Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,305cataloged exploits
36,465CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,466Referência 23,051GitHub PoC 15,051VulnCheck XDB 8,883Nuclei 4,361Metasploit 3,493✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Solaris 8/9/10 - 'fifofs I_PEEK' Local Kernel Memory Leak
Integer signedness error in FIFO filesystems (named pipes) on Sun Solaris 8 through 10 allows local users to read the co
23RISK
open ↗Referência✓ VexDay Proof
PMOS Help Desk 2.4 - Remote Command Execution
form.php in PMOS Help Desk 2.4 and earlier sends a redirect to the web browser but does not exit, which allows remote at
23RISK
open ↗Referência✓ VexDay Proof
Scout Portal Toolkit 1.4.0 - 'ParentId' SQL Injection
Multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
WordPress Plugin Wordspew - SQL Injection
SQL injection vulnerability in wordspew-rss.php in the Wordspew plugin before 3.72 for Wordpress allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
CentiPaid 1.4.2 - 'centipaid_class.php' Remote File Inclusion
PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.2 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Weblogicnet - 'files_dir' Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Weblogicnet allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗Referência✓ VexDay Proof
Cplinks 1.03 - Authentication Bypass / SQL Injection / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in search.php in cpLinks 1.03 allow remote attackers to inject arbit
23RISK
open ↗Referência✓ VexDay Proof
NULL FTP Server 1.1.0.7 - 'Site' Command Injection
Incomplete blacklist vulnerability in NULL FTP Server Free and Pro 1.1.0.7 allows remote authenticated users to execute
23RISK
open ↗Referência✓ VexDay Proof
DFF PHP Framework API - 'Data Feed File' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in DataFeedFile (DFF) PHP Framework API allow remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
PHP-Fusion Mod Classifieds - 'lid' SQL Injection
SQL injection vulnerability in classifieds.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Referência✓ VexDay Proof
TurnkeyForms Web Hosting Directory - Multiple Vulnerabilities
TurnkeyForms Web Hosting Directory stores sensitive information under the web root with insufficient access control, whi
23RISK
open ↗Referência✓ VexDay Proof
pivot 1.40.4-7 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.40.4 and 1.40.7 allow remote attackers to inject arbitrar
23RISK
open ↗Referência✓ VexDay Proof
MailEnable 3.13 SMTP Service - 'VRFY/EXPN' Denial of Service
Multiple unspecified vulnerabilities in the SMTP service in MailEnable Standard Edition 1.x, Professional Edition 3.x an
23RISK
open ↗Referência✓ VexDay Proof
WebCalendar 0.9.45 - 'includedir' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in WebCalendar 0.9.45 allow remote attackers to execute arbitrary PHP
23RISK
open ↗Referência✓ VexDay Proof
zKup CMS 2.0 < 2.3 - Arbitrary File Upload
Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
Student Study Center Management System v1.0 - Stored Cross-Site Scripting (XSS)
Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the "Admin Name" f
23RISK
open ↗Referência✓ VexDay Proof
WebCards 1.3 - SQL Injection
Unrestricted file upload vulnerability in the "Add Image Macro" feature in WebCards 1.3 allows remote authenticated admi
23RISK
open ↗Referência✓ VexDay Proof
work system E-Commerce 3.0.5 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in WORK system e-commerce 3.0.5 and earlier allow remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Viewpoint Media Player for IE 3.2 - Remote Stack Overflow (PoC)
Multiple stack-based buffer overflows in the AxMetaStream ActiveX control in AxMetaStream.dll 3.3.2.26 in Viewpoint Medi
23RISK
open ↗Referência✓ VexDay Proof
Quake 3 Engine 1.32b - 'R_RemapShader()' Remote Client Buffer Overflow
Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Castle Wolfenstein 1.41, and (3) Quake III
23RISK
open ↗Referência✓ VexDay Proof
EMO Realty Manager - 'ida' SQL Injection
SQL injection vulnerability in news.php in EMO Realty Manager allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
phpBB User Viewed Posts Tracker 1.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/functions_user_viewed_posts.php in the Nivisec User Viewed Posts Tra
23RISK
open ↗Referência✓ VexDay Proof
X-Forum 0.6.2 - Remote Command Execution
Static code injection vulnerability in X-Forum 0.6.2 allows remote authenticated administrators to inject arbitrary PHP
23RISK
open ↗Referência✓ VexDay Proof
MiniBB 2.0.5 - 'Language' Local File Inclusion
Directory traversal vulnerability in index.php in MiniBB 2.0.5 allows remote attackers to read arbitrary files via a ..
23RISK
open ↗Referência✓ VexDay Proof
Freelance Auction Script 1.0 - 'browseproject.php' SQL Injection
SQL injection vulnerability in browseproject.php in Freelance Auction Script 1.0 allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Internet Explorer - MDAC Remote Code Execution (MS06-014)
Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and dis
60RISK
open ↗Referência✓ VexDay Proof
Etomite CMS 0.6.1 - 'rfiles.php' Remote Command Execution
Unrestricted file upload vulnerability in manager/media/ibrowser/scripts/rfiles.php in Etomite CMS 0.6.1 and earlier all
23RISK
open ↗Referência✓ VexDay Proof
PHP-Stats 0.1.9.2 - Multiple Vulnerabilities
Multiple eval injection vulnerabilities in Php-Stats 0.1.9.2 allow remote authenticated administrators to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
AllMyGuests 0.4.1 - 'cfg_serverpath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in AllMyGuests 0.4.1 and earlier allow remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
68 Classifieds 4.0 - 'category.php' SQL Injection
SQL injection vulnerability in category.php in 68 Classifieds 4.0.1 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.