Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,305cataloged exploits
36,465CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,466Referência 23,051GitHub PoC 15,051VulnCheck XDB 8,883Nuclei 4,361Metasploit 3,493✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
MyPHP Forum 3.0 - 'Final' SQL Injection
Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Office 2003 - '.wps' Local Stack Overflow (MS08-011)
Stack-based buffer overflow in wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Wor
35RISK
open ↗Referência✓ VexDay Proof
LoudBlog 0.6.1 - 'parsedpage' Remote Code Execution
Eval injection vulnerability in loudblog/inc/parse_old.php in Loudblog 0.8.0 and earlier allows remote attackers to exec
28RISK
open ↗Referência✓ VexDay Proof
WebPortal CMS 0.6-beta - Remote Password Change
Multiple SQL injection vulnerabilities in WebPortal CMS 0.6-beta allow remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
InoutMailingListManager 3.1 - Remote Command Execution
Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows
23RISK
open ↗Referência✓ VexDay Proof
Evilsentinel 1.0.9 - Multiple Vulnerabilities Disable
admin/config.php in Evilsentinel 1.0.9 and earlier allows remote attackers to bypass the CAPTCHA test by omitting the es
23RISK
open ↗Referência✓ VexDay Proof
StreamAudio ChainCast ProxyManager - 'ccpm_0237.dll' Remote Buffer Overflow
Buffer overflow in an ActiveX control in ccpm_0237.dll for StreamAudio ChainCast ProxyManager allows remote attackers to
28RISK
open ↗Referência✓ VexDay Proof
Microsoft Visual InterDev 6.0 SP6 - '.sln' Local Buffer Overflow
Buffer overflow in Microsoft Visual InterDev 6.0 (SP6) allows user-assisted attackers to execute arbitrary code via a St
28RISK
open ↗Referência✓ VexDay Proof
PixelPost 1.7 - Blind SQL Injection
SQL injection vulnerability in index.php in Pixelpost 1.7 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
Crystal Reports XI Release 2 (Enterprise Tree Control) - ActiveX Buffer Overflow (Denial of Service) (PoC)
Race condition in the Enterprise Tree ActiveX control (EnterpriseControls.dll 11.5.0.313) in Crystal Reports XI Release
23RISK
open ↗Referência✓ VexDay Proof
MyBulletinBoard (MyBB) 1.2.10 - Multiple Vulnerabilities
Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via
35RISK
open ↗Referência✓ VexDay Proof
Bandwebsite 1.5 - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in lyrics.php in Bandwebsite (aka Bandsite portal system) 1.5 allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
phpMyWebmin 1.0 - 'target' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Joshua Muheim phpMyWebmin 1.0 allow remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
Travelsized CMS 0.4 - 'FrontPage.php' Remote File Inclusion
PHP remote file inclusion vulnerability in frontpage.php in Dan Jensen Travelsized CMS 0.4 and earlier allows remote att
23RISK
open ↗Referência✓ VexDay Proof
Invision Gallery 2.0.7 - 'readfile()' / SQL Injection
Directory traversal vulnerability in Invision Gallery 2.0.7 allows remote attackers to read arbitrary files via a .. (do
28RISK
open ↗Referência✓ VexDay Proof
V3 Chat Profiles/Dating Script 3.0.2 - Authentication Bypass
SQL injection vulnerability in V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
MyBulletinBoard (MyBB) 1.2.10 - Remote Code Execution
Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via
35RISK
open ↗Referência✓ VexDay Proof
OpenBSD 4.2 - 'rtlabel_id2name()' Local Null Pointer Dereference Denial of Service
OpenBSD 4.2 allows local users to cause a denial of service (kernel panic) by calling the SIOCGIFRTLABEL IOCTL on an int
23RISK
open ↗Referência✓ VexDay Proof
alitalk 1.9.1.1 - Multiple Vulnerabilities
inc/elementz.php in aliTalk 1.9.1.1 does not properly verify authentication, which allows remote attackers to add an arb
23RISK
open ↗Referência✓ VexDay Proof
OpenDock Easy Gallery 1.4 - 'doc_directory' File Inclusion
Multiple PHP remote file inclusion vulnerabilities in OpenDock Easy Gallery 1.4 and earlier, when register_globals is en
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component com_registration_detailed 4.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in registration_detailed.inc.php in Mark Van Bellen Detailed User Registration (
23RISK
open ↗Referência✓ VexDay Proof
Vlog System 1.1 - SQL Injection
SQL injection vulnerability in blog.php in NetArt Media Vlog System 1.1 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Download-Engine 1.4.2 - 'spaw' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/includes/spaw/spaw_control.class.php in Download-Engine 1.4.2 allows re
23RISK
open ↗Referência✓ VexDay Proof
CSPartner 1.0 - Delete All Users / SQL Injection
SQL injection vulnerability in gestion.php in CSPartner 0.1, when magic_quotes_gpc is disabled, allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
JASmine 0.0.2 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Nayco JASmine (aka Jasmine-Web) allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
Foafgen 0.3 - 'redir.php' Local Source Disclosure
Directory traversal vulnerability in redir.php in Foafgen 0.3 allows remote attackers to read arbitrary files via a .. (
23RISK
open ↗Referência✓ VexDay Proof
Ultrastats 0.2.144/0.3.11 - 'serverid' SQL Injection
SQL injection vulnerability in index.php in Ultrastats 0.2.144 and 0.3.11 allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
Apoll 0.7b - Authentication Bypass
SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
YaBBSM 3.0.0 - 'Offline.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in SuperMod 3.0.0 for YABB (YaBBSM) allow remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Apoll 0.7b - Authentication Bypass
SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execu
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.