Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,883cataloged exploits
40,037CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
mail2forum phpBB Mod 1.2 - 'm2f_root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Mail2Forum (module for phpBB) 1.2 and earlier allow remote attacke
23RISK
open ↗Referência✓ VexDay Proof
iManage CMS 4.0.12 - 'absolute_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in component.php in iManage CMS 4.0.12 and earlier allow remote attac
28RISK
open ↗Referência✓ VexDay Proof
Prozilla Webring Website Script - 'category.php?cat' SQL Injection
SQL injection vulnerability in category.php in Prozilla Webring allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
IBM Rational ClearQuest - Web Authentication Bypass / SQL Injection
SQL injection vulnerability in /main in IBM Rational ClearQuest (CQ) Web 7.0.0.0-IFIX02 and 7.0.0.1 allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Visual FoxPro 6.0 - FPOLE.OCX 6.0.8450.0 Remote (PoC)
Stack-based buffer overflow in certain ActiveX controls in (1) FPOLE.OCX 6.0.8450.0 and (2) Foxtlib.ocx, as used in the
35RISK
open ↗Referência✓ VexDay Proof
Omnistar Article Manager Software - 'article.php' SQL Injection
SQL injection vulnerability in article.php in OmniStar Article Manager allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
SimpCMS - 'keyword' SQL Injection
SQL injection vulnerability in index.php in SimpCMS allows remote attackers to execute arbitrary SQL commands via the ke
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component joom12pic 1.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.joom12pic.php in the joom12Pic (com_joom12pic) 1.0 component for Joomla
28RISK
open ↗Referência✓ VexDay Proof
KwsPHP 1.0 - 'login.php' SQL Injection
Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via (1) th
23RISK
open ↗Referência✓ VexDay Proof
cpDynaLinks 1.02 - 'category.php' SQL Injection
SQL injection vulnerability in category.php in cpDynaLinks 1.02 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
ProfileCMS 1.0 - Arbitrary File Upload
Unrestricted file upload vulnerability in the profiles script in ProfileCMS 1.0 allows remote attackers to upload and ex
23RISK
open ↗Referência✓ VexDay Proof
LearnLoop 2.0beta7 - 'sFilePath' Remote File Disclosure
Directory traversal vulnerability in include/file_download.php in LearnLoop 2.0 beta7 allows remote attackers to read ar
23RISK
open ↗Referência✓ VexDay Proof
Web-MeetMe 3.0.3 - 'play.php' Remote File Disclosure
Multiple directory traversal vulnerabilities in play.php in Web-MeetMe 3.0.3 allow remote attackers to read arbitrary fi
23RISK
open ↗Referência✓ VexDay Proof
eSyndiCat Link Exchange Script 2005-2006 - SQL Injection
SQL injection vulnerability in suggest-link.php in eSyndiCat Link Exchange Script allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
RunCMS 1.6 - Get Admin Cookie Blind SQL Injection
Multiple SQL injection vulnerabilities in RunCMS before 1.6.1 allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Referência✓ VexDay Proof
1024 CMS 1.4.2 - Local File Inclusion / Blind SQL Injection
SQL injection vulnerability in includes/system.php in 1024 CMS 1.4.2 beta and earlier, when magic_quotes_gpc is disabled
23RISK
open ↗Referência✓ VexDay Proof
ZenPhoto 1.1.3 - 'rss.php?albumnr' SQL Injection
SQL injection vulnerability in rss.php in Zenphoto 1.1 through 1.1.3 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
MyPHP Forum 3.0 (Final) - Multiple SQL Injections
SQL injection vulnerability in faq.php in MyPHP Forum 3.0 and earlier allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
Webmin 1.962 - 'Package Updates' Escape Bypass RCE (Metasploit)
Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can ex
28RISK
open ↗Referência✓ VexDay Proof
AlkalinePHP 0.80.00 Beta - 'thread.php' SQL Injection
SQL injection vulnerability in thread.php in AlkalinePHP 0.80.00 beta and earlier allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
FicHive 1.0 - 'category' Blind SQL Injection
SQL injection vulnerability in index.php in FicHive 1.0 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Referência✓ VexDay Proof
WebPortal CMS 0.6-beta - Remote Password Change
Multiple SQL injection vulnerabilities in WebPortal CMS 0.6-beta allow remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
Shop-Script 2.0 - 'index.php' Remote File Disclosure
Directory traversal vulnerability in index.php in Shop-Script 2.0 and possibly other versions allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
samPHPweb 4.2.2 - 'songinfo.php' SQL Injection
SQL injection vulnerability in songinfo.php in SAM Broadcaster samPHPweb, possibly 4.2.2 and earlier, allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
ClipShare < 3.0.1 - 'tid' SQL Injection
SQL injection vulnerability in group_posts.php in ClipShare before 3.0.1 allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
Softbiz Link Directory Script - SQL Injection
SQL injection vulnerability in searchresult.php in Softbiz Link Directory Script allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
doITlive CMS 2.50 - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in edit/showmedia.asp in doITLive CMS 2.50 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
BoatScripts Classifieds - 'type' SQL Injection
SQL injection vulnerability in index.php in BoatScripts Classifieds allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
project alumni 1.0.9 - Cross-Site Scripting / SQL Injection
Multiple cross-site scripting (XSS) vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to inject
23RISK
open ↗Referência✓ VexDay Proof
WorkingOnWeb 2.0.1400 - 'events.php' SQL Injection
SQL injection vulnerability in events.php in WorkingOnWeb 2.0.1400 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.