Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
84,035cataloged exploits
39,531CVEs with public exploitation
24,695lab-tested
AllReferência 25,557Exploit-DB 24,485GitHub PoC 16,313VulnCheck XDB 9,678Nuclei 4,478Metasploit 3,524✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
ScriptsFeed (SF) Auto Classifieds Software - Arbitrary File Upload
Unrestricted file upload vulnerability in ScriptsFeed Auto Classifieds allows remote authenticated users to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
xoops module tsdisplay4xoops 0.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in blocks/tsdisplay4xoops_block2.php in tsdisplay4xoops (TSD4XOOPS, aka the Team
23RISK
open ↗Referência✓ VexDay Proof
Simple Machines Forum (SMF) 1.1.5 (Windows x86) - Admin Reset Password
The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before
23RISK
open ↗Referência✓ VexDay Proof
Google Chrome 0.2.149.27 - Automatic File Download
Google Chrome BETA (0.2.149.27) does not prompt the user before saving an executable file, which makes it easier for rem
23RISK
open ↗Referência✓ VexDay Proof
Winamp 5.3 - '.wmv' Remote Denial of Service
Buffer overflow in Nullsoft Winamp 5.3 allows user-assisted remote attackers to cause a denial of service (crash) via a
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows Server - Universal Code Execution (MS08-067)
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 20
100RISK
open ↗Referência✓ VexDay Proof
wavewoo 0.1.1 - 'loading.php?path_include' Remote File Inclusion
PHP remote file inclusion vulnerability in include/loading.php in Alessandro Lulli wavewoo 0.1.1 allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
minb 0.1.0 - Remote Code Execution
include/modules/top/1-random_quote.php in Minb Is Not a Blog (minb) 0.1.0 allows remote attackers to execute arbitrary P
23RISK
open ↗Referência✓ VexDay Proof
Chilkat IMAP ActiveX 7.9 - File Execution / Denial of Service
Insecure method vulnerability in ChilkatMail_v7_9.dll in the Chilkat Software IMAP ActiveX control (ChilkatMail2.Chilkat
23RISK
open ↗Referência✓ VexDay Proof
The Merchant 2.2.0 - 'index.php?show' Remote File Inclusion
PHP remote file inclusion vulnerability in help/index.php in The Merchant (themerchant) 2.2 allows remote attackers to e
23RISK
open ↗Referência✓ VexDay Proof
Libra PHP File Manager 1.18 - Insecure Cookie Handling
Libra File Manager 1.18 and earlier allows remote attackers to bypass authentication and gain privileges by setting the
23RISK
open ↗Referência✓ VexDay Proof
phpMyNewsletter 0.8 (beta5) - Multiple Vulnerabilities
admin/send_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit
23RISK
open ↗Referência✓ VexDay Proof
AvailScript Photo Album - 'pics.php' Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Availscript Photo Album allow remote attackers to inject arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Vastal I-Tech Software Zone - 'cat_id' SQL Injection
SQL injection vulnerability in view_product.php in Vastal I-Tech Software Zone allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
Codefixer MailingListPro - Database Disclosure
CodefixerSoftware MailingListPro Free Edition stores sensitive information under the web root with insufficient access c
23RISK
open ↗Referência✓ VexDay Proof
CS-Cart 1.3.5 - Authentication Bypass
SQL injection vulnerability in core/user.php in CS-Cart 1.3.5 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
Aj Classifieds - Authentication Bypass
AJ Classifieds allows remote attackers to bypass authentication and gain administrator privileges via a direct request t
23RISK
open ↗Referência✓ VexDay Proof
Firefly 1.1.01 - 'doc_root' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in FireFly 1.1.01 allow remote attackers to execute arbitrary PHP cod
23RISK
open ↗Referência✓ VexDay Proof
pPIM 1.0 - Upload/Change Password
changepassword.php in Phlatline's Personal Information Manager (pPIM) 1.0 and earlier does not require administrative au
23RISK
open ↗Referência✓ VexDay Proof
chipmunk topsites - Authentication Bypass / Cross-Site Scripting
SQL injection vulnerability in authenticate.php in Chipmunk Topsites allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
chipmunk topsites - Authentication Bypass / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Chipmunk Topsites allows remote attackers to inject arbitrary w
23RISK
open ↗Referência✓ VexDay Proof
Pie Web m{a_e}sher mod rss 0.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in lib/action/rss.php in RSS module 0.1 for Pie Web M{a,e}sher, when register_gl
23RISK
open ↗Referência✓ VexDay Proof
ReVou Twitter Clone - Authentication Bypass
Multiple SQL injection vulnerabilities in ReVou Micro Blogging Twitter clone allow remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Maian Greetings 2.1 - Insecure Cookie Handling
Maian Greetings 2.1 allows remote attackers to bypass authentication and gain administrative privileges by setting the m
23RISK
open ↗Referência✓ VexDay Proof
Belkin Wireless G Router / ADSL2 Modem - Authentication Bypass
The web interface to the Belkin Wireless G router and ADSL2 modem F5D7632-4V6 with firmware 6.01.08 allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
webid 0.5.4 - Multiple Vulnerabilities
SQL injection vulnerability in the admin panel (admin/) in WeBid auction script 0.5.4 allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
telltarget 1.3.3 - 'tt_docroot' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in telltarget CMS 1.3.3 allow remote attackers to execute arbitrary P
28RISK
open ↗Referência✓ VexDay Proof
TutorialCMS 1.00 - 'search.php?search' SQL Injection
Multiple SQL injection vulnerabilities in TutorialCMS (aka Photoshop Tutorials) 1.00 and earlier allow remote attackers
23RISK
open ↗Referência✓ VexDay Proof
webid 0.5.4 - Multiple Vulnerabilities
eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets (CSS) file
23RISK
open ↗Referência✓ VexDay Proof
Butterfly ORGanizer 2.0.0 - Arbitrary Delete (Category/Account)
Butterfly Organizer 2.0.0 allows remote attackers to (1) delete arbitrary categories via a modified tablehere parameter
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.