↗

Exploit-DB✓ VexDay Proof

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/usertools.php?ids' SQL Injection

CVE-2005-3019—webappsphp19 Sep 2005

Multiple SQL injection vulnerabilities in vBulletin before 3.0.9 allow remote attackers to execute arbitrary SQL command

23RISK

open ↗

Exploit-DB✓ VexDay Proof

vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/css.php?group' Cross-Site Scripting

CVE-2005-3020—webappsphp19 Sep 2005

Multiple cross-site scripting (XSS) vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary

23RISK

open ↗

Exploit-DB✓ VexDay Proof

MCCS (Multi-Computer Control Systems) Command - Denial of Service

CVE-2005-3002—doswindows19 Sep 2005

Multi-Computer Control System (MCCS) 1.0 allows remote attackers to cause a denial of service via a malformed UDP packet

23RISK

open ↗

Exploit-DB✓ VexDay Proof

EPay Pro 2.0 - 'index.php' Directory Traversal

CVE-2005-3026—webappsphp19 Sep 2005

Directory traversal vulnerability in index.php in Alstrasoft Epay Pro 2.0 and earlier allows remote attackers to read ar

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.