Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
FTP Voyager 14.0.0.3 - 'CWD' Remote Stack Overflow (PoC)
Stack-based buffer overflow in Rhino Software, Inc. FTP Voyager 14.0.0.3 and earlier allows remote servers to cause a de
23RISK
open ↗Referência✓ VexDay Proof
SuperCali PHP Event Calendar 0.4.0 - SQL Injection
SQL injection vulnerability in index.php in SuperCali PHP Event Calendar 0.4.0 allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
TinyButStrong 3.4.0 - 'script' Local File Disclosure
Directory traversal vulnerability in examples/tbs_us_examples_0view.php in TinyButStrong 3.4.0 allows remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
PHPOF 20040226 - 'DB_adodb.class.php' Remote File Inclusion
PHP remote file inclusion vulnerability in dbmodules/DB_adodb.class.php in PHP Object Framework (PHPOF) 20040226 and ear
23RISK
open ↗Referência✓ VexDay Proof
freeSSHd 1.2.1 - (Authenticated) SFTP 'rename' Remote Buffer Overflow (PoC)
Stack-based buffer overflow in freeSSHd 1.2.1 allows remote authenticated users to cause a denial of service (service cr
28RISK
open ↗Referência✓ VexDay Proof
Social Site Generator 2.0 - 'path' Remote File Inclusion
PHP remote file inclusion vulnerability in social_game_play.php in Social Site Generator (SSG) 2.0 allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
audioCMS arash 0.1.4 - 'arashlib_dir' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in audioCMS arash 0.1.4 allow remote attackers to execute arbitrary P
23RISK
open ↗Referência✓ VexDay Proof
2532/Gigs 1.2.1 - 'activateuser.php' Local File Inclusion
Directory traversal vulnerability in activateuser.php in 2532|Gigs 1.2.1 allows remote attackers to include and execute
23RISK
open ↗Referência✓ VexDay Proof
aflog 1.01 - Multiple Insecure Cookie Handling Vulnerabilities
aflog 1.01 allows remote attackers to bypass authentication and gain administrative access by setting the aflog_auth_a c
23RISK
open ↗Referência✓ VexDay Proof
eMeeting Online Dating Software 5.2 - SQL Injection
Multiple SQL injection vulnerabilities in eMeeting Online Dating Software 5.2 allow remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Internet Explorer - XML Parsing Remote Buffer Overflow
Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet
50RISK
open ↗Referência✓ VexDay Proof
Pligg CMS 9.9.0 - Cross-Site Scripting / Local File Inclusion / SQL Injection
Cross-site scripting (XSS) vulnerability in Pligg 9.9 and earlier allows remote attackers to inject arbitrary web script
23RISK
open ↗Referência✓ VexDay Proof
Easy Scripts Answer and Question Script - Multiple Vulnerabilities
Unrestricted file upload vulnerability in myaccount.php in Easy Scripts Answer and Question Script allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
SiteDepth CMS 3.44 - 'ShowImage.php?name' File Disclosure
Directory traversal vulnerability in ShowImage.php in SiteDepth CMS 3.44 allows remote attackers to read arbitrary files
23RISK
open ↗Referência✓ VexDay Proof
Pictures Rating - 'index.php?msgid' SQL Injection
SQL injection vulnerability in index.php in Pictures Rating (Picture Rating) allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Softbiz Auctions Script - 'product_desc.php' SQL Injection
SQL injection vulnerability in product_desc.php in Softbiz Auctions Script allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
1024 CMS 0.7 - 'download.php' Remote File Disclosure
Directory traversal vulnerability in includes/download.php in Treble Designs 1024 CMS 0.7 allows remote attackers to rea
23RISK
open ↗Referência✓ VexDay Proof
Check New 4.52 - SQL Injection
SQL injection vulnerability in findoffice.php in Check Up New Generation (aka Check New) 4.52, when magic_quotes_gpc is
23RISK
open ↗Referência✓ VexDay Proof
Adobe Reader 8.1.4/9.1 - 'GetAnnots()' Remote Code Execution
The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote
28RISK
open ↗Referência✓ VexDay Proof
Flat PHP Board 1.2 - Multiple Vulnerabilities
Flat PHP Board 1.2 and earlier stores sensitive information under the web root with insufficient access control, which a
23RISK
open ↗Referência✓ VexDay Proof
Grabit 1.7.2 Beta 3 - '.nzb' Local Buffer Overflow (SEH)
Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
SimpleNews 1.0.0 FINAL - 'print.php?news_id' SQL Injection
SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component com_lowcosthotels - Blind SQL Injection
SQL injection vulnerability in the com_lowcosthotels component in the Hotel Booking Reservation System (aka HBS) for Joo
23RISK
open ↗Referência✓ VexDay Proof
32bit FTP (09.04.24) - 'CWD Response' Remote Buffer Overflow
Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a
23RISK
open ↗Referência✓ VexDay Proof
Feindt Computerservice News 2.0 - 'newsadmin.php?action' Remote File Inclusion
PHP remote file inclusion vulnerability in newsadmin.php in Feindt Computerservice News (News-Script) 2.0 allows remote
35RISK
open ↗Referência✓ VexDay Proof
ABC estore 3.0 - 'cat_id' Blind SQL Injection
SQL injection vulnerability in index.php in ABC eStore 3.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
Hexamail Server 3.0.0.001 - 'pop3' Remote Overflow (PoC)
Buffer overflow in the pop3 service in Hexamail Server 3.0.0.001 Lite allows remote attackers to cause a denial of servi
28RISK
open ↗Referência✓ VexDay Proof
cTorrent/DTorrent - '.torrent' Local Buffer Overflow
Stack-based buffer overflow in the btFiles::BuildFromMI function (trunk/btfiles.cpp) in Enhanced CTorrent (aka dTorrent)
28RISK
open ↗Referência✓ VexDay Proof
Joomla! 1.5 Beta1/Beta2/RC1 - SQL Injection
administrator/index.php in the installer component (com_installer) in Joomla! 1.5 Beta1, Beta2, and RC1 allows remote au
23RISK
open ↗Referência✓ VexDay Proof
IDM-OS 1.0 - 'Filename' File Disclosure
Directory traversal vulnerability in administrator/download.php in IDMOS (aka Phoenix) 1.0 allows remote attackers to re
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.