Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,107cataloged exploits

36,322CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,464Referência 22,936GitHub PoC 15,010VulnCheck XDB 8,846Nuclei 4,361Metasploit 3,490✓ verified onlyrecent popular risk

5,629 exploits

Referência✓ VexDay Proof

Weblosninger 4 - Cross-Site Scripting / SQL Injection

CVE-2008-2505—webappsphp

Cross-site scripting (XSS) vulnerability in result.php in Simpel Side Weblosning 1 through 4 allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

OwnRS blog beta3 - SQL Injection / Cross-Site Scripting

CVE-2008-2855—webappsphp

Cross-site scripting (XSS) vulnerability in clanek.php in OwnRS Beta 3 allows remote attackers to inject arbitrary web s

23RISK

open ↗

Referência✓ VexDay Proof

Pars4U Videosharing 1.0 - Cross-Site Scripting / Blind SQL Injection

CVE-2008-3771—webappsphp

Cross-site scripting (XSS) vulnerability in members.php in Pars4u Videosharing 1 allows remote attackers to inject arbit

23RISK

open ↗

Referência✓ VexDay Proof

PHP infoboard 7 plus - Multiple Vulnerabilities

CVE-2008-4333—webappsphp

Cross-site scripting (XSS) vulnerability in PHP infoBoard V.7 Plus allows remote attackers to inject arbitrary web scrip

23RISK

open ↗

Referência✓ VexDay Proof

QuestCMS - Cross-Site Scripting / Directory Traversal / SQL Injection

CVE-2008-4774—webappsphp

Cross-site scripting (XSS) vulnerability in main/main.php in QuestCMS allows remote attackers to inject arbitrary web sc

23RISK

open ↗

Referência✓ VexDay Proof

OTManager CMS 24a - Local File Inclusion / Cross-Site Scripting

CVE-2008-5202—webappsphp

Cross-site scripting (XSS) vulnerability in index.php in OTManager CMS 24a allows remote attackers to inject arbitrary w

23RISK

open ↗

Referência✓ VexDay Proof

CMS NetCat 3.12 - Multiple Vulnerabilities

CVE-2008-5729—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in AIST NetCat 3.12 and earlier allow remote attackers to inject arb

23RISK

open ↗

Referência✓ VexDay Proof

BabbleBoard 1.1.6 - Cross-Site Request Forgery/Cookie Grabber

CVE-2008-6906—webappsphp

Cross-site scripting (XSS) vulnerability in index.php in BabbleBoard 1.1.6 allows remote attackers to inject arbitrary w

23RISK

open ↗

Referência✓ VexDay Proof

chipmunk topsites - Authentication Bypass / Cross-Site Scripting

CVE-2008-7072—webappsphp

Cross-site scripting (XSS) vulnerability in index.php in Chipmunk Topsites allows remote attackers to inject arbitrary w

23RISK

open ↗

Referência✓ VexDay Proof

Lightweight news portal (LNP) 1.0b - Multiple Vulnerabilities

CVE-2008-7171—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in Lightweight news portal (LNP) 1.0b allow remote attackers to inje

23RISK

open ↗

Referência✓ VexDay Proof

THoRCMS 1.3.1 - 'phpbb_root_path' Remote File Inclusion

CVE-2006-3269—webappsphp

PHP remote file inclusion vulnerability in includes/functions_cms.php in THoRCMS 1.3.1 allows remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

Blackorpheus ClanMemberSkript 1.0 - SQL Injection

CVE-2006-1917—webappsphp

SQL injection vulnerability in member.php in Blackorpheus ClanMemberSkript 1.0 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Restaurante 1.0 - 'id' SQL Injection

CVE-2008-1465—webappsphp

SQL injection vulnerability in the Detodas Restaurante (com_restaurante) 1.0 component for Mambo and Joomla! allows remo

