Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
phpDynaSite 3.2.2 - 'racine' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in phpDynaSite 3.2.2 and earlier allow remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
iPrimal Forums - '/admin/index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in (1) index.php and (2) admin/index.php in IPrimal Forums as of 20061105 allows
23RISK
open ↗Referência✓ VexDay Proof
blogme 3.0 - Cross-Site Scripting / Authentication Bypass
Multiple cross-site scripting (XSS) vulnerabilities in comments.asp in BlogMe 3.0 allow remote attackers to inject arbit
23RISK
open ↗Referência✓ VexDay Proof
Songbird Media Player 0.2 - Format String Denial of Service (PoC)
Format string vulnerability in Songbird Media Player 0.2 and earlier allows remote attackers to cause a denial of servic
23RISK
open ↗Referência✓ VexDay Proof
HR Assist 1.05 - 'vdateUsr.asp' Remote Authentication Bypass
SQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
CM68 News 12.02.06 - 'addpth' Remote File Inclusion
PHP remote file inclusion vulnerability in engine/oldnews.inc.php in CM68 News 12.02.06 allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
Gizzar 03162002 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Gizzar 03162002 and earlier allows remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit)
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RISK
open ↗Referência✓ VexDay Proof
vBlog / C12 0.1 - 'cfgProgDir' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Vortex Blog (vBlog, aka C12) a0.1_nonfunc allow remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
TaskTracker 1.5 - 'Customize.asp' Remote Add Administrator
Geckovich TaskTracker Pro 1.5 and earlier allows remote attackers to add administrative or other accounts via an Add act
23RISK
open ↗Referência✓ VexDay Proof
AutoDealer 2.0 - 'detail.asp?iPro' SQL Injection
SQL injection vulnerability in detail.asp in ASP SiteWare autoDealer 2.0 and earlier allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke Module Emporium 2.3.0 - SQL Injection
SQL injection vulnerability in the category file in modules.php in the Emporium 2.3.0 and earlier module for PHP-Nuke al
23RISK
open ↗Referência✓ VexDay Proof
WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting
WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This vulnerability can allo
23RISK
open ↗Referência✓ VexDay Proof
XM Easy Personal FTP Server 5.30 - 'ABOR' Format String Denial of Service
Multiple buffer overflows in XM Easy Personal FTP Server 5.3.0 allow remote attackers to execute arbitrary code via unsp
23RISK
open ↗Referência✓ VexDay Proof
osTicket 1.11 - Cross-Site Scripting / Local File Inclusion
In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.ph
23RISK
open ↗Referência✓ VexDay Proof
pNews 1.1.0 - 'nbs' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/global.php in Joshua Wilson pNews System 1.1.0 (aka PowerNews) allow
23RISK
open ↗Referência✓ VexDay Proof
Enrollment System Project v1.0 - SQL Injection Authentication Bypass (SQLI)
Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to
53RISK
open ↗Referência✓ VexDay Proof
ApowerManager 3.1.7 - Phone Manager Remote Denial of Service (PoC)
The ApowerManager application through 3.1.7 for Android allows remote attackers to cause a denial of service via many si
23RISK
open ↗Referência✓ VexDay Proof
gtcatalog 0.9.1 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Chris Mac gtcatalog (aka GimeScripts Shopping Catalog) 0.9.1 and
23RISK
open ↗Referência✓ VexDay Proof
Scorp Book 1.0 - 'smilies.php?config' Remote File Inclusion
PHP remote file inclusion vulnerability in smilies.php in Scorp Book 1.0 allows remote attackers to execute arbitrary PH
23RISK
open ↗Referência✓ VexDay Proof
Free MP3 CD Ripper 2.6 - '.mp3' Buffer Overflow (SEH)
Stack-based buffer overflow in Free MP3 CD Ripper 2.6, when converting a file, allows user-assisted remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
AirMore 1.6.1 - Denial of Service (PoC)
The AirMore application through 1.6.1 for Android allows remote attackers to cause a denial of service (system hang) via
28RISK
open ↗Referência✓ VexDay Proof
TikiWiki 1.9 Sirius - 'jhot.php' Remote Command Execution
Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execu
50RISK
open ↗Referência✓ VexDay Proof
PHP-revista 1.1.2 - Remote File Inclusion / SQL Injection / Authentication Bypass / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Longino Jacome php-Revista 1.1.2 allow remote attackers to inject
23RISK
open ↗Referência✓ VexDay Proof
PBLang 4.66z - 'temppath' Remote File Inclusion
PHP remote file inclusion vulnerability in templates/pb/language/lang_nl.php in PBLang (PBL) 4.66z and earlier allows re
23RISK
open ↗Referência✓ VexDay Proof
Net_DNS 0.3 - '/DNS/RR.php' Remote File Inclusion
PHP remote file inclusion vulnerability in DNS/RR.php in Net_DNS 0.03 and earlier allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
Sun Board 1.00.00 alpha - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Sun Board 1.00.00 Alpha allow remote attackers to execute arbitrar
45RISK
open ↗Referência✓ VexDay Proof
b1gbb 2.24.0 - 'footer.inc.php?tfooter' Remote File Inclusion
PHP remote file inclusion vulnerability in footer.inc.php in B1G b1gBB 2.24 allows remote attackers to execute arbitrary
45RISK
open ↗Referência✓ VexDay Proof
Prozilla Directory Script - 'Directory.php?cat_id' SQL Injection
Multiple SQL injection vulnerabilities in Prozilla Directory Script allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
Realtor 747 - 'index.php?categoryId' SQL Injection
SQL injection vulnerability in index.php in Realtor 747 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.