Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
84,600cataloged exploits
39,734CVEs with public exploitation
24,695lab-tested
AllReferência 25,742Exploit-DB 24,486GitHub PoC 16,618VulnCheck XDB 9,736Nuclei 4,493Metasploit 3,525✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
PHPSlash 0.8.1.1 - Remote Code Execution
Eval injection vulnerability in index.php in phpSlash 0.8.1.1 and earlier allows remote attackers to execute arbitrary P
35RISK
open ↗Referência✓ VexDay Proof
fungamez rc1 - Authentication Bypass / Local File Inclusion
includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by set
23RISK
open ↗Referência✓ VexDay Proof
VIDEOSCRIPT.us - Authentication Bypass
Multiple SQL injection vulnerabilities in admin/index.php in VideoScript.us YouTube Video Script allow remote attackers
23RISK
open ↗Referência✓ VexDay Proof
dotProject 2.0.4 - 'baseDir' Remote File Inclusion
PHP remote file inclusion vulnerability in classes/query.class.php in dotProject 2.0.4 and earlier allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
CuteNews 1.1.1 - 'html.php' Remote Code Execution
plugins/wacko/highlight/html.php in Strawberry in CuteNews.ru 1.1.1 (aka Strawberry) allows remote attackers to execute
35RISK
open ↗Referência✓ VexDay Proof
Joomla! Plugin tinybrowser 1.5.12 - Arbitrary File Upload / Execution
TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.
50RISK
open ↗Referência✓ VexDay Proof
IRSR 0.2 - '_sysSessionPath' Remote File Inclusion
PHP remote file inclusion vulnerability in pageheaderdefault.inc.php in Invisionix Roaming System Remote (IRSR) 0.2 and
23RISK
open ↗Referência✓ VexDay Proof
my-colex 1.4.2 - Authentication Bypass / SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in myColex 1.4.2 allow remote attackers to execute arbitrary SQL commands via (1)
23RISK
open ↗Referência✓ VexDay Proof
TikiWiki 1.9.8 - Remote PHP Injection
tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f ar
60RISK
open ↗Referência✓ VexDay Proof
StormBoard 1.0.1 - SQL Injection
SQL injection vulnerability in thread.php in stormBoards 1.0.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component mambelfish 1.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in mambelfish.class.php in the mambelfish component (com_mambelfish) 1.1 and ear
23RISK
open ↗Referência✓ VexDay Proof
CMS NetCat 3.12 - Multiple Vulnerabilities
Multiple CRLF injection vulnerabilities in AIST NetCat 3.12 and earlier allow remote attackers to have an unknown impact
23RISK
open ↗Referência✓ VexDay Proof
Calendar Script 1.1 - Authentication Bypass
SQL injection vulnerability in index.php in Nodstrum MySQL Calendar 1.1 and 1.2 allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Google Chrome 1.0.154.53 - Null Pointer Remote Crash
Google Chrome 1.0.154.53 allows remote attackers to cause a denial of service (NULL pointer dereference and application
23RISK
open ↗Referência✓ VexDay Proof
Tutti Nova 1.6 - 'TNLIB_DIR' Remote File Inclusion
PHP remote file inclusion vulnerability in Tutti Nova 1.6 and earlier allows remote attackers to execute arbitrary PHP c
23RISK
open ↗Referência✓ VexDay Proof
FreePBX 2.1.3 - 'upgrade.php' Remote File Inclusion
PHP remote file inclusion vulnerability in upgrade.php in Coalescent Systems freePBX 2.1.3 allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
SportsPHool 1.0 - 'mainnav' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/layout/plain.footer.php in SportsPHool 1.0 allows remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
LBlog 1.05 - 'comments.asp' SQL Injection
SQL injection vulnerability in comments.asp in LBlog 1.05 and earlier allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
PromoteWeb MySQL - 'id' SQL Injection
SQL injection vulnerability in go.php in Panuwat PromoteWeb MySQL, when magic_quotes_gpc is disabled, allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
MDPro 1.0.76 - 'Cookie PNSVlang' Local File Inclusion
Directory traversal vulnerability in error.php in MD-Pro 1.0.76 and earlier allows remote authenticated users to read an
23RISK
open ↗Referência✓ VexDay Proof
Simple Text-File Login script (SiTeFiLo) 1.0.6 - File Disclosure / Remote File Inclusion
Simple Text-File Login Script (SiTeFiLo) 1.0.6 stores sensitive information under the web root with insufficient access
23RISK
open ↗Referência✓ VexDay Proof
Simple Text-File Login script (SiTeFiLo) 1.0.6 - File Disclosure / Remote File Inclusion
PHP remote file inclusion vulnerability in slogin_lib.inc.php in Simple Text-File Login Script (SiTeFiLo) 1.0.6 allows r
35RISK
open ↗Referência✓ VexDay Proof
Gnews Publisher .NET - SQL Injection
SQL injection vulnerability in authors.asp in gNews Publisher allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
Fantastic News 2.1.3 - 'script_path' Remote File Inclusion
PHP remote file inclusion vulnerability in news.php in Fantastic News 2.1.3 and earlier allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Feederator 1.0.5 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in the Recly Interactive Feederator (com_feederator) component 1.0.5
35RISK
open ↗Referência✓ VexDay Proof
PHPStore Complete Classifieds Script - Arbitrary File Upload
Unrestricted file upload vulnerability in PHPStore Complete Classifieds allows remote authenticated users to execute arb
23RISK
open ↗Referência✓ VexDay Proof
AGTC MyShop 3.2 - Insecure Cookie Handling
AGTC MyShop 3.2b allows remote attackers to bypass authentication and obtain administrative access setting the log_accep
23RISK
open ↗Referência✓ VexDay Proof
OpenSSL < 0.9.7l/0.9.8d - SSLv2 Client Crash
The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier
28RISK
open ↗Referência✓ VexDay Proof
webClassifieds 2005 - Authentication Bypass
Multiple SQL injection vulnerabilities in index.php in Web Scribble Solutions webClassifieds 2005 allow remote attackers
23RISK
open ↗Referência✓ VexDay Proof
E-Shop Shopping Cart Script - 'search_results.php' SQL Injection
SQL injection vulnerability in search_results.php in E-Php Scripts E-Shop (aka E-Php Shopping Cart) Shopping Cart Script
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.