Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
78,958cataloged exploits
36,206CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,460Referência 22,832GitHub PoC 14,991VulnCheck XDB 8,829Nuclei 4,357Metasploit 3,489✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Joovili 3.0.6 - 'joovili.images.php' Remote File Disclosure
Directory traversal vulnerability in joovili.images.php in Joovili 3.0.0 through 3.0.6 allows remote attackers to read a
23RISK
open ↗Referência✓ VexDay Proof
VP-ASP Shopping Cart 6.50 - Database Disclosure
VP-ASP Shopping Cart 6.50 stores sensitive information under the web root with insufficient access control, which allows
23RISK
open ↗Referência✓ VexDay Proof
the net guys aspired2blog - SQL Injection / File Disclosure
SQL injection vulnerability in admin/blog_comments.asp in The Net Guys ASPired2Blog allows remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
PNPHPBB2 < 1.2i - 'PHPEx' Local File Inclusion
Directory traversal vulnerability in printview.php in PNphpBB2 1.2i and earlier allows remote attackers to include and e
23RISK
open ↗Referência✓ VexDay Proof
the net guys aspired2blog - SQL Injection / File Disclosure
The Net Guys ASPired2Blog stores sensitive information under the web root with insufficient access control, which allows
23RISK
open ↗Referência✓ VexDay Proof
isweb CMS 3.0 - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in index.php in CMS ISWEB 3.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
mini-pub 0.3 - Local Directory Traversal / File Disclosure
front-end/edit.php in mini-pub 0.3 and earlier allows remote attackers to read files and obtain PHP source code via a fi
23RISK
open ↗Referência✓ VexDay Proof
Macrovision Installshield - 'isusweb.dll' Overwrite (SEH)
Buffer overflow in a certain ActiveX control in Macrovision InstallShield Update Service Web Agent 5.1.100.47363 allows
23RISK
open ↗Referência✓ VexDay Proof
ccTiddly 1.7.4 - 'cct_base' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in ccTiddly 1.7.4 and 1.7.6 allow remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
template creature - SQL Injection / File Disclosure
SQL injection vulnerability in media/media_level.asp in ASP Template Creature allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Internet Explorer 6.0.2900 SP2 - CSS Attribute Denial of Service
Microsoft Internet Explorer 6.0.2900 SP2 and earlier allows remote attackers to cause a denial of service (crash) via a
38RISK
open ↗Referência✓ VexDay Proof
Lotus Domino R6 Webmail - Remote Password Hash Dumper
IBM Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores HTTPPassword hashes from names.n
43RISK
open ↗Referência✓ VexDay Proof
VideoLAN VLC Media Player 0.8.6d - 'httpd_FileCallBack' Remote Format String
Format string vulnerability in the httpd_FileCallBack function (network/httpd.c) in VideoLAN VLC 0.8.6d allows remote at
28RISK
open ↗Referência✓ VexDay Proof
KTP Computer Customer Database CMS 1.0 - Blind SQL Injection
SQL injection vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows re
23RISK
open ↗Referência✓ VexDay Proof
template creature - SQL Injection / File Disclosure
ASP Template Creature stores sensitive information under the web root with insufficient access control, which allows rem
23RISK
open ↗Referência✓ VexDay Proof
No-IP DUC 2.1.7 - Remote Code Execution
Buffer overflow in No-IP DUC 2.1.7 and earlier allows remote HTTP servers to execute arbitrary code via a crafted respon
28RISK
open ↗Referência✓ VexDay Proof
Microsoft Visual FoxPro 6.0 - 'FPOLE.OCX' Arbitrary Command Execution
Insecure method vulnerability in the FPOLE.OCX 6.0.8450.0 ActiveX control in Microsoft Visual FoxPro 6.0 allows remote a
28RISK
open ↗Referência✓ VexDay Proof
evilboard 0.1a - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in index.php in EvilBoard 0.1a (Alpha) allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
Active Test 2.1 - 'QuizID' Blind SQL Injection
Multiple SQL injection vulnerabilities in Active Test 2.1 allow remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Referência✓ VexDay Proof
Active Test 2.1 - Authentication Bypass
Multiple SQL injection vulnerabilities in start.asp in Active Test 2.1 allow remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
sma-db 0.3.12 - Remote File Inclusion / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in startpage.php in SMA-DB 0.3.12 allows remote attackers to inject arbitrary w
23RISK
open ↗Referência✓ VexDay Proof
LokiCMS 0.3.4 - 'index.php' Arbitrary Check File
Directory traversal vulnerability in index.php in LokiCMS 0.3.4 and earlier, when magic_quotes_gpc is disabled, allows r
23RISK
open ↗Referência✓ VexDay Proof
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH (Ruby)
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that ge
45RISK
open ↗Referência✓ VexDay Proof
PHP iCalendar 2.24 - 'cookie_language' Local File Inclusion / Arbitrary File Upload
admin/index.php in PHP iCalendar 2.3.4, 2.24, and earlier does not require administrative authentication for an addupdat
23RISK
open ↗Referência✓ VexDay Proof
SunByte e-Flower - 'id' SQL Injection
SQL injection vulnerability in popupproduct.php in Sunbyte e-Flower allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
Active Business Directory 2 - Blind SQL Injection
SQL injection vulnerability in default.asp in Active Business Directory 2 allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
Active Web Mail 4 - Authentication Bypass
SQL injection vulnerability in login.aspx in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗Referência✓ VexDay Proof
Active Price Comparison 4 - Authentication Bypass
Multiple SQL injection vulnerabilities in login.aspx in Active Price Comparison 4.0 allow remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
ProjectCMS 1.0b - 'index.php?sn' SQL Injection
SQL injection vulnerability in index.php in ProjectCMS 1.0 Beta allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
Ocean12 Mailing List Manager Gold - File Disclosure / SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in Ocean12 Mailing List Manager Gold allow remote attackers to execute arbitrary
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.