Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,305cataloged exploits
36,465CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,466Referência 23,051GitHub PoC 15,051VulnCheck XDB 8,883Nuclei 4,361Metasploit 3,493✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Lito Lite CMS - 'cid' SQL Injection
SQL injection vulnerability in cate.php in Lito Lite CMS, when magic_quotes_gpc is disabled, allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Myiosoft EasyBookMarker 4 - 'Parent' SQL Injection
SQL injection vulnerability in plugins/bookmarker/bookmarker_backend.php in MyioSoft EasyBookMarker 4.0 allows remote at
23RISK
open ↗Referência✓ VexDay Proof
ASP Message Board 2.2.1c - SQL Injection
SQL injection vulnerability in boards/printer.asp in ASP Message Board 2.2.1c allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
PHP Simple Shop 2.0 - 'abs_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools PHP Simple Shop 2.0 and earlier allow remote att
28RISK
open ↗Referência✓ VexDay Proof
GuppY 4.6.3 - 'index.php?selskin' Remote File Inclusion
Directory traversal vulnerability in error.php in GuppY 4.6.3, 4.5.16, and earlier allows remote attackers to include an
23RISK
open ↗Referência✓ VexDay Proof
jPORTAL 2 - 'mailer.php' SQL Injection
SQL injection vulnerability in mailer.php in jPORTAL 2 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Referência✓ VexDay Proof
Adobe Shockwave - 'ShockwaveVersion()' Stack Overflow (PoC)
Stack-based buffer overflow in the SWCtl.SWCtl ActiveX control in Adobe Shockwave allows remote attackers to cause a den
35RISK
open ↗Referência✓ VexDay Proof
X.Org xorg-server 1.1.1-48.13 - Probe for Files (PoC)
X.Org Xserver before 1.4.1 allows local users to determine the existence of arbitrary files via a filename argument in t
23RISK
open ↗Referência✓ VexDay Proof
ASPired2Quote - Remote Database Disclosure
The Net Guys ASPired2Quote stores sensitive information under the web root with insufficient access control, which allow
23RISK
open ↗Referência✓ VexDay Proof
NEWSolved Lite 1.9.2 - 'abs_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in USOLVED NEWSolved Lite 1.9.2, and possibly earlier, allow remote a
28RISK
open ↗Referência✓ VexDay Proof
TSEP 0.942 - 'colorswitch.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Olaf Noehring The Search Engine Project (TSEP) 0.942 and earlier a
23RISK
open ↗Referência✓ VexDay Proof
4Images 1.7.x - 'search.php' SQL Injection
SQL injection vulnerability in search.php in 4images 1.7.x allows remote authenticated users to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
vsftpd 2.0.5 - 'CWD' (Authenticated) Remote Memory Consumption
Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux (RHEL) 5 and Fedora 6 throug
28RISK
open ↗Referência✓ VexDay Proof
jPORTAL 2.3.1 - 'articles.php' SQL Injection
SQL injection vulnerability in articles.php in JPortal 2.3.1 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
Softbiz Banner Exchange Network Script 1.0 - SQL Injection
SQL injection vulnerability in campaign_stats.php in Softbiz Banner Exchange Network Script 1.0 allows remote authentica
23RISK
open ↗Referência✓ VexDay Proof
SAPID Shop 1.2 - 'ROOT_PATH' Remote File Inclusion
PHP remote file inclusion vulnerability in usr/extensions/get_tree.inc.php in Dmitry Sheiko SAPID Shop 1.2 and earlier a
23RISK
open ↗Referência✓ VexDay Proof
wbstreet 1.0 - SQL Injection / File Disclosure
SQL injection vulnerability in show.php in Wbstreet (aka PHPSTREET Webboard) 1.0 allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
Ocean12 Mailing List Manager Gold - File Disclosure / SQL Injection / Cross-Site Scripting
Ocean12 Mailing List Manager Gold stores sensitive data under the web root with insufficient access control, which allow
23RISK
open ↗Referência✓ VexDay Proof
barcodegen 2.0.0 - Local File Inclusion
Directory traversal vulnerability in image.php in Barcode Generator 1D (barcodegen) 2.0.0 and earlier allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
IncCMS Core 1.0.0 - 'settings.php' Remote File Inclusion
PHP remote file inclusion vulnerability in inc/settings.php in IncCMS Core 1.0.0 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
SAPID Blog Beta 2 - 'ROOT_PATH' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Csaba Godor SAPID Blog Beta 2 and earlier allow remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Tech Article 1.x - SQL Injection
SQL injection vulnerability in the Tech Articles (com_tech_article) 1.0 component for Joomla! allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
YenerTurk Haber Script 1.0 - SQL Injection
SQL injection vulnerability in default.asp in YenerTurk Haber Script 1.0 and earlier allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
CLUB-Nuke [XP] 2.0 LCID 2048 (Turkish Version) - SQL Injection
Multiple SQL injection vulnerabilities in Club-Nuke [XP] 2.0 LCID 2048 allow remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
WebBiscuits Modules Controller 1.1 - Remote File Inclusion / Remote File Disclosure
PHP remote file inclusion vulnerability in adminhead.php in WebBiscuits Modules Controller 1.1 and earlier allows remote
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component JD-Wiki 1.0.2 - Remote File Inclusion
PHP remote file inclusion vulnerability in lib/tpl/default/main.php in the JD-Wiki Component (com_jd-wiki) 1.0.2 and ear
23RISK
open ↗Referência✓ VexDay Proof
SuperNET Shop 1.0 - SQL Injection
Multiple SQL injection vulnerabilities in SuperNET Shop 1.0 and earlier allow remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
SQLiteWebAdmin 0.1 - 'tpl.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in tpl.inc.php in Falko Timme and Till Brehm SQLiteWebAdmin 0.1 and earlier allo
23RISK
open ↗Referência✓ VexDay Proof
phNNTP 1.3 - 'article-raw.php' Remote File Inclusion
PHP remote file inclusion vulnerability in article-raw.php in Jason Alexander phNNTP 1.3 and earlier allows remote attac
23RISK
open ↗Referência✓ VexDay Proof
JaxUltraBB 2.0 - 'delete.php' Remote Auto Deface
Direct static code injection vulnerability in delete.php in JaxUltraBB (JUBB) 2.0, when register_globals is enabled, all
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.