Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,305cataloged exploits
36,465CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,466Referência 23,051GitHub PoC 15,051VulnCheck XDB 8,883Nuclei 4,361Metasploit 3,493✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
flinx 1.3 - 'id' SQL Injection
SQL injection vulnerability in category.php in Flinx 1.3 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
Move Networks Upgrade Manager Control - Remote Buffer Overflow
Stack-based buffer overflow in the QMPUpgrade.Upgrade.1 ActiveX control in QMPUpgrade.dll 1.0.0.1 in Move Networks Upgra
28RISK
open ↗Referência✓ VexDay Proof
Web Wiz Forums 9.07 - 'sub' Directory Traversal
Multiple directory traversal vulnerabilities in Web Wiz Forums 9.07 and earlier allow remote attackers to list arbitrary
23RISK
open ↗Referência✓ VexDay Proof
saPHP Lesson 2.0 - 'forumid' SQL Injection
SQL injection vulnerability in Saphp Lesson, possibly saphp Lesson1.1 and saphpLesson2.0, allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
Xcode OpenBase 10.0.0 (OSX) - Symlink Privilege Escalation
openexec in OpenBase SQL before 10.0.1 allows local users to create arbitrary files via a symlink attack on the /tmp/out
23RISK
open ↗Referência✓ VexDay Proof
Xcode OpenBase 10.0.0 (OSX) - Unsafe System Call Privilege Escalation
Untrusted search path vulnerability in openexec in OpenBase SQL before 10.0.1 allows local users to gain privileges via
23RISK
open ↗Referência✓ VexDay Proof
Mercury Mail Transport System 4.01b - PH SERVER Remote Overflow
Buffer overflow in Mercury Mail Transport System 4.01b allows remote attackers to execute arbitrary code via a long requ
50RISK
open ↗Referência✓ VexDay Proof
Munch Pro 1.0 - 'switch.asp' SQL Injection
SQL injection vulnerability on the subMenu page in switch.asp in Munch Pro 1.0 allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
Bigware Shop 2.0 - 'pollid' SQL Injection
SQL injection vulnerability in main_bigware_53.tpl.php in Bigware Shop 2.0 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
phpMyClub 0.0.1 - 'page_courante' Local File Inclusion
Directory traversal vulnerability in phpMyClub 0.0.1 allows remote attackers to include and execute arbitrary local file
23RISK
open ↗Referência✓ VexDay Proof
Invision Power Board 2.1.4 - Register Users Denial of Service
index.php in Invision Power Board (IPB) 2.0.1, with Code Confirmation disabled, allows remote attackers to cause an unsp
23RISK
open ↗Referência✓ VexDay Proof
Persits XUpload 3.0 - 'AddFile()' Remote Buffer Overflow
Stack-based buffer overflow in the Persits.XUpload.2 ActiveX control in XUpload.ocx 3.0.0.4 and earlier in Persits XUplo
43RISK
open ↗Referência✓ VexDay Proof
WordPress Plugin Adserve 0.2 - 'adclick.php' SQL Injection
SQL injection vulnerability in adclick.php in the AdServe 0.2 plugin for WordPress allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
Helix Server 11.0.1 (Windows 2000 SP4) - Remote Heap Overflow
Heap-based buffer overflow in Real Networks Helix Server and Helix Mobile Server before 11.1.3, and Helix DNA Server 11.
28RISK
open ↗Referência✓ VexDay Proof
Gallery 2.0.3 - 'stepOrder[]' Remote Command Execution
Directory traversal vulnerability in Gallery 2.0.3 and earlier, and 2.1 before RC-2a, allows remote attackers to include
23RISK
open ↗Referência✓ VexDay Proof
WORK System E-Commerce 3.0.1 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Laurent Van den Reysen WORK system e-commerce 3.0.2, and other ver
23RISK
open ↗Referência✓ VexDay Proof
PHPWebThings 1.5.2 - 'editor.php' Remote File Inclusion
PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 and earlier, when register_globals is e
23RISK
open ↗Referência✓ VexDay Proof
Etomite CMS 0.6.1.2 - '/manager/index.php' Local File Inclusion
Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component MosReporter 0.9.3 - Remote File Inclusion
PHP remote file inclusion vulnerability in reporter.logic.php in the MosReporter (com_reporter) component for Mambo and
23RISK
open ↗Referência✓ VexDay Proof
SQuery 4.5 - 'libpath' Remote File Inclusion
PHP remote file inclusion vulnerability in lib/armygame.php in SQuery 4.5 and earlier, as used in products such as Auton
23RISK
open ↗Referência✓ VexDay Proof
Photo Cart 3.9 - 'adminprint.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in adminprint.php in PicturesPro Photo Cart 3.9 allow remote attacker
23RISK
open ↗Referência✓ VexDay Proof
WebspotBlogging 3.0.1 - 'path' Remote File Inclusion
PHP remote file inclusion vulnerability in Webspotblogging 3.0.1 allows remote attackers to execute arbitrary PHP code v
28RISK
open ↗Referência✓ VexDay Proof
Wikiwig 4.1 - 'wk_lang.php' Remote File Inclusion
PHP remote file inclusion vulnerability in _wk/wk_lang.php in Wikiwig 4.1 and earlier allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
CS-Cart 1.3.3 - 'classes_dir' Remote File Inclusion
PHP remote file inclusion vulnerability in class.cs_phpmailer.php in CS-Cart 1.3.3 allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
OpenEMR 2.8.1 - 'fileroot' Remote File Inclusion
PHP remote file inclusion vulnerability in contrib/forms/evaluation/C_FormEvaluation.class.php in OpenEMR 2.8.1 and earl
23RISK
open ↗Referência✓ VexDay Proof
blur6ex 0.3.462 - 'ID' Admin Disclosure / Blind SQL Injection
SQL injection vulnerability in engine/shards/blog.php in blur6ex 0.3.462 allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
fipsGallery 1.5 - 'index1.asp' SQL Injection
SQL injection vulnerability in index1.asp in fipsGallery 1.5 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
Sisfo Kampus 0.8 - Remote File Inclusion / Download
Multiple PHP remote file inclusion vulnerabilities in Sisfo Kampus 0.8 allow remote attackers to execute arbitrary PHP c
23RISK
open ↗Referência✓ VexDay Proof
Sisfo Kampus 0.8 - Remote File Inclusion / Download
Directory traversal vulnerability in download.php in Sisfo Kampus 0.8 allows remote attackers to list arbitrary director
23RISK
open ↗Referência✓ VexDay Proof
Spaminator 1.7 - 'page' Remote File Inclusion
PHP remote file inclusion vulnerability in Login.php in Spaminator 1.7 and earlier allows remote attackers to execute ar
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.