Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
PHP Live Helper 2.0.1 - Multiple Vulnerabilities
SQL injection vulnerability in onlinestatus_html.php in Turnkey PHP Live Helper 2.0.1 and earlier allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
Webfwlog 0.92 - 'debug.php' Remote File Disclosure
include/debug.php in Webfwlog 0.92 and earlier, when register_globals is enabled, allows remote attackers to obtain sour
23RISK
open ↗Referência✓ VexDay Proof
CMS WebManager-Pro - Multiple SQL Injections
Multiple SQL injection vulnerabilities in index.php in CMS WebManager-Pro allow remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
PHP Classifieds Script - Remote Database Disclosure
Team PHP PHP Classifieds Script stores sensitive information under the web root with insufficient access control, which
23RISK
open ↗Referência✓ VexDay Proof
Vastal I-Tech Shaadi Zone 1.0.9 - 'tage' SQL Injection
SQL injection vulnerability in keyword_search_action.php in Vastal I-Tech Shaadi Zone 1.0.9 allows remote attackers to e
23RISK
open ↗Referência✓ VexDay Proof
PHPRecipeBook 2.35 - 'g_rb_basedir' Remote File Inclusion
PHP remote file inclusion vulnerability in classes/Import_MM.class.php in PHPRecipeBook 2.36, when register_globals is e
23RISK
open ↗Referência✓ VexDay Proof
MyAlbum 3.02 - 'language.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in language.inc.php in MyAlbum 3.02 and earlier allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
ItCMS 1.9 - 'boxpop.php' Remote Code Execution
Static code injection vulnerability in box/minichat/boxpop.php in IT!CMS (aka itcms) 1.9 allows remote attackers to inje
23RISK
open ↗Referência✓ VexDay Proof
PHP Jokesite 2.0 - 'cat_id' SQL Injection
SQL injection vulnerability in jokes_category.php in PHP-Jokesite 2.0 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
Brim 2.0.0 - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in the Tasks plugin in Brim 2.0.0, when magic_quotes_gpc is disabled, allows remote authenti
23RISK
open ↗Referência✓ VexDay Proof
Google Chrome - 'ChromeHTML://' Remote Parameter Injection
Argument injection vulnerability in Google Chrome 1.0.154.36 on Windows XP SP3 allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
Siemens C450IP/C475IP - Remote Denial of Service
Siemens C450 IP and C475 IP VoIP devices allow remote attackers to cause a denial of service (disconnected calls and dev
23RISK
open ↗Referência✓ VexDay Proof
acFTP FTP Server 1.4 - 'USER' Remote Buffer Overflow (PoC)
acFTP 1.4 allows remote attackers to cause a denial of service (application crash) via a long string with "{" (brace) ch
23RISK
open ↗Referência✓ VexDay Proof
Page Manager CMS 2006-02-04 - Arbitrary File Upload
Unrestricted file upload vulnerability in upload.php in Page Manager 2006-02-04 allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
@lex Guestbook 4.0.2 - Remote Command Execution
Directory traversal vulnerability in admin/skins.php for @lex Guestbook 4.0.2 and earlier allows remote attackers to cre
23RISK
open ↗Referência✓ VexDay Proof
Woltlab Burning Board 1.0.2/2.3.6 - 'search.php' SQL Injection (1)
SQL injection vulnerability in search.php in Woltlab Burning Board (wBB) 1.0.2 and earlier, and 2.3.6 and earlier in the
23RISK
open ↗Referência✓ VexDay Proof
FlashChat 4.5.7 - 'aedating4CMS.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in FlashChat before 4.6.2 allow remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Diesel Joke Site - 'picture_category.php' SQL Injection
SQL injection vulnerability in picture_category.php in Diesel Joke Site allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Bradabra 2.0.5 - '/include/includes.php' Remote File Inclusion
PHP remote file inclusion vulnerability in include/includes.php in Bradabra 2.0.5 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
makit Newsposter Script 3.0 - SQL Injection
SQL injection vulnerability in news_page.asp in Martyn Kilbryde Newsposter Script (aka makit news/blog poster) 3 and ear
23RISK
open ↗Referência✓ VexDay Proof
bloofox 0.3 - SQL Injection / File Disclosure
Directory traversal vulnerability in file.php in bloofoxCMS 0.3 allows remote attackers to read arbitrary files via a ..
23RISK
open ↗Referência✓ VexDay Proof
Acidcat CMS 3.4.1 - Multiple Vulnerabilities
Acidcat CMS 3.4.1 does not restrict access to the FCKEditor component, which allows remote attackers to upload arbitrary
23RISK
open ↗Referência✓ VexDay Proof
@lex Guestbook 4.0.2 - Remote Command Execution
SQL injection vulnerability in index.php in @lex Guestbook 4.0.2 and earlier, when magic_quotes_gpc is disabled, allows
23RISK
open ↗Referência✓ VexDay Proof
Integramod 1.4.x - Insecure Directory Download Database
IntegraMOD 1.4.x stores sensitive information under the web root with insufficient access control, which allows remote a
23RISK
open ↗Referência✓ VexDay Proof
GuppY 4.5.16 - Remote Command Execution
Multiple static code injection vulnerabilities in error.php in GuppY 4.5.16 and earlier allow remote attackers to inject
23RISK
open ↗Referência✓ VexDay Proof
EDraw Flowchart ActiveX Control 2.0 - Insecure Method
Absolute path traversal vulnerability in the EDraw Flowchart ActiveX control in EDImage.ocx 2.0.2005.1104 allows remote
23RISK
open ↗Referência✓ VexDay Proof
Google Chrome 0.2.149.27 - Inspect Element Denial of Service
Google Chrome 0.2.149.27 allows user-assisted remote attackers to cause a denial of service (browser crash) via an IMG t
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Internet Explorer 7 - Memory Corruption (PoC) (MS09-002)
Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows r
60RISK
open ↗Referência✓ VexDay Proof
Weblosninger 4 - Cross-Site Scripting / SQL Injection
Multiple SQL injection vulnerabilities in Simpel Side Weblosning 1 through 4 allow remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
FlashGet 1.9.0.1012 - 'FTP PWD Response' Remote Buffer Overflow (SafeSEH)
Buffer overflow in FlashGet (formerly JetCar) FTP 1.9 allows remote FTP servers to execute arbitrary code via a long res
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.