Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Joomla! Component Tech Article 1.x - SQL Injection
SQL injection vulnerability in the Tech Articles (com_tech_article) 1.0 component for Joomla! allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Daily Message 1.0.3 - 'id' SQL Injection
SQL injection vulnerability in the Daily Message (com_dailymessage) 1.0.3 component for Joomla! allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
Libra PHP File Manager 1.18 - Insecure Cookie Handling
Libra File Manager 1.18 and earlier allows remote attackers to bypass authentication and gain privileges by setting the
23RISK
open ↗Referência✓ VexDay Proof
Star Articles 6.0 - Blind SQL Injection (2)
Multiple SQL injection vulnerabilities in Kalptaru Infotech Ltd. Star Articles 6.0 allow remote attackers to inject arbi
23RISK
open ↗Referência✓ VexDay Proof
Maxum Rumpus 6.0 - Multiple Remote Buffer Overflow Vulnerabilities
Multiple buffer overflows in Rumpus before 6.0.1 allow remote attackers to (1) cause a denial of service (segmentation f
23RISK
open ↗Referência✓ VexDay Proof
Cadre PHP Framework - Remote File Inclusion
PHP remote file inclusion vulnerability in fw/class.Quick_Config_Browser.php in Cadre PHP Framework 20020724 allows remo
23RISK
open ↗Referência✓ VexDay Proof
Ace Image Hosting Script - 'id' SQL Injection
SQL injection vulnerability in albums.php in Ace Image Hosting Script allows remote authenticated users to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
OwenPoll 1.0 - Insecure Cookie Handling
OwenPoll 1.0 allows remote attackers to bypass authentication and obtain administrative access via a modified account na
23RISK
open ↗Referência✓ VexDay Proof
k-rate - SQL Injection / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Qsoft K-Rate Premium allow remote attackers to inject arbitrary w
23RISK
open ↗Referência✓ VexDay Proof
k-rate - SQL Injection / Cross-Site Scripting
Unspecified vulnerability in the Manage Templates feature in Qsoft K-Rate Premium allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
Ninja Blog 4.8 - Remote Information Disclosure
Directory traversal vulnerability in entries/index.php in Ninja Blog 4.8, when magic_quotes_gpc is disabled, allows remo
23RISK
open ↗Referência✓ VexDay Proof
SazCart 1.5 - 'cart.php' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/controls/cart.php in sazcart 1.5 allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
Categories hierarchy phpBB Mod 2.1.2 - 'phpbb_root_path' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/class_template.php in Categories hierarchy (aka CH or mod-CH) 2.1.2
23RISK
open ↗Referência✓ VexDay Proof
CA BrightStor ARCserve 11.5.2.0 - 'catirpc.dll' RPC Server Denial of Service
The RPC Server service (catirpc.exe) in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 SP2 and earlie
28RISK
open ↗Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
Unspecified vulnerability in IIS/iibind.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticate
23RISK
open ↗Referência✓ VexDay Proof
TeamCalPro 3.1.000 - Multiple Local/Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
eDContainer 2.22 - Local File Inclusion
Directory traversal vulnerability in index.php in eDreamers eDContainer 2.22, when magic_quotes_gpc is disabled, allows
23RISK
open ↗Referência✓ VexDay Proof
miniPortail 2.2 - Cross-Site Scripting / Local File Inclusion
Cross-site scripting (XSS) vulnerability in search.php in miniPortail 2.2 and earlier allows remote attackers to inject
23RISK
open ↗Referência✓ VexDay Proof
blogit! - SQL Injection / File Disclosure / Cross-Site Scripting
SQL injection vulnerability in index.asp in Katy Whitton BlogIt! allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗Referência✓ VexDay Proof
eXV2 Module Viso 2.0.4.3 - 'kid' SQL Injection
SQL injection vulnerability in index.php in the Viso (Industry Book) 2.04 and 2.03 module for eXV2 allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
LiteNews 0.1 - Insecure Cookie Handling
LiteNews 0.1 (aka 01), and possibly 1.2 and earlier, allows remote attackers to bypass authentication and gain administr
23RISK
open ↗Referência✓ VexDay Proof
Dream4 Koobi 4.4/5.4 - gallery SQL Injection
SQL injection vulnerability in index.php in dream4 Koobi 4.4 and 5.4 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
UltraVNC/TightVNC (Multiple VNC Clients) - Multiple Integer Overflows (PoC)
Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to ca
28RISK
open ↗Referência✓ VexDay Proof
Motorola Wimax modem CPEi300 - File Disclosure / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated user
23RISK
open ↗Referência✓ VexDay Proof
Max.Blog 1.0.6 - 'offline_auth.php' Offline Authentication Bypass
SQL injection vulnerability in offline_auth.php in Max.Blog 1.0.6 and earlier, when magic_quotes_gpc is disabled, allows
23RISK
open ↗Referência✓ VexDay Proof
XCMS 1.82 - Local/Remote File Inclusion
Multiple directory traversal vulnerabilities in index.php in XCMS 1.82 and earlier allow remote attackers to read arbitr
23RISK
open ↗Referência✓ VexDay Proof
DivX Player 6.6.0 - ActiveX 'SetPassword()' Denial of Service (PoC)
A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Int
28RISK
open ↗Referência✓ VexDay Proof
Euphonics Audio Player 1.0 (Windows XP SP3) - '.pls' Local Buffer Overflow
Stack-based buffer overflow in MultiMedia Soft AdjMmsEng.dll 7.11.1.0 and 7.11.2.7, as distributed in multiple MultiMedi
50RISK
open ↗Referência✓ VexDay Proof
Elecard MPEG Player 5.5 - '.m3u' Stack Buffer Overflow (PoC)
Stack-based buffer overflow in Elecard MPEG Player 5.5 build 15884.081218 allows remote attackers to execute arbitrary c
23RISK
open ↗Referência✓ VexDay Proof
Uebimiau Web-Mail 2.7.10/2.7.2 - Remote File Disclosure
Uebimiau Webmail 2.7.10 and 2.7.2 does not protect authentication state variables from being set through HTTP requests,
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.