Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,328cataloged exploits
40,208CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,716VulnCheck XDB 9,976Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
PHPCollegeExchange 0.1.5c - 'listing_view.php?itemnr' SQL Injection
SQL injection vulnerability in house/listing_view.php in phpCollegeExchange 0.1.5c allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
PacerCMS 0.6 - 'last_module' Remote Code Execution
Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including
28RISK
open ↗Referência✓ VexDay Proof
Xitami Web Server 2.5 - 'If-Modified-Since' Remote Buffer Overflow
Multiple buffer overflows in iMatix Xitami Web Server 2.5c2 allow remote attackers to execute arbitrary code via a long
60RISK
open ↗Referência✓ VexDay Proof
2532/Gigs 1.2.2 Stable - Remote Authentication Bypass
Multiple SQL injection vulnerabilities in checkuser.php in 2532designs 2532|Gigs 1.2.2 Stable, when magic_quotes_gpc is
23RISK
open ↗Referência✓ VexDay Proof
impleo music Collection 2.0 - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in admin/login.php in Impleo Music Collection 2.0, when magic_quotes_gpc is disabled, allows
23RISK
open ↗Referência✓ VexDay Proof
Motorola Timbuktu Pro 8.6.5/8.7 - Directory Traversal / Log Injection
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu P
50RISK
open ↗Referência✓ VexDay Proof
AJ Article 1.0 - Remote Authentication Bypass
AJ Square AJ Article allows remote attackers to bypass authentication and access administrator functionality via a direc
23RISK
open ↗Referência✓ VexDay Proof
TorrentTrader Classic 1.09 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows RSH daemon 1.7 - Remote Buffer Overflow
Stack-based buffer overflow in Mike Dubman Windows RSH daemon (rshd) 1.7 allows remote attackers to execute arbitrary co
28RISK
open ↗Referência✓ VexDay Proof
Confixx Pro 3.3.1 - 'saveserver.php' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/business_inc/saveserver.php in SWSoft Confixx Pro 2.0.12 through 3.3.1
23RISK
open ↗Referência✓ VexDay Proof
awzMB 4.2 Beta 1 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in awzMB 4.2 beta 1 and earlier allow remote attackers to execute arb
28RISK
open ↗Referência✓ VexDay Proof
Star Articles 6.0 - Blind SQL Injection (2)
Multiple SQL injection vulnerabilities in Kalptaru Infotech Ltd. Star Articles 6.0 allow remote attackers to inject arbi
23RISK
open ↗Referência✓ VexDay Proof
Campsite 3.3.0 RC1 - Multiple Remote File Inclusions
Directory traversal vulnerability in admin-files/ad.php in Campsite 3.3.0 RC1 allows remote attackers to read and possib
23RISK
open ↗Referência✓ VexDay Proof
PHP123 Top Sites - 'category.php?cat' SQL Injection
SQL injection vulnerability in category.php in PHP123 Top Sites allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
Docebo 3.5.0.3 - '/lib.regset.php/non-blind' SQL Injection
SQL injection vulnerability in the autoDetectRegion function in doceboCore/lib/lib.regset.php in Docebo 3.5.0.3 and earl
23RISK
open ↗Referência✓ VexDay Proof
Apple QuickTime 7.2/7.3 - RTSP Response Remote Overwrite (SEH)
Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac
50RISK
open ↗Referência✓ VexDay Proof
SunOS 5.10 Sun Cluster - 'rpc.metad' Denial of Service (PoC)
rpc.metad in Sun Solaris 10 allows remote attackers to cause a denial of service (daemon crash) via a malformed RPC requ
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Nice Talk 0.9.3 - 'tagid' SQL Injection
SQL injection vulnerability in index.php in the Nice Talk component (com_nicetalk) 0.9.3 and earlier for Joomla! allows
23RISK
open ↗Referência✓ VexDay Proof
ftp Admin 0.1.0 - Local File Inclusion / Cross-Site Scripting / Authentication Bypass
index.php in FTP Admin 0.1.0 allows remote attackers to bypass authentication and obtain administrative access via a log
23RISK
open ↗Referência✓ VexDay Proof
Online Media Technologies 'AVSMJPEGFILE.DLL 1.1' - Remote Buffer Overflow (PoC)
Buffer overflow in a certain ActiveX control in Online Media Technologies AVSMJPEGFILE.DLL 1.1.1.102 allows remote attac
28RISK
open ↗Referência✓ VexDay Proof
CPCommerce 1.1.0 - Cross-Site Scripting / Local File Inclusion
Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Online Fantasy Football League (OFFL) 0.2.6 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Online Fantasy Football League (OFFL) 0.2.6 allow remote attackers
35RISK
open ↗Referência✓ VexDay Proof
Microsoft Office 2003 - '.wps' Local Stack Overflow (MS08-011)
Stack-based buffer overflow in wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Wor
35RISK
open ↗Referência✓ VexDay Proof
smbftpd 0.96 - SMBDirList-function Remote Format String
Format string vulnerability in the SMBDirList function in dirlist.c in SmbFTPD 0.96 allows remote attackers to execute a
28RISK
open ↗Referência✓ VexDay Proof
CMSimple 3.1 - Local File Inclusion / Arbitrary File Upload
Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote a
43RISK
open ↗Referência✓ VexDay Proof
Joomla! Component iJoomla! News Portal 1.0 - 'itemID' SQL Injection
SQL injection vulnerability in the iJoomla News Portal (com_news_portal) component 1.0 and earlier for Joomla! allows re
23RISK
open ↗Referência✓ VexDay Proof
PHP wcms XT 0.0.7 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in phpWCMS XT 0.0.7 BETA and earlier allow remote attackers to execut
35RISK
open ↗Referência✓ VexDay Proof
Telephone Directory 2008 - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in edit1.php in Telephone Directory 2008 allows remote attackers to inject arbi
23RISK
open ↗Referência✓ VexDay Proof
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that ge
45RISK
open ↗Referência✓ VexDay Proof
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH (Ruby)
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that ge
45RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.