Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,883cataloged exploits
40,037CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
MobilePublisherPHP 1.5 RC2 - Remote File Inclusion
PHP remote file inclusion vulnerability in header.php in MobilePublisherPHP 1.5 RC2 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
faceStones personal 2.0.42 - 'fs_form_links.php' File Inclusion
PHP remote file inclusion vulnerability in fsl2/objects/fs_form_links.php in faceStones Personal 2.0.42 and earlier allo
23RISK
open ↗Referência✓ VexDay Proof
n@board 3.1.9e - 'naboard_pnr.php' Remote File Inclusion
PHP remote file inclusion vulnerability in naboard_pnr.php in n@board 3.1.9e and earlier allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
webSPELL 4.01.01 - 'getsquad' SQL Injection
SQL injection vulnerability in index.php in WebSPELL 4.01.01 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
Open Meetings Filing Application - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Rhode Island Open Meetings Filing Application (OMFA) allow remote
28RISK
open ↗Referência✓ VexDay Proof
QnECMS 2.5.6 - 'adminfolderpath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in QnECMS 2.5.6 and earlier allow remote attackers to execute arbitra
28RISK
open ↗Referência✓ VexDay Proof
Free Image Hosting 1.0 - 'forgot_pass.php' File Inclusion
PHP remote file inclusion vulnerability in forgot_pass.php in Free Image Hosting 1.0 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
iPrimal Forums - '/admin/index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in (1) index.php and (2) admin/index.php in IPrimal Forums as of 20061105 allows
23RISK
open ↗Referência✓ VexDay Proof
Evince Document Viewer - 'DocumentMedia' Remote Buffer Overflow
Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows u
28RISK
open ↗Referência✓ VexDay Proof
PHPManta 1.0.2 - 'view-sourcecode.php' Local File Inclusion
Directory traversal vulnerability in Mdoc/view-sourcecode.php for phpManta 1.0.2 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
blogme 3.0 - Cross-Site Scripting / Authentication Bypass
Multiple cross-site scripting (XSS) vulnerabilities in comments.asp in BlogMe 3.0 allow remote attackers to inject arbit
23RISK
open ↗Referência✓ VexDay Proof
Songbird Media Player 0.2 - Format String Denial of Service (PoC)
Format string vulnerability in Songbird Media Player 0.2 and earlier allows remote attackers to cause a denial of servic
23RISK
open ↗Referência✓ VexDay Proof
Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit)
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RISK
open ↗Referência✓ VexDay Proof
vBlog / C12 0.1 - 'cfgProgDir' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Vortex Blog (vBlog, aka C12) a0.1_nonfunc allow remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
uniForum 4 - 'wbsearch.aspx' SQL Injection
SQL injection vulnerability in wbsearch.aspx in uniForum 4 and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke Module Emporium 2.3.0 - SQL Injection
SQL injection vulnerability in the category file in modules.php in the Emporium 2.3.0 and earlier module for PHP-Nuke al
23RISK
open ↗Referência✓ VexDay Proof
WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting
WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This vulnerability can allo
23RISK
open ↗Referência✓ VexDay Proof
XM Easy Personal FTP Server 5.30 - 'ABOR' Format String Denial of Service
Multiple buffer overflows in XM Easy Personal FTP Server 5.3.0 allow remote attackers to execute arbitrary code via unsp
23RISK
open ↗Referência✓ VexDay Proof
Hospital Management System 4.0 - Persistent Cross-Site Scripting
PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabilities.
38RISK
open ↗Referência✓ VexDay Proof
PHP < 4.4.5/5.2.1 - 'shmop' SSL RSA Private-Key Disclosure
The shmop functions in PHP before 4.4.5, and before 5.2.1 in the 5.x series, do not verify that their arguments correspo
28RISK
open ↗Referência✓ VexDay Proof
osTicket 1.11 - Cross-Site Scripting / Local File Inclusion
In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.ph
23RISK
open ↗Referência✓ VexDay Proof
pNews 1.1.0 - 'nbs' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/global.php in Joshua Wilson pNews System 1.1.0 (aka PowerNews) allow
23RISK
open ↗Referência✓ VexDay Proof
ApowerManager 3.1.7 - Phone Manager Remote Denial of Service (PoC)
The ApowerManager application through 3.1.7 for Android allows remote attackers to cause a denial of service via many si
23RISK
open ↗Referência✓ VexDay Proof
Kaqoo Auction - 'install_root' Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Kaqoo Auction Software Free Edition allow remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
Picture-Engine 1.2.0 - 'wall.php?cat' SQL Injection
SQL injection vulnerability in wall.php in Picture-Engine 1.2.0 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
gtcatalog 0.9.1 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Chris Mac gtcatalog (aka GimeScripts Shopping Catalog) 0.9.1 and
23RISK
open ↗Referência✓ VexDay Proof
Scorp Book 1.0 - 'smilies.php?config' Remote File Inclusion
PHP remote file inclusion vulnerability in smilies.php in Scorp Book 1.0 allows remote attackers to execute arbitrary PH
23RISK
open ↗Referência✓ VexDay Proof
AirMore 1.6.1 - Denial of Service (PoC)
The AirMore application through 1.6.1 for Android allows remote attackers to cause a denial of service (system hang) via
28RISK
open ↗Referência✓ VexDay Proof
TikiWiki 1.9 Sirius - 'jhot.php' Remote Command Execution
Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execu
50RISK
open ↗Referência✓ VexDay Proof
PHP-revista 1.1.2 - Remote File Inclusion / SQL Injection / Authentication Bypass / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Longino Jacome php-Revista 1.1.2 allow remote attackers to inject
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.