Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,378cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,752VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Family Connections CMS 1.4 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated user
23RISK
open ↗Referência✓ VexDay Proof
Mini Blog 1.0.1 - 'index.php' Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in index.php in Mini Blog 1.0.1 allow remote attackers to include and execu
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module Rha7 Downloads 1.0 - 'visit.php' SQL Injection
SQL injection vulnerability in visit.php in the Rha7 Downloads (rha7downloads) 1.0 module for XOOPS, and possibly other
23RISK
open ↗Referência✓ VexDay Proof
Konqueror 3.5.9 - 'color'/'bgcolor' Multiple Remote Crash Vulnerabilities
The HTML parser in KDE Konqueror 3.5.9 allows remote attackers to cause a denial of service (application crash) via (1)
23RISK
open ↗Referência✓ VexDay Proof
AJ Auction - Authentication Bypass
AJ Square AJ Auction Pro Platinum Skin #1 sends a redirect but does not exit when it is called directly, which allows re
23RISK
open ↗Referência✓ VexDay Proof
Connectix Boards 0.8.2 - 'template_path' Remote File Inclusion
PHP remote file inclusion vulnerability in templates/Official/part_userprofile.php in Connectix Boards 0.8.2 and earlier
23RISK
open ↗Referência✓ VexDay Proof
ProManager 0.73 - 'config.php' Local File Inclusion
Directory traversal vulnerability in inc/config.php in ProManager 0.73 allows remote attackers to include and execute ar
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component zOOm Media Gallery 2.5 Beta 2 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the com_zoom 2.5 beta 2 and earlier module for Mambo allow remote
23RISK
open ↗Referência✓ VexDay Proof
jaxultrabb 2.0 - Local File Inclusion / Cross-Site Scripting
Directory traversal vulnerability in viewprofile.php in JaxUltraBB 2.0 and earlier allows remote attackers to read arbit
23RISK
open ↗Referência✓ VexDay Proof
Weatimages 1.7.1 - ini[langpack] Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Weatimages 1.7.1 and earlier, when weatimages.ini is missing, al
23RISK
open ↗Referência✓ VexDay Proof
PHPWebGallery 1.3.4 - Cross-Site Scripting / Local File Inclusion
Multiple directory traversal vulnerabilities in PhpWebGallery 1.3.4 allow remote attackers to include and execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
InoutMailingListManager 3.1 - Remote Command Execution
InoutMailingListManager 3.1 and earlier allows remote attackers to access certain restricted functionality, and upload a
23RISK
open ↗Referência✓ VexDay Proof
doop CMS 1.3.7 - Local File Inclusion
Directory traversal vulnerability in doop CMS 1.3.7 and earlier allows remote attackers to include and execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
WorkSimple 1.2.1 - Remote File Inclusion / Sensitive Data Disclosure
PHP remote file inclusion vulnerability in calendar.php in WorkSimple 1.2.1, when register_globals is enabled, allows re
35RISK
open ↗Referência✓ VexDay Proof
iScripts Socialware - 'id' SQL Injection
iScripts SocialWare stores passwords in cleartext in a database, which allows context-dependent attackers to obtain sens
23RISK
open ↗Referência✓ VexDay Proof
Joomla! / Mambo Component Taskhopper 1.1 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the Taskhopper 1.1 component for Mambo and Joomla! allow remote at
23RISK
open ↗Referência✓ VexDay Proof
BtiTracker 1.4.7 / xbtit 2.0.542 - SQL Injection
SQL injection vulnerability in scrape.php in BtiTracker 1.4.7 and earlier and xBtiTracker 2.0.542 and earlier allows rem
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component PAX Gallery 0.1 - Blind SQL Injection
SQL injection vulnerability in the PaxGallery (com_paxgallery) component 0.1 for Joomla! allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
pl-PHP Beta 0.9 - Multiple Vulnerabilities
admin.php in pL-PHP beta 0.9 allows remote attackers to bypass authentication by setting the is_admin parameter to 1.
23RISK
open ↗Referência✓ VexDay Proof
Aqua CMS - 'Username' SQL Injection
Multiple SQL injection vulnerabilities in Aqua CMS 1.1, when magic_quotes_gpc is disabled, allow remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
PEEL CMS 3.x - Admin Hash Extraction / Arbitrary File Upload
PEEL, possibly 3.x and earlier, allows remote attackers to obtain configuration information via a direct request to phpi
23RISK
open ↗Referência✓ VexDay Proof
vhostadmin 0.1 - 'MODULES_DIR' Remote File Inclusion
PHP remote file inclusion vulnerability in modules/mail/main.php in Inter7 vHostAdmin 1.0 allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
Zomplog 3.8.2 - 'newuser.php' Arbitrary Add Admin
Zomplog 3.8.2 and earlier allows remote attackers to gain administrative access by creating an admin account via a direc
23RISK
open ↗Referência✓ VexDay Proof
clickandemail - SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in ClickAndEmail allow remote attackers to execute arbitrary SQL commands via (1)
23RISK
open ↗Referência✓ VexDay Proof
webid 0.5.4 - Multiple Vulnerabilities
WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, which allow
23RISK
open ↗Referência✓ VexDay Proof
RM Downloader 3.0.0.9 - '.m3u' Universal Stack Overflow
Stack-based buffer overflow in Mini-stream RM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a
23RISK
open ↗Referência✓ VexDay Proof
jGallery 1.3 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in jGallery 1.3 allows remote attackers to execute arbitrary PHP co
23RISK
open ↗Referência✓ VexDay Proof
JChit counter 1.0.0 - 'imgsrv.php?ac' Remote File Disclosure
Directory traversal vulnerability in imgsrv.php in jchit counter 1.0.0 allows remote attackers to read arbitrary files v
23RISK
open ↗Referência✓ VexDay Proof
Squirrelcart 1.x - 'cart.php' Remote File Inclusion
PHP remote file inclusion vulnerability in popup_window.php in Squirrelcart 1.x.x and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
WebAlbum 2.02pl - COOKIE[skin2] Remote Code Execution
Directory traversal vulnerability in start.php in WebAlbum 2.02 allows remote attackers to include arbitrary files and e
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.