Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
my-gesuad 0.9.14 - Authentication Bypass / SQL Injection / Cross-Site Scripting
modules/admuser.php in myGesuad 0.9.14 (aka 0.9) does not require administrative authentication, which allows remote aut
23RISK
open ↗Referência✓ VexDay Proof
yourplace 1.0.2 - Multiple Vulnerabilities / Remote Code Execution
YourPlace 1.0.2 and earlier stores sensitive information under the web root with insufficient access control, which allo
23RISK
open ↗Referência✓ VexDay Proof
WorkSimple 1.2.1 - Remote File Inclusion / Sensitive Data Disclosure
WorkSimple 1.2.1 stores sensitive information under the web root with insufficient access control, which allows remote a
23RISK
open ↗Referência✓ VexDay Proof
eFiction < 2.0.7 - Remote Admin Authentication Bypass
index.php in eFiction before 2.0.7 allows remote attackers to bypass authentication and gain privileges by setting the (
23RISK
open ↗Referência✓ VexDay Proof
Hailboards 1.2.0 - 'phpbb_root_path' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/usercp_viewprofile.php in Hailboards 1.2.0 allows remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
PHP Live Helper 2.0 - 'abs_path' Remote File Inclusion
PHP remote file inclusion vulnerability in global.php in Turnkey Web Tools PHP Live Helper 2.0 and earlier allows remote
23RISK
open ↗Referência✓ VexDay Proof
ASPThai.Net Forum 8.5 - Remote Database Disclosure
ASPThai.NET ASPThai Forums 8.5 stores sensitive information under the web root with insufficient access control, which a
23RISK
open ↗Referência✓ VexDay Proof
Microsoft FoxServer - 'vfp6r.dll 6.0.8862.0' ActiveX Command Execution
An ActiveX control for Microsoft Visual FoxPro (vfp6r.dll 6.0.8862.0) allows remote attackers to execute arbitrary comma
28RISK
open ↗Referência✓ VexDay Proof
ExBB Italiano 0.2 - exbb[home_path] Remote File Inclusion
PHP remote file inclusion vulnerability in modules/userstop/userstop.php in ExBB Italia 0.2 and earlier, when register_g
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows Message Queuing Service - RPC Buffer Overflow (MS07-065) (2)
Stack-based buffer overflow in the Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4, Window
50RISK
open ↗Referência✓ VexDay Proof
Dev-C++ 4.9.9.2 - '.CPP' File Parsing Local Stack Overflow (PoC)
Stack-based buffer overflow in Bloodshed Dev-C++ 4.9.9.2 allows user-assisted remote attackers to cause a denial of serv
23RISK
open ↗Referência✓ VexDay Proof
Akarru 0.4.3.34 - 'bm_content' Remote File Inclusion
PHP remote file inclusion vulnerability in akarru.gui/main_content.php in Akarru Social BookMarking Engine 0.4.3.34 and
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Internet Explorer 7 (Windows 2003 SP2) - Memory Corruption (MS09-002)
Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows r
60RISK
open ↗Referência✓ VexDay Proof
Jetik Emlak ESA 2.0 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Jetik Emlak Sistem A (ESA) 2.0 allow remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Jokes Site Script - 'jokes.php' SQL Injection
SQL injection vulnerability in jokes.php in YourFreeWorld Jokes Site Script allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
MyNews 4.2.2 - 'themefunc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in include/themes/themefunc.php in MyNews 4.2.2 and earlier allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
phpQuiz 0.1.2 - SQL Injection / Code Execution
Multiple unrestricted file upload vulnerabilities in (1) back/upload_img.php and (2) admin/upload_img.php in Walter Besc
23RISK
open ↗Referência✓ VexDay Proof
Acidcat CMS 3.4.1 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in admin_colors_swatch.asp in Acidcat CMS 3.4.1 allows remote attackers to inje
23RISK
open ↗Referência✓ VexDay Proof
Sami HTTP Server 2.0.1 - HTTP 404 Object not found Denial of Service
KarjaSoft Sami HTTP Server 2.0.1 allows remote attackers to cause a denial of service (daemon hang) via a large number o
23RISK
open ↗Referência✓ VexDay Proof
DNS Tools (PHP Digger) - Remote Command Execution
dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the
28RISK
open ↗Referência✓ VexDay Proof
WebChat 0.77 - 'defines.php?WEBCHATPATH' Remote File Inclusion
PHP remote file inclusion vulnerability in defines.php in WebChat 0.77 allows remote attackers to execute arbitrary PHP
23RISK
open ↗Referência✓ VexDay Proof
Half-Life CSTRIKE Server 1.6 - 'no-steam' Denial of Service
Valve Software Half-Life Counter-Strike 1.6 allows remote attackers to cause a denial of service (crash) via multiple cr
23RISK
open ↗Referência✓ VexDay Proof
W1L3D4 philboard 1.0 - 'philboard_reply.asp' SQL Injection
Multiple SQL injection vulnerabilities in W1L3D4 Philboard 1.0 allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
ZoomStats 1.0.2 - 'mysql.php' Remote File Inclusion
PHP remote file inclusion vulnerability in libs/dbmax/mysql.php in ZoomStats 1.0.2 and earlier, when register_globals is
23RISK
open ↗Referência✓ VexDay Proof
Agares phpAutoVideo 2.21 - Local/Remote File Inclusion
PHP remote file inclusion vulnerability in admin/frontpage_right.php in Agares Media phpAutoVideo 2.21 allows remote att
23RISK
open ↗Referência✓ VexDay Proof
ModuleBuilder 1.0 - 'file' Remote File Disclosure
Directory traversal vulnerability in modules/Builder/DownloadModule.php in ModuleBuilder 1.0 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
CMS-BRD - 'menuclick' SQL Injection
SQL injection vulnerability in index.php in CMS-BRD allows remote attackers to execute arbitrary SQL commands via the me
23RISK
open ↗Referência✓ VexDay Proof
DUcalendar 1.0 - 'iEve' SQL Injection
SQL injection vulnerability in detail.asp in DUware DUcalendar 1.0 and possibly earlier allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
FretsWeb 1.2 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in FretsWeb 1.2 allow remote attackers to read arbitrary files via director
23RISK
open ↗Referência✓ VexDay Proof
dagger Web engine 23jan2007 - Remote File Inclusion
PHP remote file inclusion vulnerability in cal.func.php in Valerio Capello Dagger - The Cutting Edge r23jan2007 allows r
45RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.