Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,388cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
ABC-View Manager 1.42 - '.psp' Local Buffer Overflow
Buffer overflow in ABC-View Manager 1.42 allows user-assisted remote attackers to execute arbitrary code via a crafted .
23RISK
open ↗Referência✓ VexDay Proof
CubeCart 3.0.6 - Remote Command Execution
PHP remote file include vulnerability in includes/orderSuccess.inc.php in CubeCart allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
inertianews 0.02b - 'inertianews_main.php' Remote File Inclusion
PHP remote file inclusion vulnerability in inertianews_main.php in inertianews 0.02 beta allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
EQdkp 1.3.1 - 'Referer Spoof' Remote Database Backup
EQdkp 1.3.1 and earlier authenticates administrative requests by verifying that the HTTP Referer header specifies an adm
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component RWCards 3.0.11 - Local File Inclusion
Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla!
43RISK
open ↗Referência✓ VexDay Proof
Pixie CMS - Cross-Site Scripting / SQL Injection
SQL injection vulnerability in the referral function in admin/lib/lib_logs.php in Pixie CMS 1.01a allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
VHD Web Pack 2.0 - 'index.php' Local File Inclusion
Directory traversal vulnerability in index.php in DivideConcept VHD Web Pack 2.0 allows remote attackers to include and
23RISK
open ↗Referência✓ VexDay Proof
LightBlog 9.6 - 'Username' Local File Inclusion
Directory traversal vulnerability in view_member.php in Public Warehouse LightBlog 9.6 allows remote attackers to includ
23RISK
open ↗Referência✓ VexDay Proof
GNU/Gallery 1.1.1.0 - 'admin.php' Local File Inclusion
Directory traversal vulnerability in admin.php in GNU/Gallery 1.1.1.0 and earlier allows remote attackers to include and
23RISK
open ↗Referência✓ VexDay Proof
Mafia Scum Tools 2.0.0 - 'index.php?gen' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Mafia Scum Tools 2.0.0 in Matthew Wardrop Advanced Random Genera
23RISK
open ↗Referência✓ VexDay Proof
MyBlog: PHP and MySQL Blog/CMS software - SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in MyBlog allow remote attackers to execute arbitrary SQL commands via the (1) vi
23RISK
open ↗Referência✓ VexDay Proof
PHP 4.4.6 - 'ibase_connect()' Local Buffer Overflow
Multiple buffer overflows in the (1) ibase_connect and (2) ibase_pconnect functions in the interbase extension in PHP 4.
23RISK
open ↗Referência✓ VexDay Proof
WordPress Plugin wordTube 1.43 - 'wpPATH' Remote File Inclusion
PHP remote file inclusion vulnerability in wordtube-button.php in the wordTube 1.43 and earlier plugin for WordPress, wh
35RISK
open ↗Referência✓ VexDay Proof
Integramod Nederland 1.4.2 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/archive/archive_topic.php in IntegraMOD Nederland 1.4.2 allows remot
23RISK
open ↗Referência✓ VexDay Proof
teatro 1.6 - 'basePath' Remote File Inclusion
PHP remote file inclusion vulnerability in pub/pub08_comments.php in teatro 1.6 allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Kmita Tellfriend 2.0 - 'file' Remote File Inclusion
PHP remote file inclusion vulnerability in kmitaadmin/kmitat/htmlcode.php in Kmita Tellfriend 2.0 and earlier, when regi
23RISK
open ↗Referência✓ VexDay Proof
PortalApp 4.0 - SQL Injection / Cross-Site Scripting / Authentication Bypass
SQL injection vulnerability in forums.asp in PortalApp 4.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
eSHOP100 - 'SUB' SQL Injection
SQL injection vulnerability in index.php in eSHOP100 allows remote attackers to execute arbitrary SQL commands via the S
23RISK
open ↗Referência✓ VexDay Proof
OpenX 2.6 - 'bannerid' Blind SQL Injection
SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
DevelopItEasy Events Calendar 1.2 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in DevelopItEasy Events Calendar 1.2 allow remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
pastelcms 0.8.0 - Local File Inclusion / SQL Injection
SQL injection vulnerability in admin.php in PastelCMS 0.8.0, when magic_quotes_gpc is disabled, allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
PowerPoint Viewer OCX 3.2 - ActiveX Control Denial of Service
Multiple stack-based buffer overflows in the PowerPointOCX ActiveX control in PowerPointViewer.ocx 3.1.0.3 allow remote
23RISK
open ↗Referência✓ VexDay Proof
UploadImage/UploadScript 1.0 - Remote Change Admin Password
admin.php in UploadImage 1.0 does not check for the original password before making a change to a new password, which al
23RISK
open ↗Referência✓ VexDay Proof
CNStats 2.9 - 'who_r.php?bj' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in CNStats 2.9 allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗Referência✓ VexDay Proof
OpenASP 3.0 - Blind SQL Injection
SQL injection vulnerability in default.asp in Openasp 3.0 and earlier allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
Chipmunk Blog - (Authentication Bypass) Add Admin
Chipmunk Blogger Script allows remote attackers to gain administrator privileges via a direct request to admin/reguser.p
23RISK
open ↗Referência✓ VexDay Proof
Syntax Desktop 2.7 - 'synTarget' Local File Inclusion
Directory traversal vulnerability in admin/modules/aa/preview.php in Syntax Desktop 2.7 allows remote attackers to inclu
23RISK
open ↗Referência✓ VexDay Proof
CoolPlayer Portable 2.19.1 - '.m3u' Local Buffer Overflow (1)
Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka CoolPlayer+ Portable) 2.19.6 and earlier allows rem
28RISK
open ↗Referência✓ VexDay Proof
Catviz 0.4.0 beta1 - Local File Inclusion / Cross-Site Scripting
Multiple directory traversal vulnerabilities in index.php in Catviz 0.4.0 Beta 1 allow remote attackers to read arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Nuked-klaN 1.7.6 - Remote Code Execution
SQL injection vulnerability in Nuked-klaN 1.7.6 allows remote attackers to execute arbitrary SQL commands via the X-Forw
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.