Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Persits XUpload 3.0 - 'AddFile()' Remote Buffer Overflow
Stack-based buffer overflow in the Persits.XUpload.2 ActiveX control in XUpload.ocx 3.0.0.4 and earlier in Persits XUplo
43RISK
open ↗Referência✓ VexDay Proof
MyBulletinBoard (MyBB) 1.03 - 'misc.php' SQL Injection
SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when register_globals is enabled, allows remote
23RISK
open ↗Referência✓ VexDay Proof
WORK System E-Commerce 3.0.1 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Laurent Van den Reysen WORK system e-commerce 3.0.2, and other ver
23RISK
open ↗Referência✓ VexDay Proof
Mercury Mail Transport System 4.01b - PH SERVER Remote Overflow
Buffer overflow in Mercury Mail Transport System 4.01b allows remote attackers to execute arbitrary code via a long requ
50RISK
open ↗Referência✓ VexDay Proof
PHPWebThings 1.5.2 - 'editor.php' Remote File Inclusion
PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 and earlier, when register_globals is e
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component 'com_newsletter' 4.5 - 'listid' SQL Injection
SQL injection vulnerability in index.php in the Newsletter (com_newsletter) component for Mambo 4.5 and Joomla! allows r
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component 'com_mamml' - 'listid' SQL Injection
SQL injection vulnerability in index.php in the MaMML (com_mamml) component for Mambo and Joomla! allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
Photo Cart 3.9 - 'adminprint.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in adminprint.php in PicturesPro Photo Cart 3.9 allow remote attacker
23RISK
open ↗Referência✓ VexDay Proof
fipsGallery 1.5 - 'index1.asp' SQL Injection
SQL injection vulnerability in index1.asp in fipsGallery 1.5 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
Sisfo Kampus 0.8 - Remote File Inclusion / Download
Multiple PHP remote file inclusion vulnerabilities in Sisfo Kampus 0.8 allow remote attackers to execute arbitrary PHP c
23RISK
open ↗Referência✓ VexDay Proof
ilchClan 1.05g - 'tid' SQL Injection
SQL injection vulnerability in the forum module of ilchClan 1.05g and earlier allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
Admbook 1.2.2 - 'x-forwarded-for' Remote Command Execution
Direct static code injection vulnerability in write.php in Admbook 1.2.2 and earlier allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Liberum Help Desk 0.97.3 - SQL Injection
SQL injection vulnerability in details.asp in Doug Luxem Liberum Help Desk 0.97.3 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Invision Power Board 2.1.4 - Register Users Denial of Service
index.php in Invision Power Board (IPB) 2.0.1, with Code Confirmation disabled, allows remote attackers to cause an unsp
23RISK
open ↗Referência✓ VexDay Proof
4Images 1.7.1 - Local File Inclusion / Remote Code Execution
Directory traversal vulnerability in index.php in 4Images 1.7.1 and earlier allows remote attackers to read and include
23RISK
open ↗Referência✓ VexDay Proof
GeekLog 1.4.0sr3 - '_CONF[path]' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in GeekLog 1.4 allow remote attackers to execute arbitrary code via a
23RISK
open ↗Referência✓ VexDay Proof
Woltlab Burning Board Lite 1.0.2 - 'decode_cookie()' SQL Injection
SQL injection vulnerability in the decode_cookie function in thread.php in Woltlab Burning Board Lite 1.0.2 allows remot
23RISK
open ↗Referência✓ VexDay Proof
TIBCO Rendezvous 7.4.11 - Password Extractor
TIBCO RendezVous 7.4.11 and earlier logs base64-encoded usernames and passwords in rvrd.db, which allows local users to
23RISK
open ↗Referência✓ VexDay Proof
mxBB Module mx_tinies 1.3.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/mx_common.php in the mx_tinies 1.3.0 Module for MxBB Portal 1.06 all
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component ChronoForms 2.3.5 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in ChronoEngine ChronoForms (com_chronocontact) 2.3.5 component for J
35RISK
open ↗Referência✓ VexDay Proof
Mindmeld 1.2.0.10 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Mindmeld 1.2.0.10 allow remote attackers to execute arbitrary PHP
28RISK
open ↗Referência✓ VexDay Proof
Downstat 1.8 - 'art' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Vmist Downstat 1.8 and earlier allow remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
Ipswitch WS_FTP Server with SSH 6.1.0.0 - Remote Buffer Overflow (PoC)
Buffer overflow in Ipswitch WS_FTP Server with SSH 6.1.0.0 allows remote authenticated users to cause a denial of servic
28RISK
open ↗Referência✓ VexDay Proof
Linux Kernel 2.6.17 < 2.6.24.1 - 'vmsplice' Local Privilege Escalation (2)
The vmsplice_to_pipe function in Linux kernel 2.6.17 through 2.6.24.1 does not validate a certain userspace pointer befo
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Expose RC35 - Arbitrary File Upload
uploadimg.php in the Expose RC35 and earlier (com_expose) component for Joomla! sends an error message but does not exit
23RISK
open ↗Referência✓ VexDay Proof
bwired - 'index.php?newsID' SQL Injection
SQL injection vulnerability in index.php in bwired allows remote attackers to execute arbitrary SQL commands via the new
23RISK
open ↗Referência✓ VexDay Proof
PHP-Update 2.7 - '/admin/uploads.php' Remote Code Execution
Unrestricted file upload vulnerability in admin/uploads.php in PHP-Update 2.7 and earlier allows remote authenticated us
23RISK
open ↗Referência✓ VexDay Proof
File Store PRO 3.2 - Multiple Blind SQL Injections
SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Referência✓ VexDay Proof
PHP iCalendar 2.21 - 'publish.ical.php' Remote Code Execution
publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write acce
23RISK
open ↗Referência✓ VexDay Proof
phpunity.postcard - 'gallery_path' Remote File Inclusion
PHP remote file inclusion vulnerability in phpunity-postcard.php in phpunity.postcard allows remote attackers to execute
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.