23RISK

open ↗

Referência✓ VexDay Proof

Alstrasoft e-Friends 4.98 - 'seid' Multiple SQL Injections

CVE-2007-6106—webappsphp

SQL injection vulnerability in index.php in AlstraSoft E-Friends 4.98 and earlier allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

mail2forum phpBB Mod 1.2 - 'm2f_root_path' Remote File Inclusion

CVE-2006-3735—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Mail2Forum (module for phpBB) 1.2 and earlier allow remote attacke

23RISK

open ↗

Referência✓ VexDay Proof

blogme 3.0 - Cross-Site Scripting / Authentication Bypass

CVE-2006-5976—webappsasp

Multiple SQL injection vulnerabilities in admin_login.asp in BlogMe 3.0 allow remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Softbiz Jobs & Recruitment - SQL Injection

CVE-2007-5316—webappsphp

SQL injection vulnerability in browsecats.php in Softbiz Jobs and Recruitment Script allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

Softbiz Web Host Directory Script - 'host_id' SQL Injection

CVE-2008-2087—webappsphp

SQL injection vulnerability in search_result.php in Softbiz Web Host Directory Script, when magic_quotes_gpc is disabled

23RISK

open ↗

Referência✓ VexDay Proof

Links Management Application 1.0 - 'lcnt' SQL Injection

CVE-2007-1339—webappsphp

SQL injection vulnerability in index.php in Links Management Application 1.0 allows remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

Dew-NewPHPLinks 2.0 - Local File Inclusion / Cross-Site Scripting

CVE-2009-1623—webappsphp

Cross-site scripting (XSS) vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to inject arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Venalsur on-line Booking Centre - Cross-Site Scripting / SQL Injection

CVE-2008-6216—webappsphp

SQL injection vulnerability in cadena_ofertas_ext.php in Venalsur Booking Centre Booking System for Hotels Group allows

23RISK

open ↗

Referência✓ VexDay Proof

VP-ASP 6.00 - 'shopcurrency.asp' SQL Injection

CVE-2006-2263—webappsasp

SQL injection vulnerability in shopcurrency.asp in VP-ASP 6.00 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

Ipswitch WS_FTP Home/Professional FTP Client - Remote Format String (PoC)

CVE-2008-3795—doswindows

Buffer overflow in Ipswitch WS_FTP Home client allows remote FTP servers to have an unknown impact via a long "message r

28RISK

open ↗

Referência✓ VexDay Proof

skyportal vrc6 - Multiple Vulnerabilities

CVE-2007-6078—webappsphp

Multiple SQL injection vulnerabilities in SkyPortal RC6 allow remote attackers to execute arbitrary SQL commands via uns

23RISK

open ↗

Referência✓ VexDay Proof

Acoustica Mixcraft 4.2 Build 98 - 'mx4' Local Buffer Overflow

CVE-2008-3877—localwindows

Stack-based buffer overflow in Acoustica Mixcraft 4.1 Build 96 and 4.2 Build 98 allows user-assisted attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

Pc4Uploader 9.0 - Blind SQL Injection

CVE-2009-1742—webappsphp

code.php in PC4Arb Pc4 Uploader 9.0 and earlier makes it easier for remote attackers to conduct SQL injection attacks vi

23RISK

open ↗

Referência✓ VexDay Proof

PHPNS 1.1 - 'shownews.php?id' SQL Injection

CVE-2007-4628—webappsphp

SQL injection vulnerability in shownews.php in phpns 1.1 allows remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência✓ VexDay Proof

Anserv Auction XL - 'cat' SQL Injection

CVE-2008-2189—webappsphp

SQL injection vulnerability in viewfaqs.php in AnServ Auction XL allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

GForge 4.5.19 - Multiple SQL Injections

CVE-2008-6187—webappsphp

SQL injection vulnerability in frs/shownotes.php in Gforge 4.5.19 and earlier allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component 'com_catalogshop' 1.0b1 - SQL Injection

CVE-2008-0557—webappsphp

SQL injection vulnerability in index.php in the CatalogShop (com_catalogshop) 1.0b1 componenent for Mambo and Joomla! al

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.