Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,337cataloged exploits
39,873CVEs with public exploitation
24,696lab-tested
AllReferência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
PHP 5.2.3 - 'bz2 com_print_typeinfo()' Denial of Service
The com_print_typeinfo function in the bz2 extension in PHP 5.2.3 allows context-dependent attackers to cause a denial o
23RISK
open ↗Referência✓ VexDay Proof
Apple Mac OSX - 'mount_smbfs' Local Stack Buffer Overflow
Stack-based buffer overflow in SMB in Apple Mac OS X 10.4.11 allows local users to execute arbitrary code via (1) a long
23RISK
open ↗Referência✓ VexDay Proof
Seditio CMS Events Plugin - 'c' SQL Injection
SQL injection vulnerability in events/inc/events.inc.php in the Events plugin for Seditio CMS 1.0 allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
Xpression News 1.0.1 - 'archives.php' Remote File Disclosure
Directory traversal vulnerability in archives.php in Xpression News (X-News) 1.0.1 allows remote attackers to include ar
23RISK
open ↗Referência✓ VexDay Proof
WordPress Plugin wp-Table 1.43 - 'inc_dir' Remote File Inclusion
PHP remote file inclusion vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin for WordPress,
35RISK
open ↗Referência✓ VexDay Proof
PStruh-CZ 1.3/1.5 - 'download.asp' File Disclosure
Directory traversal vulnerability in download.asp in Motobit 1.3 and 1.5 (aka PStruh-CZ) allows remote attackers to read
23RISK
open ↗Referência✓ VexDay Proof
Xserver 0.1 Alpha - 'POST' Remote Buffer Overflow (PoC)
Buffer overflow in Nipun Jain xserver 0.1 alpha allows remote attackers to cause a denial of service via a POST request
23RISK
open ↗Referência✓ VexDay Proof
Adobe Reader 8.1.4/9.1 - 'GetAnnots()' Remote Code Execution
The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote
28RISK
open ↗Referência✓ VexDay Proof
Check New 4.52 - SQL Injection
SQL injection vulnerability in findoffice.php in Check Up New Generation (aka Check New) 4.52, when magic_quotes_gpc is
23RISK
open ↗Referência✓ VexDay Proof
Grabit 1.7.2 Beta 3 - '.nzb' Local Buffer Overflow (SEH)
Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
SimpleNews 1.0.0 FINAL - 'print.php?news_id' SQL Injection
SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
Flat PHP Board 1.2 - Multiple Vulnerabilities
Flat PHP Board 1.2 and earlier stores sensitive information under the web root with insufficient access control, which a
23RISK
open ↗Referência✓ VexDay Proof
32bit FTP (09.04.24) - 'CWD Response' Remote Buffer Overflow
Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a
23RISK
open ↗Referência✓ VexDay Proof
Feindt Computerservice News 2.0 - 'newsadmin.php?action' Remote File Inclusion
PHP remote file inclusion vulnerability in newsadmin.php in Feindt Computerservice News (News-Script) 2.0 allows remote
35RISK
open ↗Referência✓ VexDay Proof
Joomla! Component com_lowcosthotels - Blind SQL Injection
SQL injection vulnerability in the com_lowcosthotels component in the Hotel Booking Reservation System (aka HBS) for Joo
23RISK
open ↗Referência✓ VexDay Proof
ABC estore 3.0 - 'cat_id' Blind SQL Injection
SQL injection vulnerability in index.php in ABC eStore 3.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
Hexamail Server 3.0.0.001 - 'pop3' Remote Overflow (PoC)
Buffer overflow in the pop3 service in Hexamail Server 3.0.0.001 Lite allows remote attackers to cause a denial of servi
28RISK
open ↗Referência✓ VexDay Proof
Soritong MP3 Player 1.0 - Local Buffer Overflow (SEH)
Stack-based buffer overflow in Sorinara Soritong MP3 Player 1.0 allows remote attackers to execute arbitrary code via a
23RISK
open ↗Referência✓ VexDay Proof
Acoustica MP3 CD Burner 4.51 Build 147 - '.asx' Local Buffer Overflow
Buffer overflow in Acoustica MP3 CD Burner 4.32 allows user-assisted remote attackers to execute arbitrary code via a .a
23RISK
open ↗Referência✓ VexDay Proof
CKGold Shopping Cart 2.0 - 'category.php' Blind SQL Injection
SQL injection vulnerability in category.php in CartKeeper CKGold Shopping Cart 2.0 allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
Pluck CMS 4.6.2 - 'langpref' Local File Inclusion
Multiple directory traversal vulnerabilities in pluck 4.6.2, when register_globals is enabled, allow remote attackers to
28RISK
open ↗Referência✓ VexDay Proof
EDraw Office Viewer Component - Unsafe Method
A certain ActiveX control in the EDraw Office Viewer Component (edrawofficeviewer.ocx) 4.0.5.20, and other versions befo
23RISK
open ↗Referência✓ VexDay Proof
Link Request Contact Form 3.4 - Remote Code Execution
Unrestricted file upload vulnerability in Link Request Contact Form 3.4 allows remote attackers to execute arbitrary PHP
23RISK
open ↗Referência✓ VexDay Proof
AuraCMS 1.5rc - Multiple SQL Injections
Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Referência✓ VexDay Proof
IDM-OS 1.0 - 'Filename' File Disclosure
Directory traversal vulnerability in administrator/download.php in IDMOS (aka Phoenix) 1.0 allows remote attackers to re
23RISK
open ↗Referência✓ VexDay Proof
Seagull 0.6.3 - 'files' Remote File Disclosure
Directory traversal vulnerability in optimizer.php in Seagull 0.6.3 allows remote attackers to read arbitrary files via
23RISK
open ↗Referência✓ VexDay Proof
Web Wiz Rich Text Editor 4.0 - Multiple Vulnerabilities
Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02,
23RISK
open ↗Referência✓ VexDay Proof
Adobe JRun 4 - 'logfile' (Authenticated) Directory Traversal
Directory traversal vulnerability in logging/logviewer.jsp in the Management Console in Adobe JRun Application Server 4
23RISK
open ↗Referência✓ VexDay Proof
MySpace Uploader - 'MySpaceUploader.ocx 1.0.0.4' Remote Buffer Overflow
Stack-based buffer overflow in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.5.70 and earlier, as used i
35RISK
open ↗Referência✓ VexDay Proof
OllyDbg 1.10 - Local Format String
Format string vulnerability in OllyDbg 1.10 allows remote attackers to cause a denial of service (crash) and possibly ex
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.