Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,231cataloged exploits
40,195CVEs with public exploitation
24,696lab-tested
AllReferência 26,069Exploit-DB 24,488GitHub PoC 17,620VulnCheck XDB 9,976Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Total Video Player 1.20 - '.m3u' File Local Stack Buffer Overflow
Stack-based buffer overflow in iTinySoft Studio Total Video Player 1.03, and possibly earlier, allows remote attackers t
28RISK
open ↗Referência✓ VexDay Proof
Social Engine 2.0 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in Social Engine 2.0 allow remote attackers to include and execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
TFT Gallery 0.10 - Password Disclosure
TFT Gallery 0.10 stores sensitive information under the web root with insufficient access control, which allows remote a
23RISK
open ↗Referência✓ VexDay Proof
PHPMyDesk 1.0 Beta - 'viewticket.php' Local File Inclusion
Directory traversal vulnerability in pmd-config.php in PHPMyDesk 1.0beta allows remote attackers to include arbitrary lo
23RISK
open ↗Referência✓ VexDay Proof
Vastal I-Tech MMORPG Zone - 'game_id' SQL Injection
SQL injection vulnerability in game.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
ESPG (Enhanced Simple PHP Gallery) 1.72 - File Disclosure
Directory traversal vulnerability in gallery/comment.php in Enhanced Simple PHP Gallery (ESPG) 1.72 allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
FCRing 1.31 - 'fcring.php?s_fuss' Remote File Inclusion
PHP remote file inclusion vulnerability in fcring.php in FCRing 1.3 allows remote attackers to execute arbitrary PHP cod
23RISK
open ↗Referência✓ VexDay Proof
FlashBlog - 'articulo_id' SQL Injection
SQL injection vulnerability in php/leer_comentarios.php in FlashBlog allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
TorrentTrader Classic 1.04 - Blind SQL Injection
SQL injection vulnerability in completed-advance.php in TorrentTrader Classic 1.08 and 1.04 and earlier allows remote at
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component acctexp 0.12.x - Blind SQL Injection
SQL injection vulnerability in the acctexp (com_acctexp) component 0.12.x and earlier for Joomla! allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
Fastpublish CMS 1.9999 - Local File Inclusion / SQL Injection
Multiple SQL injection vulnerabilities in Fastpublish CMS 1.9.9.9.9 d (1.9999 d) allow remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
PHP-Fusion Mod raidtracker_panel - 'INFO_RAID_ID' SQL Injection
SQL injection vulnerability in thisraidprogress.php in the World of Warcraft tracker infusion (raidtracker_panel) module
23RISK
open ↗Referência✓ VexDay Proof
Pre News Manager 1.0 - 'id' SQL Injection
SQL injection vulnerability in Pre News Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the (1
23RISK
open ↗Referência✓ VexDay Proof
SAPID 1.2.3.05 - 'ROOT_PATH' Remote File Inclusion
PHP remote file inclusion vulnerability in SAPID CMS 123 rc3 allows remote attackers to execute arbitrary PHP code via a
23RISK
open ↗Referência✓ VexDay Proof
NoAh 0.9 pre 1.2 - 'filepath' Remote File Disclosure
Multiple directory traversal vulnerabilities in PHP Content Architect (aka NoAh) 0.9 pre 1.2 and earlier allow remote at
23RISK
open ↗Referência✓ VexDay Proof
I-Pos Internet Pay Online Store 1.3 Beta - SQL Injection
SQL injection vulnerability in index.asp in I-Pos Internet Pay Online Store 1.3 Beta and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
asiCMS alpha 0.208 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in asiCMS alpha 0.208 allow remote attackers to execute arbitrary PHP
23RISK
open ↗Referência✓ VexDay Proof
MyKtools 2.4 - Arbitrary Database Backup
mykdownload.php in MyKtools 2.4 does not require administrative authentication, which allows remote attackers to read a
23RISK
open ↗Referência✓ VexDay Proof
Rama CMS 0.9.8 - 'download.php' File Disclosure
Directory traversal vulnerability in download.php in Rama Zaiten CMS 0.9.8 and earlier allows remote attackers to read a
23RISK
open ↗Referência✓ VexDay Proof
Censtore 7.3.x - 'censtore.cgi' Remote Command Execution
censtore.cgi in Censtore 7.3.002 and earlier allows remote attackers to execute arbitrary commands via shell metacharact
23RISK
open ↗Referência✓ VexDay Proof
Insanely Simple Blog 0.5 - SQL Injection
Multiple SQL injection vulnerabilities in index.php in Insanely Simple Blog 0.5 allow remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
Built2Go PHP Movie Review 2B - Remote File Inclusion
PHP remote file inclusion vulnerability in movie_cls.php in Built2Go PHP Movie Review 2B and earlier allows remote attac
23RISK
open ↗Referência✓ VexDay Proof
reSIProcate 1.3.2 - Remote Denial of Service (PoC)
rutil/dns/DnsStub.cxx in ReSIProcate 1.3.2, as used by repro, allows remote attackers to cause a denial of service (daem
23RISK
open ↗Referência✓ VexDay Proof
CCMS 3.1 - 'skin' Local File Inclusion
Multiple directory traversal vulnerabilities in CCMS 3.1 allow remote attackers to include and execute arbitrary local f
23RISK
open ↗Referência✓ VexDay Proof
mg.applanix 1.3.1 - 'apx_root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in mg.applanix 1.3.1 and earlier allow remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
News-Letterman 1.1 - 'eintrag.php?sqllog' Remote File Inclusion
PHP remote file inclusion vulnerability in eintrag.php in Weltennetz News-Letterman 1.1 allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
PHP < 4.4.5/5.2.1 - 'shmop' Local Code Execution
The shmop functions in PHP before 4.4.5, and before 5.2.1 in the 5.x series, do not verify that their arguments correspo
28RISK
open ↗Referência✓ VexDay Proof
Joomla! Component imagebrowser 0.1.5 rc2 - Directory Traversal
Directory traversal vulnerability in the Image Browser (com_imagebrowser) 0.1.5 component for Joomla! allows remote atta
43RISK
open ↗Referência✓ VexDay Proof
ItCMS 2.1a - Authentication Bypass
SQL injection vulnerability in login.php in IT!CMS 2.1a and earlier allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
netForo! 0.1 - 'down.php?file_to_download' Remote File Disclosure
Directory traversal vulnerability in down.php in netForo! 0.1g allows remote attackers to read arbitrary files via a ..
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.