Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
84,598cataloged exploits
39,733CVEs with public exploitation
24,695lab-tested
AllReferência 25,742Exploit-DB 24,486GitHub PoC 16,616VulnCheck XDB 9,736Nuclei 4,493Metasploit 3,525✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Microsoft Windows - '.chm' Denial of Service (HTML Compiled)
Buffer overflow in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (memory corruption and
35RISK
open ↗Referência✓ VexDay Proof
212Cafe Board 0.07 - 'qID' SQL Injection
SQL injection vulnerability in view.php in 212cafe Board 0.07 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
MyioSoft Ajax Portal 3.0 - 'page' SQL Injection
SQL injection vulnerability in ajaxp_backend.php in MyioSoft AjaxPortal 3.0 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Mini-stream RM-MP3 Converter 3.0.0.7 - '.asx' Local Buffer Overflow
Multiple stack-based buffer overflows in Mini-stream Easy RM-MP3 Converter 3.0.0.7 allow remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
vbzoom 1.x - 'forum.php?MainID' SQL Injection
SQL injection vulnerability in forum.php in VBZooM 1.11 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Referência✓ VexDay Proof
Mini-stream RM-MP3 Converter 3.0.0.7 - '.RAM' Local Buffer Overflow
Multiple stack-based buffer overflows in Mini-stream Easy RM-MP3 Converter 3.0.0.7 allow remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component JPad 1.0 - (Authenticated) SQL Injection
SQL injection vulnerability in the Jpad (com_jpad) 1.0 component for Joomla! allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
2DayBiz Business Community Script - Multiple Vulnerabilities
admin/adminaddeditdetails.php in Business Community Script does not properly restrict access, which allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
PHP-Lance 1.52 - 'catid' SQL Injection
SQL injection vulnerability in show.php in BitmixSoft PHP-Lance 1.52 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
eLitius 1.0 - Remote Command Execution
Unrestricted file upload vulnerability in admin/uploadimage.php in eLitius 1.0 allows remote attackers to bypass intende
23RISK
open ↗Referência✓ VexDay Proof
Scout Portal Toolkit 1.4.0 - 'forumid' SQL Injection
SQL injection vulnerability in SPT--ForumTopics.php in Scout Portal Toolkit (SPT) 1.4.0 and earlier allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
PAPOO 3_RC3 - SQL Injection / Admin Credentials Disclosure
SQL injection vulnerability in forumthread.php in Papoo 3 RC3 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
Visagesoft eXPert PDF ViewerX - 'VSPDFViewerX.ocx' File Overwrite
Insecure method vulnerability in VISAGESOFT eXPert PDF Viewer X ActiveX control (VSPDFViewerX.ocx) 3.0.990.0 allows remo
23RISK
open ↗Referência✓ VexDay Proof
PHPMyManga 0.8.1 - 'template.php' Multiple File Inclusions
Multiple PHP remote file inclusion vulnerabilities in template.php in Phpmymanga 0.8.1 and earlier allow remote attacker
23RISK
open ↗Referência✓ VexDay Proof
Mynews 0.10 - Authentication Bypass
SQL injection vulnerability in login.php in MyNews 0.10 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Referência✓ VexDay Proof
QuestCMS - Cross-Site Scripting / Directory Traversal / SQL Injection
Directory traversal vulnerability in main/main.php in QuestCMS allows remote attackers to read arbitrary local files via
23RISK
open ↗Referência✓ VexDay Proof
MLdonkey 2.9.7 - Arbitrary File Disclosure
Absolute path traversal vulnerability in MLDonkey 2.8.4 through 2.9.7 allows remote attackers to read arbitrary files vi
23RISK
open ↗Referência✓ VexDay Proof
Winlpd 1.2 Build 1076 - Remote Buffer Overflow
Stack-based buffer overflow in Winlpd 1.26 allows remote attackers to execute arbitrary code via a long string in a requ
23RISK
open ↗Referência✓ VexDay Proof
TugZip 3.00 Archiver - '.zip' Local Buffer Overflow
Stack-based buffer overflow in TUGzip 3.5.0.0 allows remote attackers to denial of service (crash) or execute arbitrary
50RISK
open ↗Referência✓ VexDay Proof
DevelopItEasy Membership System 1.3 - Authentication Bypass
Multiple SQL injection vulnerabilities in Develop It Easy Membership System 1.3 allow remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
Kipper 2.01 - Cross-Site Scripting / Local File Inclusion / File Disclosure
Directory traversal vulnerability in index.php in Kipper 2.01 allows remote attackers to include and execute arbitrary l
23RISK
open ↗Referência✓ VexDay Proof
DM FileManager 3.9.2 - Authentication Bypass
Multiple SQL injection vulnerabilities in login.php in DM FileManager 3.9.2, when magic_quotes_gpc is disabled, allow re
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Internet Explorer - WebViewFolderIcon setSlice() Overflow (Metasploit) (1)
Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service
68RISK
open ↗Referência✓ VexDay Proof
MyKtools 2.4 - 'langage' Local File Inclusion
Directory traversal vulnerability in update.php in MyKtools 2.4 allows remote attackers to include and execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
K-Lite Mega Codec Pack 3.5.7.0 - Local Windows Explorer Denial of Service (PoC)
vsfilter.dll in K-Lite Mega Codec Pack 3.5.7.0 allows remote attackers to cause a denial of service (application crash)
23RISK
open ↗Referência✓ VexDay Proof
Realty Web-Base 1.0 - 'list_list.php?id' SQL Injection
SQL injection vulnerability in list_list.php in Realty Webware Technologies Web-Base 1.0 allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
Enthrallweb eCars 1.0 - 'types.asp' SQL Injection
SQL injection vulnerability in Types.asp in Enthrallweb eCars 1.0 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows Wordpad - '.doc' File Local Denial of Service (PoC)
The WordPad Text Converter for Word 97 files in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2 allows r
35RISK
open ↗Referência✓ VexDay Proof
Opera 9.62 - 'file://' Local Heap Overflow
Heap-based buffer overflow in Opera 9.62 on Windows allows remote attackers to execute arbitrary code via a long file://
35RISK
open ↗Referência✓ VexDay Proof
miniBloggie 1.0 - 'del.php' Arbitrary Delete Post
del.php in miniBloggie 1.0 allows remote attackers to delete arbitrary posts via a direct request with a modified post_i
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.