Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,230cataloged exploits
36,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Ocean12 Mailing List Manager Gold - File Disclosure / SQL Injection / Cross-Site Scripting
Ocean12 Mailing List Manager Gold stores sensitive data under the web root with insufficient access control, which allow
23RISK
open ↗Referência✓ VexDay Proof
barcodegen 2.0.0 - Local File Inclusion
Directory traversal vulnerability in image.php in Barcode Generator 1D (barcodegen) 2.0.0 and earlier allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
IncCMS Core 1.0.0 - 'settings.php' Remote File Inclusion
PHP remote file inclusion vulnerability in inc/settings.php in IncCMS Core 1.0.0 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
SAPID Blog Beta 2 - 'ROOT_PATH' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Csaba Godor SAPID Blog Beta 2 and earlier allow remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Tech Article 1.x - SQL Injection
SQL injection vulnerability in the Tech Articles (com_tech_article) 1.0 component for Joomla! allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
YenerTurk Haber Script 1.0 - SQL Injection
SQL injection vulnerability in default.asp in YenerTurk Haber Script 1.0 and earlier allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
CLUB-Nuke [XP] 2.0 LCID 2048 (Turkish Version) - SQL Injection
Multiple SQL injection vulnerabilities in Club-Nuke [XP] 2.0 LCID 2048 allow remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
SuperNET Shop 1.0 - SQL Injection
Multiple SQL injection vulnerabilities in SuperNET Shop 1.0 and earlier allow remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
SQLiteWebAdmin 0.1 - 'tpl.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in tpl.inc.php in Falko Timme and Till Brehm SQLiteWebAdmin 0.1 and earlier allo
23RISK
open ↗Referência✓ VexDay Proof
phNNTP 1.3 - 'article-raw.php' Remote File Inclusion
PHP remote file inclusion vulnerability in article-raw.php in Jason Alexander phNNTP 1.3 and earlier allows remote attac
23RISK
open ↗Referência✓ VexDay Proof
JaxUltraBB 2.0 - 'delete.php' Remote Auto Deface
Direct static code injection vulnerability in delete.php in JaxUltraBB (JUBB) 2.0, when register_globals is enabled, all
23RISK
open ↗Referência✓ VexDay Proof
Sciurus Hosting Panel - Remote Code Injection
Direct static code injection vulnerability in acp/savenews.php in Sciurus Hosting Panel, possibly 2.0.3, allows remote a
23RISK
open ↗Referência✓ VexDay Proof
Apple Safari / QuickTime 7.3 - RTSP Content-Type Remote Buffer Overflow
Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac
50RISK
open ↗Referência✓ VexDay Proof
e107 Plugin BLOG Engine 2.1.4 - SQL Injection
SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows re
23RISK
open ↗Referência✓ VexDay Proof
e107 Plugin BLOG Engine 2.2 - 'uid' Blind SQL Injection
SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows re
23RISK
open ↗Referência✓ VexDay Proof
VWar 1.50 R14 - 'online.php' SQL Injection
SQL injection vulnerability in extra/online.php in Virtual War (VWar) 1.5.0 R14 and earlier allows remote attackers to e
23RISK
open ↗Referência✓ VexDay Proof
KB-Bestellsystem - 'kb_whois.cgi' Command Execution
kb_whois.cgi in K+B-Bestellsystem (aka KB-Bestellsystem) allows remote attackers to execute arbitrary commands via shell
23RISK
open ↗Referência✓ VexDay Proof
TuMusika Evolution 1.7R5 - Remote File Disclosure
Multiple directory traversal vulnerabilities in TuMusika Evolution 1.7R5 allow remote attackers to include and execute a
23RISK
open ↗Referência✓ VexDay Proof
Chaussette 080706 - '_BASE' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Chaussette 080706 and earlier allow remote attackers to execute ar
28RISK
open ↗Referência✓ VexDay Proof
phpPrintAnalyzer 1.2 - Remote File Inclusion
PHP remote file inclusion vulnerability in inc/header.inc.php in phpPrintAnalyzer 1.2 and earlier allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
HP OpenView Network Node Manager 07.50 - CGI Remote Buffer Overflow
Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 6.41, 7.01, and 7.51 allow remote att
50RISK
open ↗Referência✓ VexDay Proof
KML share 1.1 - 'region.php?layer' Remote File Disclosure
Directory traversal vulnerability in region.php in KML share 1.1 allows remote attackers to read arbitrary files via a .
23RISK
open ↗Referência✓ VexDay Proof
Absolute Banner Manager - Insecure Cookie Handling
Absolute Banner Manager .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by sett
23RISK
open ↗Referência✓ VexDay Proof
Absolute Control Panel XE 1.5 - Insecure Cookie Handling
Xigla Software Absolute Control Panel XE 1.5 allows remote attackers to bypass authentication and gain administrative ac
23RISK
open ↗Referência✓ VexDay Proof
Absolute Live Support 5.1 - Insecure Cookie Handling
Xigla Software Absolute Live Support .NET 5.1 allows remote attackers to bypass authentication and gain administrative a
23RISK
open ↗Referência✓ VexDay Proof
merlix educate servert - Authentication Bypass / File Disclosure
Merlix Educate Server allows remote attackers to bypass intended security restrictions and obtain sensitive information
23RISK
open ↗Referência✓ VexDay Proof
merlix educate servert - Authentication Bypass / File Disclosure
Merlix Educate Server stores db.mdb under the web root with insufficient access control, which allows remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
ExoPHPDesk 1.2 Final - Authentication Bypass
SQL injection vulnerability in admin.php in Exocrew ExoPHPDesk 1.2 Final allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
ThePortal 2.2 - Arbitrary File Upload
Unrestricted file upload vulnerability in admin/galeria.php in ThePortal2 2.2 allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
TaskDriver 1.3 - Remote Change Admin Password
profileedit.php TaskDriver 1.3 and earlier allows remote attackers to bypass authentication and gain administrative acce
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.