Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,883cataloged exploits
40,037CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
MDForum 2.0.1 - 'PNSVlang' Remote Code Execution
Directory traversal vulnerability in includes/search/search_mdforum.php in MAXdev MDForum 2.0.1 and earlier, when magic_
23RISK
open ↗Referência✓ VexDay Proof
Booking Centre 2.01 - 'HotelID' SQL Injection
SQL injection vulnerability in hotel_habitaciones.php in Venalsur Booking Centre Booking System for Hotels Group 2.01 al
23RISK
open ↗Referência✓ VexDay Proof
Telekorn Signkorn Guestbook 1.3 - 'dir_path' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/log.inc.php in Telekorn SignKorn Guestbook (SL) 1.3 and earlier, whe
23RISK
open ↗Referência✓ VexDay Proof
Vz (Adp) Forum 2.0.3 - Remote Password Disclosure
Vz (Adp) Forum 2.0.3 stores sensitive information under the web root with insufficient access control, which allows remo
23RISK
open ↗Referência✓ VexDay Proof
MicroTik RouterOS 3.2 - SNMPd snmp-set Denial of Service
SNMPd in MikroTik RouterOS 3.2 and earlier allows remote attackers to cause a denial of service (daemon crash) via a cra
23RISK
open ↗Referência✓ VexDay Proof
KwsPHP Module jeuxflash 1.0 - 'cat' SQL Injection
SQL injection vulnerability in the jeuxflash module for KwsPHP allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
Fuzzylime CMS 3.01a - 'file' Local File Inclusion
Multiple directory traversal vulnerabilities in fuzzylime (cms) 3.01 and 3.01a allow remote attackers to include and exe
23RISK
open ↗Referência✓ VexDay Proof
Pie Cart Pro - 'Inc_Dir' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in WAHM E-Commerce Pie Cart Pro allow remote attackers to execute arb
28RISK
open ↗Referência✓ VexDay Proof
JSBoard 2.0.10 - 'login.php?table' Local File Inclusion
Directory traversal vulnerability in login.php in JSBoard before 2.0.12 allows remote attackers to include and execute a
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module XFsection - 'modify.php' Remote File Inclusion
PHP remote file inclusion vulnerability in modify.php in the XFsection 1.07 module for XOOPS allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
TeamCalPro 3.1.000 - Multiple Local/Remote File Inclusions
Multiple directory traversal vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to include and ex
23RISK
open ↗Referência✓ VexDay Proof
Adobe Album Starter 3.2 - Unchecked Local Buffer Overflow
Buffer overflow in Adobe Photoshop Album Starter Edition 3.2, and possibly After Effects CS3, allows user-assisted remot
28RISK
open ↗Referência✓ VexDay Proof
Joomla! Component DBQuery 1.4.1.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in the Green Mountain Information Technology and Consulting Database Query (com_
23RISK
open ↗Referência✓ VexDay Proof
phpGreetCards - Cross-Site Scripting / Arbitrary File Upload
Unrestricted file upload vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to execute arbitrary PH
23RISK
open ↗Referência✓ VexDay Proof
Pligg CMS 9.9.0 - 'editlink.php' SQL Injection
SQL injection vulnerability in editlink.php in Pligg 9.9.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
PHP 5.2.6 - 'error_log' Safe_mode Bypass
PHP 5 before 5.2.7 does not enforce the error_log safe_mode restrictions when safe_mode is enabled through a php_admin_f
23RISK
open ↗Referência✓ VexDay Proof
PHPLD 3.3 - Blind SQL Injection
SQL injection vulnerability in page.php in PHP Link Directory (phpLD) 3.3, when register_globals is enabled and magic_qu
23RISK
open ↗Referência✓ VexDay Proof
EQdkp 1.3.0 - 'dbal.php' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/dbal.php in EQdkp 1.3.0 and earlier allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
WordPress Core 2.2 - 'xmlrpc.php' SQL Injection
SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
Jasmine CMS 1.0 - SQL Injection / Remote Code Execution
Directory traversal vulnerability in admin/plugin_manager.php in Jasmine CMS 1.0 allows remote authenticated administrat
23RISK
open ↗Referência✓ VexDay Proof
Simple HTTPd 1.41 - '/aux' Remote Denial of Service
Sergey Lyubka Simple HTTPD (shttpd) 1.3 on Windows allows remote attackers to cause a denial of service via a request th
23RISK
open ↗Referência✓ VexDay Proof
My Gaming Ladder 7.5 - 'ladderid' SQL Injection
SQL injection vulnerability in ladder.php in My Gaming Ladder 7.5 and earlier allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
ZebraFeeds 1.0 - 'zf_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in ZebraFeeds 1.0, when register_globals is enabled, allow remote att
23RISK
open ↗Referência✓ VexDay Proof
Absolute Poll Manager XE 4.1 - Insecure Cookie Handling
Xigla Software Absolute Poll Manager XE 4.1 allows remote attackers to bypass authentication and gain administrative acc
23RISK
open ↗Referência✓ VexDay Proof
VMware 'IntraProcessLogging.dll' 5.5.3.42958 - Arbitrary Data Write
Absolute path traversal vulnerability in a certain ActiveX control in IntraProcessLogging.dll 5.5.3.42958 in EMC VMware
23RISK
open ↗Referência✓ VexDay Proof
Absolute NewsLetter 6.1 - Insecure Cookie Handling
Xigla Software Absolute Newsletter 6.0 and 6.1 allows remote attackers to bypass authentication and gain administrative
23RISK
open ↗Referência✓ VexDay Proof
SasCam WebCam Server 2.6.5 - ActiveX Remote Buffer Overflow
Buffer overflow in the XHTTP Module 4.1.0.0 in the ActiveX control for SaschArt SasCam Webcam Server 2.6.5 allows remote
50RISK
open ↗Referência✓ VexDay Proof
WengoPhone 2.x - SIP Phone Remote Denial of Service
WengoPhone 2.1 allows remote attackers to cause a denial of service (device crash) via a SIP INVITE message without a Co
23RISK
open ↗Referência✓ VexDay Proof
Quantum Game Library 0.7.2c - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Quantum Game Library 0.7.2c allow remote attackers to execute arbi
28RISK
open ↗Referência✓ VexDay Proof
HydraIrc 0.3.164 - Remote Denial of Service
HydraIRC 0.3.164 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and applicat
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.