Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,696cataloged exploits
39,957CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Microsoft Visual Studio 6.0 - 'PDWizard.ocx' Remote Command Execution
A certain ActiveX control in PDWizard.ocx 6.0.0.9782 and earlier in Microsoft Visual Studio 6.0 exposes dangerous (1) St
35RISK
open ↗Referência✓ VexDay Proof
Friendly Technologies - 'fwRemoteCfg.dll' ActiveX Command Execution
A certain ActiveX control in fwRemoteCfg.dll 3.3.3.1 in Friendly Technologies FriendlyPPPoE Client 3.0.0.57 allows remot
23RISK
open ↗Referência✓ VexDay Proof
FlexBB 0.5.5 - '/inc/start.php?_COOKIE' SQL Bypass
SQL injection vulnerability in inc/start.php in FlexBB 0.5.5 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
iG Calendar 1.0 - 'user.php?id' SQL Injection
SQL injection vulnerability in user.php in iGeneric iG Calendar 1.0 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
Okul Web Otomasyon Sistemi 4.0.1 - SQL Injection
SQL injection vulnerability in etkinlikbak.asp in Okul Web Otomasyon Sistemi 4.0.1 allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
FreeBSD mcweject 0.9 'Eject' - Local Buffer Overflow / Local Privilege Escalation
Buffer overflow in eject.c in Jason W. Bacon mcweject 0.9 on FreeBSD, and possibly other versions, allows local users to
23RISK
open ↗Referência✓ VexDay Proof
wolioCMS - Authentication Bypass / SQL Injection
Multiple SQL injection vulnerabilities in wolioCMS allow remote attackers to execute arbitrary SQL commands via (1) the
23RISK
open ↗Referência✓ VexDay Proof
OpenLD 1.2.2 - 'index.php?id' SQL Injection
SQL injection vulnerability in index.php in OpenLD 1.2.2 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
phpDatingClub 3.7 - SQL Injection / Cross-Site Scripting Injection
Cross-site scripting (XSS) vulnerability in website.php in phpDatingClub 3.7 allows remote attackers to inject arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Shop-Script FREE 2.0 - Remote Command Execution
admin.php in Shop-Script FREE 2.0 and earlier sends a redirect to the web browser but does not exit when administrative
23RISK
open ↗Referência✓ VexDay Proof
Jupiter CMS 1.1.5 - 'Client-IP' SQL Injection
Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
FlashGameScript 1.7 - 'user' SQL Injection
SQL injection vulnerability in index.php in FlashGameScript 1.7 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
ACG News 1.0 - 'aid'/'catid' SQL Injection
Multiple SQL injection vulnerabilities in index.php in ACG News 1.0 allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
eXV2 Module bamaGalerie 3.03 - SQL Injection
SQL injection vulnerability in viewcat.php in the bamaGalerie (Bama Galerie) 3.03 and 3.041 module for eXV2 2.0.6 allows
23RISK
open ↗Referência✓ VexDay Proof
Frogss CMS 0.7 - SQL Injection
Multiple SQL injection vulnerabilities in Frogss CMS 0.7 and earlier allow remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
phpBP RC3 (2.204) FIX4 - SQL Injection
SQL injection vulnerability in includes/functions/banners-external.php in phpBP 2 RC3 (2.204) FIX 4 allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
Autodealers CMS AutOnline - 'pageid' SQL Injection
SQL injection vulnerability in index.php in Zanfi Autodealers CMS AutOnline allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
team 1.x - File Disclosure / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in online.asp in Team Board 1.x allows remote attackers to inject arbitrary web
23RISK
open ↗Referência✓ VexDay Proof
MonGoose 2.4 (Windows) - WebServer Directory Traversal
Directory traversal vulnerability in Mongoose 2.4 allows remote attackers to read arbitrary files via a .. (dot dot) in
23RISK
open ↗Referência✓ VexDay Proof
KwsPHP 1.0 Member_Space Module - SQL Injection
Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via (1) th
23RISK
open ↗Referência✓ VexDay Proof
Coupon Script 4.0 - 'id' SQL Injection
SQL injection vulnerability in index.php in PHP Coupon Script 4.0 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
Katalog Plyt Audio (pl) 1.0 - SQL Injection
SQL injection vulnerability in index.php in Katalog Plyt Audio 1.0 and earlier allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
EQdkp 1.3.2 - 'listmembers.php' SQL Injection
SQL injection vulnerability in listmembers.php in EQdkp 1.3.2 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
Pagetool 1.07 - 'news_id' SQL Injection
SQL injection vulnerability in index.php in pagetool 1.07 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
GForge < 4.6b2 - 'skill_delete' SQL Injection
SQL injection vulnerability in www/people/editprofile.php in GForge 4.6b2 and earlier allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
A-Blog 2.0 - Cross-Site Scripting / SQL Injection
Cross-site scripting (XSS) vulnerability in search.php in A-Blog 2 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗Referência✓ VexDay Proof
AJ Forum 1.0 - 'topic_title.php' SQL Injection
SQL injection vulnerability in topic_title.php in AJ Forum 1.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
moziloCMS 1.11 - Local File Inclusion / Full Path Disclosure / Cross-Site Scripting
Directory traversal vulnerability in index.php in moziloCMS 1.11 allows remote attackers to read arbitrary files via a .
23RISK
open ↗Referência✓ VexDay Proof
JobSitePro 1.0 - 'search.php' SQL Injection
SQL injection vulnerability in search.php in PHP Labs JobSitePro 1.0 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module Camportail 1.1 - 'camid' SQL Injection
SQL injection vulnerability in show.php in the Camportail 1.1 and earlier module for Xoops allows remote attackers to ex
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.