Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,388cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
PPLive 1.9.21 - '/LoadModule' URI Handlers Argument Injection
Multiple argument injection vulnerabilities in PPLive.exe in PPLive 1.9.21 and earlier allow remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
TemaTres 1.0.3 - Authentication Bypass / SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magic_quotes_gpc is disabled, allow remote atta
23RISK
open ↗Referência✓ VexDay Proof
PHP Live Helper 2.0.1 - Multiple Vulnerabilities
Variable overwrite vulnerability in libsecure.php in Turnkey PHP Live Helper 2.0.1 and earlier, when register_globals is
23RISK
open ↗Referência✓ VexDay Proof
nuseo PHP enterprise 1.6 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin/nuseo_admin_d.php in NuSEO PHP Enterprise 1.6 (NuSEO.PHP), when registe
23RISK
open ↗Referência✓ VexDay Proof
TlGuestBook 1.2 - Insecure Cookie Handling
TlGuestBook 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlGuestBo
23RISK
open ↗Referência✓ VexDay Proof
Apache Geronimo 2.1.3 - Multiple Directory Traversal Vulnerabilities
Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1
35RISK
open ↗Referência✓ VexDay Proof
mini-pub 0.3 - Local Directory Traversal / File Disclosure
Absolute path traversal vulnerability in front-end/dir.php in mini-pub 0.3 and earlier allows remote attackers to list a
23RISK
open ↗Referência✓ VexDay Proof
MyPicGallery 1.0 - Arbitrary Add Admin
MyPicGallery 1.0 allows remote attackers to bypass application authentication and gain administrative access by setting
23RISK
open ↗Referência✓ VexDay Proof
odars CMS 1.0.2 - Remote File Inclusion
PHP remote file inclusion vulnerability in src/browser/resource/categories/resource_categories_view.php in Open Digital
23RISK
open ↗Referência✓ VexDay Proof
Stash 1.0.3 - Insecure Cookie Handling
admin/login.php in Stash 1.0.3 allows remote attackers to bypass authentication and gain administrative access by settin
23RISK
open ↗Referência✓ VexDay Proof
Atomic Photo Album 1.1.0pre4 - Insecure Cookie Handling
Atomic Photo Album 1.1.0 pre4 does not properly handle the apa_cookie_login and apa_cookie_password cookies, which proba
23RISK
open ↗Referência✓ VexDay Proof
Professional Download Assistant 0.1 - Authentication Bypass
SQL injection vulnerability in admin/login.asp in Professional Download Assistant 0.1 allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Vivvo Article Manager 3.2 - 'id' SQL Injection
SQL injection vulnerability in pdf_version.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earl
23RISK
open ↗Referência✓ VexDay Proof
A+ PHP Scripts - Nms Insecure Cookie Handling
A+ PHP Scripts News Management System (NMS) allows remote attackers to bypass authentication and gain administrator priv
23RISK
open ↗Referência✓ VexDay Proof
Softerra Time-Assistant 6.2 - 'inc_dir' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in lib/timesheet.class.php in Softerra Time-Assistant 6.2 and earlier
23RISK
open ↗Referência✓ VexDay Proof
FretsWeb 1.2 - 'name' Blind SQL Injection
Multiple SQL injection vulnerabilities in FretsWeb 1.2 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module Tiny Event 1.01 - 'id' SQL Injection
SQL injection vulnerability in index.php in the Tiny Event (tinyevent) 1.01 and earlier module for Xoops allows remote a
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module MyAds Bug Fix 2.04jp - 'index.php' SQL Injection
SQL injection vulnerability in index.php in the MyAds 2.04jp and earlier module for Xoops allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
Absolute FAQ Manager 6.0 - Insecure Cookie Handling
Xigla Software Absolute FAQ Manager.NET 6.0 allows remote attackers to bypass authentication and gain administrative acc
23RISK
open ↗Referência✓ VexDay Proof
Check Point Firewall-1 - PKI Web Service HTTP Header Remote Overflow
NOTE: this issue has been disputed by the vendor. Buffer overflow in the PKI Web Service in Check Point Firewall-1 PKI
23RISK
open ↗Referência✓ VexDay Proof
Teraway LinkTracker 1.0 - Insecure Cookie Handling
Teraway LinkTracker 1.0 allows remote attackers to bypass authentication and gain administrative access via a userid=1&l
23RISK
open ↗Referência✓ VexDay Proof
Belkin F5D9230-4 Wireless G Plus MIMO Router - Authentication Bypass
The web server in Belkin Wireless G Plus MIMO Router F5D9230-4 does not require authentication for SaveCfgFile.cgi, whic
23RISK
open ↗Referência✓ VexDay Proof
SmodCMS 2.10 - Slownik ssid SQL Injection
SQL injection vulnerability in index.php in the slownik module in SmodCMS 2.10 and earlier allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
Active Trade 2 - Authentication Bypass
SQL injection vulnerability in account.asp in Active Trade 2 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke Module eBoard 1.0.7 - GLOBALS[name] Local File Inclusion
Directory traversal vulnerability in member.php in the eBoard 1.0.7 module for PHP-Nuke allows remote attackers to inclu
23RISK
open ↗Referência✓ VexDay Proof
MiniHTTPServer Web Forum & File Sharing Server 4.0 - Add User
join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accou
23RISK
open ↗Referência✓ VexDay Proof
Konqueror 3.5.9 - 'load' Remote Crash
HTMLTokenizer::scriptHandler in Konqueror in KDE 3.5.9 and 3.5.10 allows remote attackers to cause a denial of service (
23RISK
open ↗Referência✓ VexDay Proof
ASPPortal 3.2.5 - Database Disclosure
ASP Portal 3.2.5 stores sensitive information under the web root with insufficient access control, which allows remote a
23RISK
open ↗Referência✓ VexDay Proof
SH-News 3.0 - Insecure Cookie Handling
action.php in SH-News 3.0 allows remote attackers to bypass authentication and gain administrator privileges by setting
23RISK
open ↗Referência✓ VexDay Proof
ScarNews 1.2.1 - 'sn_admin_dir' Local File Inclusion
Directory traversal vulnerability in scarnews.inc.php in ScarNews 1.2.1 allows remote attackers to include and execute a
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.