Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
19,067 exploits
Exploit-DB✓ VexDay Proof
WarFTP 1.65 (Windows 2000 SP4) - 'USER' Remote Buffer Overflow
Stack-based buffer overflow in War FTP Daemon 1.65, and possibly earlier, allows remote attackers to cause a denial of s
35RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 7 - NavCancel.HTM Cross-Site Scripting
Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly
28RISK
open ↗Exploit-DB✓ VexDay Proof
aBitWhizzy - 'whizzylink.php?d' Traversal Arbitrary Directory Listing
Multiple directory traversal vulnerabilities in aBitWhizzy allow remote attackers to list arbitrary directories via a ..
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.2.1 - 'session_regenerate_id()' Double-Free
Double free vulnerability in PHP before 4.4.7, and 5.x before 5.2.2, allows context-dependent attackers to execute arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.2.0/5.2.1 - Rejected Session ID Double-Free
Double free vulnerability in the session extension in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to execute
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache Tomcat 5.x/6.0.x - Directory Traversal
Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using c
45RISK
open ↗Exploit-DB✓ VexDay Proof
aBitWhizzy - 'whizzypic.php?d' Traversal Arbitrary Directory Listing
Multiple directory traversal vulnerabilities in aBitWhizzy allow remote attackers to list arbitrary directories via a ..
23RISK
open ↗Exploit-DB✓ VexDay Proof
Zomplog 3.7.6 (Windows x86) - Local File Inclusion
Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier allows remote attackers to include arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
JGBBS 3.0beta1 - 'search.asp?author' SQL Injection
SQL injection vulnerability in search.asp in JGBBS 3.0 Beta 1 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows XP/2000 - 'WinMM.dll' / '.WAV' Remote Denial of Service
winmm.dll in Microsoft Windows XP allows user-assisted remote attackers to cause a denial of service (infinite loop) via
28RISK
open ↗Exploit-DB✓ VexDay Proof
CARE2X 1.1 - 'ROOT_PATH' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in CARE2X 1.1 allow remote attackers to execute arbitrary PHP code vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
D-Link TFTP 1.0 - Transporting Mode Remote Buffer Overflow
Buffer overflow in D-Link TFTP Server 1.0 allows remote attackers to cause a denial of service (crash) via a long (1) GE
50RISK
open ↗Exploit-DB✓ VexDay Proof
OES (Open Educational System) 0.1beta - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Open Education System (OES) 0.1beta allow remote attackers to exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.2 - EXT/Filter Function Remote Buffer Overflow
Buffer underflow in the PHP_FILTER_TRIM_DEFAULT macro in the filtering extension (ext/filter) in PHP 5.2.0 allows contex
23RISK
open ↗Exploit-DB✓ VexDay Proof
ClipShare 1.5.3 - 'ADODB-Connection.Inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in include/adodb-connection.inc.php in ClipShare 1.5.3 allows remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.2.0 (OSX) - EXT/Filter Space Trimming Buffer Underflow
Buffer underflow in the header function in PHP 5.2.0 allows context-dependent attackers to execute arbitrary code by pas
23RISK
open ↗Exploit-DB✓ VexDay Proof
PostNuke Module phgstats 0.5 - 'phgdir' Remote File Inclusion
phgstats.inc.php in phgstats before 0.5.1, if register_globals is enabled, allows remote attackers to include arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
cPanel 10.9.x - 'Fantastico' Local File Inclusion
Multiple absolute path traversal vulnerabilities in Fantastico, as used with cPanel 10.x, allow remote authenticated use
23RISK
open ↗Exploit-DB✓ VexDay Proof
Premod SubDog 2 - '/includes/functions_kb.php?phpbb_root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Premod SubDog 2 allow remote attackers to execute arbitrary PHP co
28RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.2.0 - EXT/Filter FDF Post Filter Bypass
The FDF support (ext/fdf) in PHP 5.2.0 and earlier does not implement the input filtering hooks for ext/filter, which al
23RISK
open ↗Exploit-DB✓ VexDay Proof
SoftNews 4.1/5.5 - '/engine/Ajax/editnews.php?root_dir' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Softnews Media Group DataLife Engine allow remote attackers to exe
23RISK
open ↗Exploit-DB✓ VexDay Proof
NukeSentinel 2.5.06 - SQL Injection
nukesentinel.php in NukeSentinel 2.5.06 and earlier uses a permissive regular expression to validate an IP address, whic
23RISK
open ↗Exploit-DB✓ VexDay Proof
SoftNews 4.1/5.5 - '/engine/init.php?root_dir' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Softnews Media Group DataLife Engine allow remote attackers to exe
23RISK
open ↗Exploit-DB✓ VexDay Proof
Premod SubDog 2 - '/includes/logger_engine.php?phpbb_root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Premod SubDog 2 allow remote attackers to execute arbitrary PHP co
28RISK
open ↗Exploit-DB✓ VexDay Proof
Premod SubDog 2 - '/includes/themen_portal_mitte.php?phpbb_root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Premod SubDog 2 allow remote attackers to execute arbitrary PHP co
28RISK
open ↗Exploit-DB✓ VexDay Proof
Grayscale Blog 0.8.0 - Security Bypass / SQL Injection / Cross-Site Scripting
Grayscale Blog 0.8.0, and possibly earlier versions, allows remote attackers to gain privileges via direct requests with
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.2.0 / PHP with PECL ZIP 1.8.3 - 'zip://' URL Wrapper Buffer Overflow
Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier, as bundled with PHP 5.2.0 and 5.2.1
28RISK
open ↗Exploit-DB✓ VexDay Proof
MySQL 5.0.x - Single Row SubSelect Remote Denial of Service
MySQL 5.x before 5.0.36 allows local users to cause a denial of service (database crash) by performing information_schem
23RISK
open ↗Exploit-DB✓ VexDay Proof
Grayscale Blog 0.8.0 - Security Bypass / SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Grayscale Blog 0.8.0, and possibly earlier versions, allows remote attackers
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.