Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,107cataloged exploits
34,679CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,692GitHub PoC 13,812VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecentpopularrisk
21,692 exploits
Referência✓ VexDay Proof
MiniPort@l 0.1.5 Beta - 'skiny' Remote File Inclusion
PHP remote file inclusion vulnerability in menu.php in MiniPort@l 2.0 and earlier allows remote attackers to execute arb
23RISK
open ↗Referência
CVE-2009-4574
SQL injection vulnerability in country_escorts.php in I-Escorts Directory Script allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
openmovieeditor 0.0.20060901 - 'name' Local Buffer Overflow
Buffer overflow in Open Movie Editor 0.0.20060901 allows local users to cause a denial of service (system crash) or exec
23RISK
open ↗Referência
CVE-2009-4578
Cross-site scripting (XSS) vulnerability in the Facileforms (com_facileforms) component for Joomla! and Mambo allows rem
23RISK
open ↗Referência✓ VexDay Proof
TualBLOG 1.0 - 'icerikno' SQL Injection
Multiple SQL injection vulnerabilities in icerik.asp in TualBLOG 1.0 allow remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência
CVE-2009-4581
Directory traversal vulnerability in modules/admincp.php in RoseOnlineCMS 3 B1 and earlier, when magic_quotes_gpc is dis
23RISK
open ↗Referência
CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISK
open ↗Referência✓ VexDay Proof
Limbo CMS 1.0.4.2L - 'com_contact' Remote Code Execution
Unrestricted file upload vulnerability in contact.html.php in the Contact (com_contact) component in Limbo (aka Lite Mam
23RISK
open ↗Referência
CVE-2021-22005
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with netw
100RISK
open ↗Referência
CVE-2017-8484
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2,
23RISK
open ↗Referência
CVE-2020-5902
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic
100RISK
open ↗Referência✓ VexDay Proof
Techno Dreams FAQ Manager 1.0 - SQL Injection
SQL injection vulnerability in faqview.asp in Techno Dreams FAQ Manager Package 1.0 allows remote attackers to execute a
23RISK
open ↗Referência
CVE-2009-4582
SQL injection vulnerability in detail.php in the Dictionary module for XOOPS 2.0.18 allows remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
CMtextS 1.0 - '/users_logins/admin.txt' Credentials Disclosure
CMtextS 1.0 and earlier stores users_logins/admin.txt under the web document root with insufficient access control, whic
23RISK
open ↗Referência✓ VexDay Proof
guanxiCRM Business Solution 0.9.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in include/phpxd/phpXD.php in guanxiCRM 0.9.1 and earlier allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
more.groupware 0.74 - 'new_calendarid' SQL Injection
SQL injection vulnerability in modules/calendar/week.php in More.groupware 0.74 allows remote attackers to execute arbit
23RISK
open ↗Referência
CVE-2009-4583
SQL injection vulnerability in the DhForum (com_dhforum) component for Joomla! allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
PHP DocWriter 0.3 - 'script' Remote File Inclusion
PHP remote file inclusion vulnerability in PHP DocWriter 0.3 and earlier allows remote attackers to execute arbitrary PH
23RISK
open ↗Referência
CVE-2009-4583
SQL injection vulnerability in the DhForum (com_dhforum) component for Joomla! allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
Alstrasoft e-Friends 4.85 - Remote Command Execution
Directory traversal vulnerability in chat/getStartOptions.php in AlstraSoft E-friends 4.85 allows remote attackers to in
23RISK
open ↗Referência✓ VexDay Proof
Tekman Portal 1.0 - 'tr' SQL Injection
SQL injection vulnerability in uye_profil.asp in Tekman Portal (TR) 1.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Simple Discussion Board 0.1.0 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Simple Discussion Board 0.1.0 allow remote attackers to execute ar
23RISK
open ↗Referência
CVE-2009-4588
Heap-based buffer overflow in the WindsPlayerIE.View.1 ActiveX control in WindsPly.ocx 3.5.0.0 Beta, 3.0.0.5, and earlie
50RISK
open ↗Referência✓ VexDay Proof
Site@School 2.4.02 - Arbitrary File Upload
Unrestricted file upload vulnerability in starnet/editors/htmlarea/popups/images.php in Site@School (S@S) 2.4.02 and ear
23RISK
open ↗Referência✓ VexDay Proof
ProgSys 0.156 - 'RR.php' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/pear/Net/DNS/RR.php in ProgSys 0.151 and earlier allows remote attac
23RISK
open ↗Referência✓ VexDay Proof
Digital WebShop 1.128 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Cardway (aka Frederic Boudaud) DigitalWebShop 1.128 and earlier al
23RISK
open ↗Referência
CVE-2009-4596
Cross-site scripting (XSS) vulnerability in index.php in PHP Inventory 1.2 allows remote attackers to inject arbitrary w
23RISK
open ↗Referência✓ VexDay Proof
MyReview 1.9.4 - 'email' SQL Injection / Code Execution
SQL injection vulnerability in the GetMember function in functions.php in MyReview 1.9.4 allows remote attackers to exec
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.