Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,379cataloged exploits
36,530CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,466Referência 23,104GitHub PoC 15,068VulnCheck XDB 8,883Nuclei 4,365Metasploit 3,493✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
VistaBB 2.x - 'functions_mod_user.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in VistaBB 2.0.33 and earlier allow remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
SL_Site 1.0 - 'spaw_root' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/editeur/spaw_control.class.php in Web Provence SL_Site 1.0 and earlier
28RISK
open ↗Referência✓ VexDay Proof
Somery 0.4.6 - 'skin_dir' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/system/include.php in Somery 0.4.6 and earlier, when register_globals i
23RISK
open ↗Referência✓ VexDay Proof
PhotoKorn Gallery 1.52 - 'dir_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in PhotoKorn Gallery 1.52 and earlier allow remote attackers to execu
28RISK
open ↗Referência✓ VexDay Proof
SIPS 0.3.1 - 'box.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in sipssys/code/box.inc.php in Haakon Nilsen simple, integrated publishing syste
23RISK
open ↗Referência✓ VexDay Proof
Fantastic News 2.1.4 - Multiple Remote File Inclusions
PHP remote file inclusion vulnerability in headlines.php in Fantastic News 2.1.4, and possibly earlier, allows remote at
23RISK
open ↗Referência✓ VexDay Proof
Vivvo Article Manager 3.2 - 'classified_path' File Inclusion
PHP remote file inclusion vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 an
23RISK
open ↗Referência✓ VexDay Proof
Fire Soft Board RC 3 - 'racine' Remote File Inclusion
PHP remote file inclusion vulnerability in demarrage.php in Fire Soft Board (FSB) RC3 and earlier allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
MyABraCaDaWeb 1.0.3 - 'base' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in MyABraCaDaWeb 1.0.3, when register_globals is enabled, allow remot
23RISK
open ↗Referência✓ VexDay Proof
RaidenHTTPD 1.1.49 - 'SoftParserFileXml' Remote Code Execution
PHP remote file inclusion vulnerability in raidenhttpd-admin/slice/check.php in RaidenHTTPD 1.1.49, when register_global
23RISK
open ↗Referência✓ VexDay Proof
Web Server Creator 0.1 - 'l' Remote File Inclusion
PHP remote file inclusion vulnerability in news/include/customize.php in Web Server Creator 0.1 allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
MobilePublisherPHP 1.5 RC2 - Remote File Inclusion
PHP remote file inclusion vulnerability in header.php in MobilePublisherPHP 1.5 RC2 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
BolinOS 4.5.5 - 'gBRootPath' Remote File Inclusion
PHP remote file inclusion vulnerability in system/_b/contentFiles/gBIndex.php in BolinOS 4.5.5 and earlier allows remote
23RISK
open ↗Referência✓ VexDay Proof
Q-Shop 3.5 - 'browse.asp' SQL Injection
SQL injection vulnerability in browse.asp in QuadComm Q-Shop 3.5 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component com_serverstat 0.4.4 - Remote File Inclusion
PHP remote file inclusion vulnerability in install.serverstat.php in the Serverstat (com_serverstat) 0.4.4 and earlier c
23RISK
open ↗Referência✓ VexDay Proof
Techno Dreams FAQ Manager 1.0 - SQL Injection
SQL injection vulnerability in faqview.asp in Techno Dreams FAQ Manager Package 1.0 allows remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
CMtextS 1.0 - '/users_logins/admin.txt' Credentials Disclosure
CMtextS 1.0 and earlier stores users_logins/admin.txt under the web document root with insufficient access control, whic
23RISK
open ↗Referência✓ VexDay Proof
guanxiCRM Business Solution 0.9.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in include/phpxd/phpXD.php in guanxiCRM 0.9.1 and earlier allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
more.groupware 0.74 - 'new_calendarid' SQL Injection
SQL injection vulnerability in modules/calendar/week.php in More.groupware 0.74 allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
PHP DocWriter 0.3 - 'script' Remote File Inclusion
PHP remote file inclusion vulnerability in PHP DocWriter 0.3 and earlier allows remote attackers to execute arbitrary PH
23RISK
open ↗Referência✓ VexDay Proof
Alstrasoft e-Friends 4.85 - Remote Command Execution
Directory traversal vulnerability in chat/getStartOptions.php in AlstraSoft E-friends 4.85 allows remote attackers to in
23RISK
open ↗Referência✓ VexDay Proof
Tekman Portal 1.0 - 'tr' SQL Injection
SQL injection vulnerability in uye_profil.asp in Tekman Portal (TR) 1.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Simple Discussion Board 0.1.0 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Simple Discussion Board 0.1.0 allow remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
Site@School 2.4.02 - Arbitrary File Upload
Unrestricted file upload vulnerability in starnet/editors/htmlarea/popups/images.php in Site@School (S@S) 2.4.02 and ear
23RISK
open ↗Referência✓ VexDay Proof
MyReview 1.9.4 - 'email' SQL Injection / Code Execution
SQL injection vulnerability in the GetMember function in functions.php in MyReview 1.9.4 allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
PHP Blue Dragon CMS 2.9.1 - Cross-Site Scripting / SQL Injection Code Execution
SQL injection vulnerability in the GetModuleConfig function in public_includes/pub_kernel/pbd_modules.php in Php Blue Dr
23RISK
open ↗Referência✓ VexDay Proof
PHPartenaire 1.0 - 'dix.php3' Remote File Inclusion
PHP remote file inclusion vulnerability in dix.php3 in PHPartenaire 1.0 allows remote attackers to execute arbitrary PHP
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Joomlaboard 1.1.1 - 'sbp' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the Joomlaboard Forum Component (com_joomlaboard) before 1.1.2 for
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component Security Images 3.0.5 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Security Images (com_securityimages) component 3.0.5 and earlier f
28RISK
open ↗Referência✓ VexDay Proof
Advaced-Clan-Script 3.4 - 'mcf.php' Remote File Inclusion
PHP remote file inclusion vulnerability in mcf.php in Advanced-Clan-Script (AVCX) 3.4 and earlier allows remote attacker
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.