Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
84,150cataloged exploits
39,601CVEs with public exploitation
24,695lab-tested
AllReferência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
CoolPlayer Portable 2.19.1 - '.m3u' Local Stack Overflow (PoC)
Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka CoolPlayer+ Portable) 2.19.6 and earlier allows rem
28RISK
open ↗Referência✓ VexDay Proof
Flatchat 3.0 - 'pmscript.php' Local File Inclusion
Directory traversal vulnerability in pmscript.php in Flatchat 3.0 allows remote attackers to include and execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
Zix Forum 1.12 - 'layid' SQL Injection
SQL injection vulnerability in settings.asp in Zixforum 1.12 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Visual Basic Enterprise 6.0 SP6 - Code Execution
Buffer overflow in Microsoft Visual Basic 6.0 and Enterprise Edition 6.0 SP6 allows user-assisted remote attackers to ex
50RISK
open ↗Referência✓ VexDay Proof
XGuestBook 2.0 - Authentication Bypass
SQL injection vulnerability in login.php in xGuestbook 2.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
GOM Player 2.1.16.6134 - Subtitle Local Buffer Overflow (PoC)
Stack-based buffer overflow in srt2smi.exe in Gretech Online Movie Player (GOM Player) 2.1.16.4635 allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component MailTo - 'article' SQL Injection
SQL injection vulnerability in the MailTo (aka com_mailto) component in Joomla! allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
metajour 2.1 - 'system_path' Remote File Inclusion
PHP remote file inclusion vulnerability in METAjour 2.1, when register_globals is enabled, allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
RW::Download 2.0.3 lite - 'index.php?dlid' SQL Injection
Multiple SQL injection vulnerabilities in UPLOAD/index.php in RW::Download 2.0.3 lite allow remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
FREEze Greetings 1.0 - Remote Password Retrieve
ScriptsEz FREEze Greetings 1.0 stores pwd.txt under the web root with insufficient access control, which allows remote a
23RISK
open ↗Referência✓ VexDay Proof
VideoLAN VLC Media Player 0.9.8a - Web UI 'input' Remote Denial of Service
requests/status.xml in VLC 0.9.8a allows remote attackers to cause a denial of service (stack consumption and crash) via
23RISK
open ↗Referência✓ VexDay Proof
Absolute Form Processor XE-V 1.5 - Insecure Cookie Handling
Absolute Form Processor XE 1.5 allows remote attackers to bypass authentication and gain administrative access by settin
23RISK
open ↗Referência✓ VexDay Proof
BackLinkSpider 1.1 - 'cat_id' SQL Injection
SQL injection vulnerability in BackLinkSpider allows remote attackers to execute arbitrary SQL commands via the cat_id p
23RISK
open ↗Referência✓ VexDay Proof
eLitius 1.0 - 'banner-details.php?id' SQL Injection
SQL injection vulnerability in classes/Xp.php in eLitius 1.0 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Referência✓ VexDay Proof
Icewarp Merak Mail Server 9.4.1 - 'Base64FileEncode()' Buffer Overflow (PoC)
Stack-based buffer overflow in the IceWarpServer.APIObject ActiveX control in api.dll in IceWarp Merak Mail Server 9.4.1
23RISK
open ↗Referência✓ VexDay Proof
CaLogic Calendars 1.2.2 - 'langsel' SQL Injection
SQL injection vulnerability in userreg.php in CaLogic Calendars 1.2.2 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
TNT Forum 0.9.4 - Local File Inclusion
Directory traversal vulnerability in index.php in TNT Forum 0.9.4, when magic_quotes_gpc is disabled, allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
ASPPortal Free Version - 'Topic_Id' SQL Injection
SQL injection vulnerability in content/forums/reply.asp in ASPPortal allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
Bloginator 1a - Cookie Bypass / SQL Injection
SQL injection vulnerability in articleCall.php in Bloginator 1A allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
OpenH323 Opal SIP Protocol - Remote Denial of Service
The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remo
28RISK
open ↗Referência✓ VexDay Proof
Qt QuickTeam - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Qt quickteam 2 allow remote attackers to execute arbitrary PHP cod
35RISK
open ↗Referência✓ VexDay Proof
Wysi Wiki Wyg 1.0 - Local File Inclusion / Cross-Site Scripting / PHPInfo
Wysi Wiki Wyg 1.0 allows remote attackers to obtain system information via an invalid categup parameter to index.php, wh
23RISK
open ↗Referência✓ VexDay Proof
Job Script 2.0 - Arbitrary Change Admin Password
admin/changepassword.php in Job Script Job Board Software 2.0 allows remote attackers to change the administrator passwo
23RISK
open ↗Referência✓ VexDay Proof
WU-FTPD 2.6.2 - 'wuftpd-freezer.c' Remote Denial of Service
ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, w
23RISK
open ↗Referência✓ VexDay Proof
Arcadwy Arcade Script - 'Username' Static Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in register.php in Arcadwy Arcade Script CMS allows remote attackers to inject
23RISK
open ↗Referência✓ VexDay Proof
BaoFeng - ActiveX 'OnBeforeVideoDownload()' Remote Buffer Overflow
Stack-based buffer overflow in the MPS.StormPlayer.1 ActiveX control in mps.dll 3.9.4.27 in Baofeng Storm allows remote
50RISK
open ↗Referência✓ VexDay Proof
Mercury/32 4.52 IMAPD - 'SEARCH' (Authenticated) Overflow
Stack-based buffer overflow in IMAPD in Mercury/32 4.52 allows remote authenticated users to execute arbitrary code via
23RISK
open ↗Referência✓ VexDay Proof
Leap CMS 0.1.4 - SQL Injection / Cross-Site Scripting / Arbitrary File Upload
Multiple SQL injection vulnerabilities in leap.php in Leap CMS 0.1.4, when magic_quotes_gpc is disabled, allow remote at
23RISK
open ↗Referência✓ VexDay Proof
Airsensor M520 - HTTPd Remote Denial of Service / Buffer Overflow (PoC)
Multiple buffer overflows in the AirDefense Airsensor M520 with firmware 4.3.1.1 and 4.4.1.4 allow remote authenticated
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke addon Nuke Mobile Entartainment 1.0 - Local File Inclusion
Directory traversal vulnerability in data/compatible.php in the Nuke Mobile Entertainment 1 addon for PHP-Nuke allows re
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.