Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
NukeSentinel 2.5.05 - 'nsbypass.php' Blind SQL Injection
SQL injection vulnerability in includes/nsbypass.php in NukeSentinel 2.5.05, 2.5.11, and other versions before 2.5.12 al
23RISK
open ↗Referência✓ VexDay Proof
CMSbright - 'id_rub_page' SQL Injection
SQL injection vulnerability in public/page.php in Websens CMSbright allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
X.Org xorg-x11-xfs 1.0.2-3.1 - Local Race Condition
The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the
23RISK
open ↗Referência✓ VexDay Proof
PHPRunner 4.2 - 'SearchOption' Blind SQL Injection
Multiple SQL injection vulnerabilities in PHPRunner 4.2, and possibly earlier, allow remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
Teraway LiveHelp 2.0 - Insecure Cookie Handling
Teraway LiveHelp 2.0 allows remote attackers to bypass authentication and gain administrative access via a pwd=&lvl=1&us
23RISK
open ↗Referência✓ VexDay Proof
XOOPS 2.0.18 - Local File Inclusion / URL Redirecting
Open redirect vulnerability in htdocs/user.php in XOOPS 2.0.18 allows remote attackers to redirect users to arbitrary we
23RISK
open ↗Referência✓ VexDay Proof
IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow (PoC)
Stack-based buffer overflow in the HTML parser in IntelliTamper 2.0.7 allows remote attackers to execute arbitrary code
23RISK
open ↗Referência✓ VexDay Proof
Zeeways Shaadi Clone 2.0 - Authentication Bypass (1)
Zeeways SHAADICLONE 2.0 allows remote attackers to bypass authentication and gain administrative privileges via a direct
23RISK
open ↗Referência✓ VexDay Proof
beLive 0.2.3 - 'arch.php?arch' Local File Inclusion
Directory traversal vulnerability in arch.php in beLive 0.2.3 allows remote attackers to read arbitrary files via a .. (
23RISK
open ↗Referência✓ VexDay Proof
OLIB 7 WebView 2.5.1.1 - 'infile' Local File Inclusion
Fretwell-Downing Informatics (FDI) OLIB7 WebView 2.5.1.1 allows remote authenticated users to obtain sensitive informati
23RISK
open ↗Referência✓ VexDay Proof
PHP121 Instant Messenger 1.4 - Remote Code Execution
SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
cPanel 11.x - Cross-Site Scripting / Local File Inclusion
Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Mo
23RISK
open ↗Referência✓ VexDay Proof
ViPlay3 < 3.00 - '.vpl' Local Stack Overflow (PoC)
Stack-based buffer overflow in URUWorks ViPlay3 3.0 and earlier allows remote attackers to cause a denial of service (cr
23RISK
open ↗Referência✓ VexDay Proof
phpCommunityCalendar 4.0.3 - Cross-Site Scripting / SQL Injection
Multiple SQL injection vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
QuickCart 2.0 - 'categories.php' Local File Inclusion
Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0, when register_globals is enabled and magic
23RISK
open ↗Referência✓ VexDay Proof
phpBB Insert User Mod 0.1.2 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBB Insert User 0.1.2 and earlier allows
23RISK
open ↗Referência✓ VexDay Proof
Crea-Book 1.0 - Admin Access Bypass / Database Disclosure / Code Execution
Multiple direct static code injection vulnerabilities in admin/configurer2.php in Crea-Book 1.0 and earlier allow remote
23RISK
open ↗Referência✓ VexDay Proof
W1L3D4 philboard 0.2 - 'W1L3D4_bolum.asp' SQL Injection
SQL injection vulnerability in W1L3D4_bolum.asp in W1L3D4 Philboard 0.2 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Quick.Cart 2.2 - Local/Remote File Inclusion / Remote Code Execution
Directory traversal vulnerability in index.php in Open Solution Quick.Cart 2.2 and earlier allows remote attackers to in
23RISK
open ↗Referência✓ VexDay Proof
Yahoo! Messenger Webcam 8.1 - ActiveX Remote Buffer Overflow
Buffer overflow in the Yahoo! Webcam Upload ActiveX control in ywcupl.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows
50RISK
open ↗Referência✓ VexDay Proof
Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting
SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
TurnkeyForms Web Hosting Directory - Multiple Vulnerabilities
TurnkeyForms Web Hosting Directory stores sensitive information under the web root with insufficient access control, whi
23RISK
open ↗Referência✓ VexDay Proof
PHP Real Estate Classifieds - Remote File Inclusion
PHP remote file inclusion vulnerability in admin/header.php in PHP Real Estate Classifieds Premium Plus allows remote at
23RISK
open ↗Referência✓ VexDay Proof
Apartment Search Script - 'listtest.php' SQL Injection
SQL injection vulnerability in listtest.php in YourFreeWorld Apartment Search Script allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Getacoder clone - 'sb_protype' SQL Injection
SQL injection vulnerability in search_form.php in Getacoder Clone allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Datsogallery 1.6 - Blind SQL Injection
SQL injection vulnerability in sub_votepic.php in the Datsogallery (com_datsogallery) module 1.6 for Joomla! allows remo
23RISK
open ↗Referência✓ VexDay Proof
Ocean12 Membership Manager Pro - Authentication Bypass
SQL injection vulnerability in login.asp in Ocean12 Membership Manager Pro allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
BrewBlogger 2.1.0.1 - Arbitrary Add Admin
SQL injection vulnerability in the authenticateUser function in includes/authentication.inc.php in BrewBlogger (BB) 2.1.
23RISK
open ↗Referência✓ VexDay Proof
Particle Blogger 1.2.0 - 'post.php?postid' SQL Injection
SQL injection vulnerability in post.php in Particle Blogger 1.0.0 through 1.2.0 allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Ace-FTP Client 1.24a - Remote Buffer Overflow (PoC)
Buffer overflow in Ace-FTP Client 1.24a allows user-assisted, remote FTP servers to execute arbitrary code via a long re
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.