Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,366cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,740VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Mole Group Rental Script - Authentication Bypass
SQL injection vulnerability in admin/index.php in Mole Group Rental Script allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
JShop 1.x < 2.x - 'xPage' Local File Inclusion
Directory traversal vulnerability in v2demo/page.php in Jshop Server 1.x through 2.x allows remote attackers to include
23RISK
open ↗Referência✓ VexDay Proof
ModernBill 4.4.x - Cross-Site Scripting / Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in ModernBill 4.4 and earlier allow remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Yaws < 1.80 - Multiple Headers Remote Denial of Service Vulnerabilities
Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with
28RISK
open ↗Referência✓ VexDay Proof
Sisfo Kampus 2006 - 'dwoprn.php?f' Arbitrary File Download
Directory traversal vulnerability in dwoprn.php in Sisfo Kampus 2006 (Semarang 3) allows remote attackers to read arbitr
23RISK
open ↗Referência✓ VexDay Proof
PHPKB 1.5 Professional - Multiple SQL Injections
Multiple SQL injection vulnerabilities in PHPKB Knowledge Base Software 1.5 Professional allow remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
TorrentTrader Classic 1.09 - Multiple Vulnerabilities
backup-database.php in TorrentTrader Classic 1.09 does not require administrative authentication, which allows remote at
23RISK
open ↗Referência✓ VexDay Proof
phpWebSite 0.10.0-full - 'topics.php' SQL Injection
SQL injection vulnerability in topics.php in Appalachian State University phpWebSite 0.10.2 and earlier allows remote at
23RISK
open ↗Referência✓ VexDay Proof
OPT Max 1.2.0 - 'CRM_inc' Remote File Inclusion
PHP remote file inclusion vulnerability in include/urights.php in Outreach Project Tool (OPT) Max 1.2.6 and earlier allo
23RISK
open ↗Referência✓ VexDay Proof
phpFullAnnu 5.1 - 'repmod' Remote File Inclusion
PHP remote file inclusion vulnerability in modules/home.module.php in phpFullAnnu 5.1 and earlier allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
Star FTP Server 1.10 - 'RETR' Remote Denial of Service
Fightersoft Multimedia Star FTP server 1.10 allows remote attackers to cause a denial of service (crash) via multiple RE
23RISK
open ↗Referência✓ VexDay Proof
Simple HTTPd 1.38 - Multiple Vulnerabilities
Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI progra
23RISK
open ↗Referência✓ VexDay Proof
Mapbender 2.4.4 - 'gaz' SQL Injection
Multiple SQL injection vulnerabilities in Mapbender 2.4.4 allow remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Referência✓ VexDay Proof
MycroCMS 0.5 - Blind SQL Injection
SQL injection vulnerability in index.php in MycroCMS 0.5, when magic_quotes_gpc is disabled, allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Ascended Guestbook 1.0.0 - 'embedded.php' File Inclusion
PHP remote file inclusion vulnerability in embedded.php in Ascended Guestbook 1.0.0 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
eLineStudio Site Composer (ESC) 2.6 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
Digital Eye CMS 0.1.1b - 'module.php' Remote File Inclusion
PHP remote file inclusion vulnerability in module.php in Digital Eye Gallery 1.1 Beta (aka 0.1.1b) allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
PHP-Fusion Mod Kroax 4.42 - 'category' SQL Injection
SQL injection vulnerability in kroax.php in the Kroax (the_kroax) 4.42 and earlier module for PHP-Fusion allows remote a
23RISK
open ↗Referência✓ VexDay Proof
GeoVision LiveX 8200 - ActiveX 'LIVEX_~1.OCX' File Corruption
Directory traversal vulnerability in the SnapShotToFile method in the GeoVision LiveX (aka LiveX_v8200) ActiveX control
23RISK
open ↗Referência✓ VexDay Proof
falcon CMS 1.4.3 - Remote File Inclusion / Cross-Site Scripting
Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
ScriptMagix Recipes 2.0 - 'index.php?catid' SQL Injection
SQL injection vulnerability in index.php in ScriptMagix Recipes 2.0 and earlier allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Basic-CMS - SQL Injection
SQL injection vulnerability in pages/index.php in BASIC-CMS allows remote attackers to execute arbitrary SQL commands vi
43RISK
open ↗Referência✓ VexDay Proof
Comparison Engine Power 1.0 - Blind SQL Injection
SQL injection vulnerability in product.detail.php in Kalptaru Infotech Comparison Engine Power Script 1.0 allows remote
23RISK
open ↗Referência✓ VexDay Proof
X7 Chat 2.0.1A1 - 'mini.php' Local File Inclusion
Directory traversal vulnerability in help/mini.php in X7 Chat 2.0.1 A1 and earlier allows remote attackers to include an
23RISK
open ↗Referência✓ VexDay Proof
Active PHP Bookmark Notes 0.2.5 - Remote File Inclusion
PHP remote file inclusion vulnerability in templates/head.php in Active PHP Bookmark Notes (APB) 0.2.5 and earlier allow
23RISK
open ↗Referência✓ VexDay Proof
Pakupaku CMS 0.4 - Arbitrary File Upload / Local File Inclusion
Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and ex
23RISK
open ↗Referência✓ VexDay Proof
Apple iTunes 8.1.1 - 'ITMS' Multiple Protocol Handler Buffer Overflow (Metasploit)
Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a deni
43RISK
open ↗Referência✓ VexDay Proof
FreeCMS.us 0.2 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in FreeCMS 0.2 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Referência✓ VexDay Proof
mystats - 'hits.php' Multiple Vulnerabilities
hits.php in myWebland myStats allows remote attackers to bypass IP address restrictions via a modified X-Forwarded-For H
23RISK
open ↗Referência✓ VexDay Proof
ClanLite 2.x - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in service/profil.php in ClanLite 2.2006.05.20 allows remote attackers to execute arbitrary
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.