Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,508cataloged exploits
40,258CVEs with public exploitation
24,696lab-tested
AllReferência 26,095Exploit-DB 24,488GitHub PoC 17,831VulnCheck XDB 10,015Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Streamline PHP Media Server 1.0-beta4 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Streamline PHP Media Server 1.0-beta4 allow remote attackers to ex
35RISK
open ↗Referência✓ VexDay Proof
RiteCMS 2.2.1 - Authenticated Remote Code Execution
An issue was discovered in RiteCMS 2.2.1. An authenticated user can directly execute system commands by uploading a php
28RISK
open ↗Referência✓ VexDay Proof
OneCMS 2.4 - 'abc' SQL Injection
SQL injection vulnerability in userreviews.php in OneCMS 2.4 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Referência✓ VexDay Proof
phpMySms 2.0 - 'ROOT_PATH' Remote File Inclusion
PHP remote file inclusion vulnerability in sms_config/gateway.php in PhpMySms 2.0 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Mambo Module galleria 1.0b - Remote File Inclusion
PHP remote file inclusion vulnerability in galleria.html.php in Galleria Mambo Module 1.0 and earlier for Mambo allows r
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module icontent 1.0/4.5 - Remote File Inclusion
PHP remote file inclusion vulnerability in include/wysiwyg/spaw_control.class.php in the icontent 4.5 module for XOOPS a
35RISK
open ↗Referência✓ VexDay Proof
VistaBB 2.x - 'functions_mod_user.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in VistaBB 2.0.33 and earlier allow remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
ProManager 0.73 - 'note.php' SQL Injection
SQL injection vulnerability in note.php in ProManager 0.73 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
AlberT-EasySite 1.0a5 - 'PSA_PATH' Remote File Inclusion
PHP remote file inclusion vulnerability in AES/modules/auth/phpsecurityadmin/include/logout.php in AlberT-EasySite (AES)
23RISK
open ↗Referência✓ VexDay Proof
2WIRE Modems/Routers - 'CRLF' Denial of Service
The web-based management interface in 2Wire, Inc. HomePortal and OfficePortal Series modems and routers allows remote at
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component com_downloads - SQL Injection
SQL injection vulnerability in index.php in the Downloads (com_downloads) component for Mambo and Joomla! allows remote
23RISK
open ↗Referência✓ VexDay Proof
mail2forum phpBB Mod 1.2 - 'm2f_root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Mail2Forum (module for phpBB) 1.2 and earlier allow remote attacke
23RISK
open ↗Referência✓ VexDay Proof
iManage CMS 4.0.12 - 'absolute_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in component.php in iManage CMS 4.0.12 and earlier allow remote attac
28RISK
open ↗Referência✓ VexDay Proof
Prozilla Webring Website Script - 'category.php?cat' SQL Injection
SQL injection vulnerability in category.php in Prozilla Webring allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
IBM Rational ClearQuest - Web Authentication Bypass / SQL Injection
SQL injection vulnerability in /main in IBM Rational ClearQuest (CQ) Web 7.0.0.0-IFIX02 and 7.0.0.1 allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
Txx CMS 0.2 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Txx CMS 0.2 allow remote attackers to execute arbitrary PHP code v
35RISK
open ↗Referência✓ VexDay Proof
Txx CMS 0.2 - Multiple Remote File Inclusions
Multiple cross-site scripting (XSS) vulnerabilities in Txx CMS 0.2 allow remote attackers to inject arbitrary web script
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component MCQuiz 0.9 Final - 'tid' SQL Injection
SQL injection vulnerability in index.php in the McQuiz (com_mcquiz) 0.9 Final component for Joomla! allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
neuron news 1.0 - 'index.php?q' Local File Inclusion
Directory traversal vulnerability in index.php in Neuron News 1.0 allows remote attackers to include and execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
iziContents rc6 - Local/Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute ar
35RISK
open ↗Referência✓ VexDay Proof
Softbiz Classifieds PLUS - 'id' SQL Injection
SQL injection vulnerability in store_info.php in SoftBiz Classifieds PLUS allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
ActiveKB KnowledgeBase 2.x - 'catId' SQL Injection
SQL injection vulnerability in index.php in Interspire ActiveKB NX 2.x allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
LearnLoop 2.0beta7 - 'sFilePath' Remote File Disclosure
Directory traversal vulnerability in include/file_download.php in LearnLoop 2.0 beta7 allows remote attackers to read ar
23RISK
open ↗Referência✓ VexDay Proof
Web-MeetMe 3.0.3 - 'play.php' Remote File Disclosure
Multiple directory traversal vulnerabilities in play.php in Web-MeetMe 3.0.3 allow remote attackers to read arbitrary fi
23RISK
open ↗Referência✓ VexDay Proof
Joomla! / Mambo Component rsgallery 2.0b5 - 'catid' SQL Injection
SQL injection vulnerability in index.php in the RSGallery (com_rsgallery) 2.0 beta 5 and earlier component for Mambo and
23RISK
open ↗Referência✓ VexDay Proof
SineCMS 2.3.4 - Calendar SQL Injection
Multiple SQL injection vulnerabilities in SineCMS 2.3.4 and earlier allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
PHPCOIN 1.2.3 - 'session_set.php' Remote File Inclusion
PHP remote file inclusion vulnerability in coin_includes/constants.php in phpCOIN 1.2.3 allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
PHP ZLink 0.3 - 'go.php' SQL Injection
SQL injection vulnerability in go.php in PHP ZLink 0.3 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Referência✓ VexDay Proof
Wallpaper Site 1.0.09 - 'category.php' SQL Injection
Multiple SQL injection vulnerabilities in Wallpaper Site 1.0.09 allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
ZenPhoto 1.1.3 - 'rss.php?albumnr' SQL Injection
SQL injection vulnerability in rss.php in Zenphoto 1.1 through 1.1.3 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.