Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,412cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 10,014Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
FreeLyrics 1.0 - Remote File Disclosure
Directory traversal vulnerability in source.php in FreeLyrics 1.0 allows remote attackers to read arbitrary files via di
23RISK
open ↗Referência✓ VexDay Proof
Forum82 < 2.5.2b - 'repertorylevel' Multiple File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Forum82 2.5.2b and earlier allow remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
PlaySms 0.9.3 - Multiple Local/Remote File Inclusions
Multiple directory traversal vulnerabilities in playSMS 0.9.3 allow remote attackers to include and execute arbitrary lo
23RISK
open ↗Referência✓ VexDay Proof
ASPired2Quote - Remote Database Disclosure
The Net Guys ASPired2Quote stores sensitive information under the web root with insufficient access control, which allow
23RISK
open ↗Referência✓ VexDay Proof
Discussion Web 4 - Remote Database Disclosure
TAKempis Discussion Web 4.0 stores sensitive information under the web root with insufficient access control, which allo
23RISK
open ↗Referência✓ VexDay Proof
FAQ Manager 1.2 - 'categorie.php' SQL Injection
SQL injection vulnerability in catagorie.php in Werner Hilversum FAQ Manager 1.2 allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
mini-pub 0.3 - Local Directory Traversal / File Disclosure
front-end/edit.php in mini-pub 0.3 and earlier allows remote attackers to read files and obtain PHP source code via a fi
23RISK
open ↗Referência✓ VexDay Proof
template creature - SQL Injection / File Disclosure
ASP Template Creature stores sensitive information under the web root with insufficient access control, which allows rem
23RISK
open ↗Referência✓ VexDay Proof
BBaCE 3.5 - '/includes/functions.php' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/functions.php in Bulletin Board Ace (BBaCE) 3.5 and earlier allows r
23RISK
open ↗Referência✓ VexDay Proof
LiveCMS 3.4 - 'categoria.php?cid' SQL Injection
Cross-site scripting (XSS) vulnerability in LiveCMS 3.4 and earlier allows remote attackers to inject arbitrary web scri
23RISK
open ↗Referência✓ VexDay Proof
LiveCMS 3.4 - 'categoria.php?cid' SQL Injection
Unrestricted file upload vulnerability in LiveCMS 3.4 and earlier allows remote attackers to upload and execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
MiniBill 1.2.5 - 'run_billing.php' Remote File Inclusion
PHP remote file inclusion vulnerability in crontab/run_billing.php in MiniBill 1.2.5 allows remote attackers to execute
35RISK
open ↗Referência✓ VexDay Proof
MyBulletinBoard (MyBB) 1.2.10 - Remote Code Execution
Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via
35RISK
open ↗Referência✓ VexDay Proof
OpenBSD 4.2 - 'rtlabel_id2name()' Local Null Pointer Dereference Denial of Service
OpenBSD 4.2 allows local users to cause a denial of service (kernel panic) by calling the SIOCGIFRTLABEL IOCTL on an int
23RISK
open ↗Referência✓ VexDay Proof
V3 Chat Profiles/Dating Script 3.0.2 - Authentication Bypass
SQL injection vulnerability in V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
CCProxy 6.2 - Telnet Proxy Ping Overflow (Metasploit)
Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long addre
28RISK
open ↗Referência✓ VexDay Proof
Vlog System 1.1 - SQL Injection
SQL injection vulnerability in blog.php in NetArt Media Vlog System 1.1 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Download-Engine 1.4.2 - 'spaw' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/includes/spaw/spaw_control.class.php in Download-Engine 1.4.2 allows re
23RISK
open ↗Referência✓ VexDay Proof
Cdsagenda 4.2.9 - 'SendAlertEmail.php' File Inclusion
PHP remote file inclusion vulnerability in modification/SendAlertEmail.php in CDS Software Consortium CDS Agenda 4.2.9 a
23RISK
open ↗Referência✓ VexDay Proof
Ultrastats 0.2.144/0.3.11 - 'serverid' SQL Injection
SQL injection vulnerability in index.php in Ultrastats 0.2.144 and 0.3.11 allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
Apoll 0.7b - Authentication Bypass
SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
YaBBSM 3.0.0 - 'Offline.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in SuperMod 3.0.0 for YABB (YaBBSM) allow remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
PHP AMX 0.90 - '/plugins/main.php' Remote File Inclusion
PHP remote file inclusion vulnerability in plugins/main.php in Php AMX 0.9.0, when register_globals is enabled or magic_
23RISK
open ↗Referência✓ VexDay Proof
Pro Chat Rooms 3.0.2 - Cross-Site Scripting / Cross-Site Request Forgery
Cross-site scripting (XSS) vulnerability in profiles/index.php in Pro Chat Rooms 3.0.2 allows remote attackers to inject
23RISK
open ↗Referência✓ VexDay Proof
DigitalHive 2.0 RC2 - 'base_include.php' Remote File Inclusion
PHP remote file inclusion vulnerability in template/purpletech/base_include.php in DigitalHive 2.0 RC2 allows remote att
23RISK
open ↗Referência✓ VexDay Proof
Softerra PHP Developer Library 1.5.3 - Remote File Inclusion
PHP remote file inclusion vulnerability in Softerra PHP Developer Library 1.5.3 and earlier allows remote attackers to e
23RISK
open ↗Referência✓ VexDay Proof
pandaBB - 'displayCategory' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in modules/My_eGallery/public/displayCategory.php in the pandaBB modu
23RISK
open ↗Referência✓ VexDay Proof
flinx 1.3 - 'id' SQL Injection
SQL injection vulnerability in category.php in Flinx 1.3 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
Winamp 5.12 - '.pls' Remote Buffer Overflow (Perl) (2)
Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with
60RISK
open ↗Referência✓ VexDay Proof
Move Networks Upgrade Manager Control - Remote Buffer Overflow
Stack-based buffer overflow in the QMPUpgrade.Upgrade.1 ActiveX control in QMPUpgrade.dll 1.0.0.1 in Move Networks Upgra
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.