Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,883cataloged exploits
40,037CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Microsoft Windows - '.doc' Malformed Pointers Denial of Service
Microsoft Windows Explorer on Windows 2000 SP4 FR and XP SP2 FR, and possibly other versions and platforms, allows remot
35RISK
open ↗Referência✓ VexDay Proof
Mooseguy Blog System 1.0 - 'month' SQL Injection
SQL injection vulnerability in blog.php in Mooseguy Blog System (MGBS) 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
ABC Advertise 1.0 - Admin Password Disclosure
Zakkis Technology ABC Advertise 1.0 does not properly restrict access to admin.inc.php, which allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Pre Shopping Mall - Insecure Cookie Handling
Pre Shopping Mall allows remote attackers to bypass authentication and gain administrative access by setting the (1) adm
23RISK
open ↗Referência✓ VexDay Proof
32bit FTP (09.04.24) - 'Banner' Remote Buffer Overflow (PoC)
Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a
23RISK
open ↗Referência✓ VexDay Proof
SCart 2.0 - 'page' Remote Code Execution
scart.cgi in SCart 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the page parame
23RISK
open ↗Referência✓ VexDay Proof
SFS EZ Software - 'id' SQL Injection
SQL injection vulnerability in software-description.php in Scripts For Sites (SFS) Hotscripts-like Site allows remote at
23RISK
open ↗Referência✓ VexDay Proof
Simple Customer 1.3 - Arbitrary Change Admin Password
profile.php in Simple Customer 1.3 does not require administrative authentication, which allows remote attackers to chan
23RISK
open ↗Referência✓ VexDay Proof
PHP League 0.82 - 'classement.php' SQL Injection
SQL injection vulnerability in consult/classement.php in Uni-Vert PhpLeague 0.82 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
PHP 4.4.6 - 'crack_opendict()' Local Buffer Overflow
Buffer overflow in the crack extension (CrackLib), as bundled with PHP 4.4.6 and other versions before 5.0.0, might allo
23RISK
open ↗Referência✓ VexDay Proof
SFS EZ Top Sites - SQL Injection
SQL injection vulnerability in topsite.php in Scripts For Sites (SFS) EZ Top Sites allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
T-Dreams Job Career Package 3.0 - Insecure Cookie Handling
Techno Dreams Job Career Package 3.0 allows remote attackers to bypass authentication and obtain administrative access b
23RISK
open ↗Referência✓ VexDay Proof
AEP SmartGate 4.3b - 'GET' Arbitrary File Download
The SSL server in AEP Smartgate 4.3b allows remote attackers to determine existence of directories via a direct request
23RISK
open ↗Referência✓ VexDay Proof
Macromedia 10.1.4.20 - 'SwDir.dll' Internet Explorer Stack Overflow Denial of Service
Multiple stack-based buffer overflows in an ActiveX control in SwDir.dll 10.1.4.20 in Macromedia Shockwave allow remote
28RISK
open ↗Referência✓ VexDay Proof
Family Project 2.x - Authentication Bypass
Multiple SQL injection vulnerabilities in index.php in FamilyProject 2.0 allow remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
exV2 < 2.0.4.3 - 'extract()' Remote Command Execution
Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to de
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component com_gsticketsystem - 'catid' Blind SQL Injection
SQL injection vulnerability in the GridSupport (GS) Ticket System (com_gsticketsystem) component for Joomla! allows remo
23RISK
open ↗Referência✓ VexDay Proof
RakhiSoftware Shopping Cart - SQL Injection
SQL injection vulnerability in product.php in RakhiSoftware Price Comparison Script (aka Shopping Cart) allows remote at
23RISK
open ↗Referência✓ VexDay Proof
DGNews 3.0 Beta - 'id' SQL Injection
SQL injection vulnerability in berita.php in Dian Gemilang DGNews 3.0 Beta allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
my-gesuad 0.9.14 - Authentication Bypass / SQL Injection / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in myGesuad 0.9.14 (aka 0.9) allow remote attackers to inject arbitr
23RISK
open ↗Referência✓ VexDay Proof
Power Phlogger 2.0.9 - 'config.inc.php3' File Inclusion
PHP remote file inclusion vulnerability in config.inc.php3 in Power Phlogger 2.0.9 and earlier allows remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
PunBB (Private Messaging System 1.2.x) - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in Private Messaging System (PMS) 1.2.3 and earlier for PunBB allow remote
23RISK
open ↗Referência✓ VexDay Proof
Soulseek 157 NS - Remote Buffer Overflow (SEH)
Stack-based buffer overflow in Soulseek 156 and 157 NS allows remote attackers to execute arbitrary code via a long sear
23RISK
open ↗Referência✓ VexDay Proof
FreeWebShop.org script 2.2.2 - Multiple Vulnerabilities
Directory traversal vulnerability in index.php in FreeWebshop 2.2.1 and earlier allows remote attackers to read arbitrar
23RISK
open ↗Referência✓ VexDay Proof
iPrimal Forums - '/admin/index.php' Change User Password
admin/index.php in IPrimal Forums as of 20061105 allows remote attackers to bypass authentication and modify user passwo
23RISK
open ↗Referência✓ VexDay Proof
Adobe Acrobat 9 - ActiveX Remote Denial of Service
A certain ActiveX control in Adobe Acrobat 9, when used with Microsoft Windows Vista and Internet Explorer 7, allows rem
28RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows - '.png' IHDR Block Denial of Service (PoC) (1)
Microsoft Windows 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (cpu consumption) via a
28RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Ynews 1.0.0 - 'id' SQL Injection
SQL injection vulnerability in index.php in the Ynews (com_ynews) 1.0.0 component for Joomla! allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
propertymax pro free - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in PropertyMax Pro FREE 0.3 allows remote attackers to inject arbi
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Word 2007 - Multiple Vulnerabilities
Multiple unspecified vulnerabilities in Microsoft Word 2007 allow remote attackers to cause a denial of service (CPU con
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.