Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,825cataloged exploits
40,030CVEs with public exploitation
24,696lab-tested
AllReferência 25,954Exploit-DB 24,488GitHub PoC 17,440VulnCheck XDB 9,888Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
PozScripts Business Directory Script - 'cid' SQL Injection
SQL injection vulnerability in showcategory.php in PozScripts Business Directory Script allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
Kipper 2.01 - Cross-Site Scripting / Local File Inclusion / File Disclosure
Kipper 2.01 stores sensitive information under the web root with insufficient access control, which allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
Easy RM to MP3 Converter - Universal Stack Overflow
Stack-based buffer overflow in Easy RM to MP3 Converter allows remote attackers to execute arbitrary code via a long fil
28RISK
open ↗Referência✓ VexDay Proof
YenerTurk Haber Script 1.0 - SQL Injection
SQL injection vulnerability in default.asp in YenerTurk Haber Script 1.0 and earlier allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Merlix Teamworx Server - File Disclosure/Bypass
Merlix Teamworx Server stores sensitive information under the web root with insufficient access control, which allows re
23RISK
open ↗Referência✓ VexDay Proof
Spidey Blog Script 1.5 - 'proje_goster.asp' SQL Injection (1)
SQL injection vulnerability in proje_goster.php in Spidey Blog Script 1.5 and earlier allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
SFS EZ Link Directory - 'cat_id' SQL Injection
SQL injection vulnerability in links.php in Scripts for Sites (SFS) EZ Link Directory allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
RhinoSoft Serv-U FTP Server 7.4.0.1 - 'MKD' Create Arbitrary Directories
Directory traversal vulnerability in the FTP server in Rhino Software Serv-U File Server 7.0.0.1 through 7.4.0.1 allows
28RISK
open ↗Referência✓ VexDay Proof
DeluxeBB 1.3 - 'qorder' SQL Injection
SQL injection vulnerability in misc.php in DeluxeBB 1.3 and earlier allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
Real Player - 'rmoc3260.dll' ActiveX Control Remote Code Execution
The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, Rea
50RISK
open ↗Referência✓ VexDay Proof
Haberx 1.02 < 1.1 - 'tr' SQL Injection
SQL injection vulnerability in kategorix.asp in Haberx 1.02 through 1.1 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Alstrasoft Web Host Directory - Authentication Bypass
SQL injection vulnerability in the login directory in AlstraSoft Web Host Directory allows remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
Vinagre < 2.24.2 - 'show_error()' Remote Format String (PoC)
Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2
23RISK
open ↗Referência✓ VexDay Proof
FeedMon 2.7.0.0 - outline Tag Buffer Overflow (PoC)
Stack-based buffer overflow in NewsGator FeedDemon 2.7 and earlier allows user-assisted remote attackers to execute arbi
50RISK
open ↗Referência✓ VexDay Proof
fungamez rc1 - Authentication Bypass / Local File Inclusion
SQL injection vulnerability in pages/login.php in FunGamez RC1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
CuteNews 1.1.1 - 'html.php' Remote Code Execution
plugins/wacko/highlight/html.php in Strawberry in CuteNews.ru 1.1.1 (aka Strawberry) allows remote attackers to execute
35RISK
open ↗Referência✓ VexDay Proof
Pluck CMS 4.6.1 - 'module_pages_site.php' Local File Inclusion
Directory traversal vulnerability in data/modules/blog/module_pages_site.php in Pluck 4.6.1 allows remote attackers to i
23RISK
open ↗Referência✓ VexDay Proof
dotProject 2.0.4 - 'baseDir' Remote File Inclusion
PHP remote file inclusion vulnerability in classes/query.class.php in dotProject 2.0.4 and earlier allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
PHPSlash 0.8.1.1 - Remote Code Execution
Eval injection vulnerability in index.php in phpSlash 0.8.1.1 and earlier allows remote attackers to execute arbitrary P
35RISK
open ↗Referência✓ VexDay Proof
Icarus 2.0 - '.pgn' Local Stack Overflow (SEH)
Stack-based buffer overflow in Icarus 2.0 allows remote attackers to cause a denial of service (application crash) or ex
23RISK
open ↗Referência✓ VexDay Proof
fungamez rc1 - Authentication Bypass / Local File Inclusion
includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by set
23RISK
open ↗Referência✓ VexDay Proof
VIDEOSCRIPT.us - Authentication Bypass
Multiple SQL injection vulnerabilities in admin/index.php in VideoScript.us YouTube Video Script allow remote attackers
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Plugin tinybrowser 1.5.12 - Arbitrary File Upload / Execution
TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.
50RISK
open ↗Referência✓ VexDay Proof
PromoteWeb MySQL - 'id' SQL Injection
SQL injection vulnerability in go.php in Panuwat PromoteWeb MySQL, when magic_quotes_gpc is disabled, allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
Tutti Nova 1.6 - 'TNLIB_DIR' Remote File Inclusion
PHP remote file inclusion vulnerability in Tutti Nova 1.6 and earlier allows remote attackers to execute arbitrary PHP c
23RISK
open ↗Referência✓ VexDay Proof
Simple Text-File Login script (SiTeFiLo) 1.0.6 - File Disclosure / Remote File Inclusion
Simple Text-File Login Script (SiTeFiLo) 1.0.6 stores sensitive information under the web root with insufficient access
23RISK
open ↗Referência✓ VexDay Proof
SportsPHool 1.0 - 'mainnav' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/layout/plain.footer.php in SportsPHool 1.0 allows remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
LBlog 1.05 - 'comments.asp' SQL Injection
SQL injection vulnerability in comments.asp in LBlog 1.05 and earlier allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
Simple Text-File Login script (SiTeFiLo) 1.0.6 - File Disclosure / Remote File Inclusion
PHP remote file inclusion vulnerability in slogin_lib.inc.php in Simple Text-File Login Script (SiTeFiLo) 1.0.6 allows r
35RISK
open ↗Referência✓ VexDay Proof
FreePBX 2.1.3 - 'upgrade.php' Remote File Inclusion
PHP remote file inclusion vulnerability in upgrade.php in Coalescent Systems freePBX 2.1.3 allows remote attackers to ex
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.