Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
84,150cataloged exploits
39,601CVEs with public exploitation
24,695lab-tested
AllReferência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Ax Developer CMS 0.1.1 - 'index.php?module' Local File Inclusion
Directory traversal vulnerability in index.php in Ax Developer CMS (AxDCMS) 0.1.1 allows remote attackers to include and
23RISK
open ↗Referência✓ VexDay Proof
ashNews 0.83 - 'pathtoashnews' Remote File Inclusion
PHP remote file include vulnerability in Derek Ashauer ashNews 0.83 allows remote attackers to include and execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Eznet 3.5.0 - Remote Stack Overflow / Denial of Service
Stack-based buffer overflow in eZnet.exe, as used in eZ (a) eZphotoshare, (b) eZmeeting, (c) eZnetwork, and (d) eZshare
35RISK
open ↗Referência✓ VexDay Proof
Minerva 2.0.8a Build 237 - 'phpbb_root_path' File Inclusion
PHP remote file inclusion vulnerability in stat_modules/users_age/module.php in Minerva 2.0.8a Build 237 and earlier all
23RISK
open ↗Referência✓ VexDay Proof
Socketmail 2.2.8 - 'fnc-readmail3.php' Remote File Inclusion
PHP remote file inclusion vulnerability in content/fnc-readmail3.php in SocketMail 2.2.8 allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
SyndeoCMS 2.5.01 - 'cmsdir' Remote File Inclusion
PHP remote file inclusion vulnerability in starnet/themes/c-sky/main.inc.php in Fred Stuurman SyndeoCMS 2.5.01 allows re
23RISK
open ↗Referência✓ VexDay Proof
Mega File Hosting Script 1.2 - 'fid' SQL Injection
SQL injection vulnerability in members.php in YABSoft Mega File Hosting Script (aka MFH or MFHS) 1.2 allows remote authe
23RISK
open ↗Referência✓ VexDay Proof
Banner Management Script - 'id' SQL Injection
SQL injection vulnerability in tr.php in YourFreeWorld Banner Management Script allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
OxYProject 0.85 - 'edithistory.php' Remote Code Execution
Static code injection vulnerability in edithistory.php in OxYProject OxYBox 0.85 allows remote attackers to inject arbit
23RISK
open ↗Referência✓ VexDay Proof
ModSecurity < 2.5.9 - Remote Denial of Service
The multipart processor in ModSecurity before 2.5.9 allows remote attackers to cause a denial of service (crash) via a m
28RISK
open ↗Referência✓ VexDay Proof
GuppY 4.6.3 - 'index.php?selskin' Remote File Inclusion
Directory traversal vulnerability in inc/includes.inc in GuppY 4.6.3 allows remote attackers to include and execute arbi
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component JMovies 1.1 - 'id' SQL Injection
SQL injection vulnerability in the JMovies (aka JM or com_jmovies) component 1.1 for Joomla! allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
ASP AutoDealer - Remote Database Disclosure
ASP AutoDealer stores sensitive information under the web root with insufficient access control, which allows remote att
23RISK
open ↗Referência✓ VexDay Proof
Teraway FileStream 1.0 - Insecure Cookie Handling
Teraway FileStream 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the tw
23RISK
open ↗Referência✓ VexDay Proof
Opencart 1.1.8 - 'route' Local File Inclusion
Directory traversal vulnerability in index.php in OpenCart 1.1.8 allows remote attackers to read arbitrary files via a .
23RISK
open ↗Referência✓ VexDay Proof
Acoustica Mixcraft 4.2 - Universal Stack Overflow (SEH)
Stack-based buffer overflow in Acoustica Mixcraft 4.1 Build 96 and 4.2 Build 98 allows user-assisted attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
patBBcode 1.0 - 'bbcodeSource.php' Remote File Inclusion
PHP remote file inclusion vulnerability in examples/patExampleGen/bbcodeSource.php in patBBcode 1.0 allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
XM Easy Personal FTP Server 5.6.0 - Remote Denial of Service
XM Easy Personal FTP Server 5.6.0 allows remote authenticated users to cause a denial of service via a crafted argument
50RISK
open ↗Referência✓ VexDay Proof
SFS EZ Adult Directory - 'directory.php' SQL Injection
SQL injection vulnerability in directory.php in Scripts For Sites (SFS) EZ Adult Directory allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
Mini-stream Ripper 3.0.1.1 - '.RAM' Local Buffer Overflow
Multiple stack-based buffer overflows in Mini-stream Ripper 3.0.1.1 allow remote attackers to execute arbitrary code via
50RISK
open ↗Referência✓ VexDay Proof
RTWebalbum 1.0.462 - 'albumID' Blind SQL Injection
SQL injection vulnerability in index.php in RTWebalbum 1.0.462 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
AdaptBB 1.0 - 'forumspath' Remote File Inclusion
PHP remote file inclusion vulnerability in latestposts.php in AdaptBB 1.0, when register_globals is enabled, allows remo
23RISK
open ↗Referência✓ VexDay Proof
propertymax pro free - SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in the administrative login feature in PropertyMax Pro FREE 0.3, when magic_quote
23RISK
open ↗Referência✓ VexDay Proof
Family Connections CMS 1.9 - SQL Injection
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authen
23RISK
open ↗Referência✓ VexDay Proof
Active Bids 3.5 - 'itemID' Blind SQL Injection
SQL injection vulnerability in bidhistory.asp in Active Bids 3.5 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗Referência✓ VexDay Proof
WebED 0.0.9 - 'index.php' Remote File Disclosure
Multiple directory traversal vulnerabilities in mod/chat/index.php in WebED 0.0.9 allow remote attackers to read arbitra
23RISK
open ↗Referência✓ VexDay Proof
Mcms Easy Web Make - 'index.php?template' Local File Inclusion
Directory traversal vulnerability in modules/cms/index.php in Mcms Easy Web Make 1.3, allows remote attackers to include
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component JoomRadio 1.0 - 'id' SQL Injection
Multiple SQL injection vulnerabilities in the EXP JoomRadio (com_joomradio) component 1.0 for Joomla! allow remote attac
23RISK
open ↗Referência✓ VexDay Proof
CMS WebBlizzard - 'index.php' Blind SQL Injection
SQL injection vulnerability in index.php in WebBlizzard CMS allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Referência✓ VexDay Proof
Kusaba 1.0.4 - Remote Code Execution (2)
Multiple unrestricted file upload vulnerabilities in Kusaba 1.0.4 and earlier allow remote authenticated users to execut
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.