Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
SyndeoCMS 2.5.01 - 'cmsdir' Remote File Inclusion
PHP remote file inclusion vulnerability in starnet/themes/c-sky/main.inc.php in Fred Stuurman SyndeoCMS 2.5.01 allows re
23RISK
open ↗Referência✓ VexDay Proof
CCProxy 6.2 - 'ping' Remote Buffer Overflow
Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long addre
28RISK
open ↗Referência✓ VexDay Proof
Winamp 5.55 - MAKI script Universal Integer Overflow
The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute
50RISK
open ↗Referência✓ VexDay Proof
Joomla! Component ArtForms 2.1 b7 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the InterJoomla ArtForms (com_artforms) component 2.1b7 for Joomla
23RISK
open ↗Referência✓ VexDay Proof
Web Oddity Web Server 0.09b - Directory Traversal
Directory traversal vulnerability in Web Oddity 0.09b allows remote attackers to read arbitrary files via a .. (dot dot)
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Contact Info 1.0 - SQL Injection
SQL injection vulnerability in the Contact Information Module (com_contactinfo) component 1.0 for Joomla! allows remote
23RISK
open ↗Referência✓ VexDay Proof
SiteBuilderElite 1.2 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in SiteBuilder Elite 1.2 allow remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
MiGCMS 2.0.5 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in MiGCMS 2.0.5, when register_globals is enabled, allow remote attac
23RISK
open ↗Referência✓ VexDay Proof
XChat 2.8.7b - 'URI Handler' Remote Code Execution (Internet Explorer 6/7)
Argument injection vulnerability in XChat 2.8.7b and earlier on Windows, when Internet Explorer is used, allows remote a
28RISK
open ↗Referência✓ VexDay Proof
SCO UnixWare Reliant HA 1.1.4 - Local Privilege Escalation
Untrusted search path vulnerability in (1) hvdisp and (2) rcvm in ReliantHA 1.1.4 in SCO UnixWare 7.1.4 allows local use
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component GameQ 4.0 - SQL Injection
SQL injection vulnerability in the GameQ (com_gameq) component 4.0 and earlier for Joomla! allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
IMGallery 2.5 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in IMGallery 2.5, when magic_quotes_gpc is disabled, allow remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
Mole Group Rental Script - Authentication Bypass
SQL injection vulnerability in admin/index.php in Mole Group Rental Script allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Zomplog 3.8.1 - Arbitrary File Upload
Zomplog 3.8.1 and earlier stores potentially sensitive information under the web root with insufficient access control,
23RISK
open ↗Referência✓ VexDay Proof
Extreme phpBB 3.0.1 - 'functions.php' Remote File Inclusion
PHP remote file inclusion vulnerability in functions.php in Extreme phpBB (aka phpBB Extreme) 3.0.1 allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
Yaws < 1.80 - Multiple Headers Remote Denial of Service Vulnerabilities
Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with
28RISK
open ↗Referência✓ VexDay Proof
PAD Site Scripts 3.6 - Insecure Cookie Handling
PAD Site Scripts 3.6 allows remote attackers to bypass authentication and gain privileges as other users, including admi
23RISK
open ↗Referência✓ VexDay Proof
JShop 1.x < 2.x - 'xPage' Local File Inclusion
Directory traversal vulnerability in v2demo/page.php in Jshop Server 1.x through 2.x allows remote attackers to include
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows Media Player - '.mid' Integer Overflow (PoC)
Integer overflow in Microsoft Windows Media Player (WMP) 11.0.5721.5260 allows remote attackers to cause a denial of ser
28RISK
open ↗Referência✓ VexDay Proof
CA Internet Security Suite 2008 - 'SaveToFile()' File Corruption (PoC)
Directory traversal vulnerability in the UmxEventCli.CachedAuditDataList.1 (aka UmxEventCliLib) ActiveX control in UmxEv
28RISK
open ↗Referência✓ VexDay Proof
Wordsmith 1.1b - 'config.inc.php?_path' Remote File Inclusion
PHP remote file inclusion vulnerability in config.inc.php in Wordsmith 1.0 RC1, when register_globals is enabled, allows
35RISK
open ↗Referência✓ VexDay Proof
Dew-NewPHPLinks 2.0 - Local File Inclusion / Cross-Site Scripting
Directory traversal vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to read arbitrary files vi
23RISK
open ↗Referência✓ VexDay Proof
GLLCTS2 < 4.2.4 - 'detail' SQL Injection
SQL injection vulnerability in login.php in Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
RoomPHPlanning 1.5 - Arbitrary Add Admin
admin/userform.php in RoomPHPlanning 1.5 does not require administrative credentials, which allows remote authenticated
23RISK
open ↗Referência✓ VexDay Proof
PostNuke Module pnEncyclopedia 0.2.0 - SQL Injection
SQL injection vulnerability in the pnEncyclopedia module 0.2.0 and earlier for PostNuke allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
IPSwitch IMail Server 8.0x - Remote Heap Overflow
Heap-based buffer overflow in iaspam.dll in the SMTP Server in Ipswitch IMail Server 8.01 through 8.11 allows remote att
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke addon Nuke Mobile Entartainment 1.0 - Local File Inclusion
Directory traversal vulnerability in data/compatible.php in the Nuke Mobile Entertainment 1 addon for PHP-Nuke allows re
23RISK
open ↗Referência✓ VexDay Proof
Airsensor M520 - HTTPd Remote Denial of Service / Buffer Overflow (PoC)
Multiple buffer overflows in the AirDefense Airsensor M520 with firmware 4.3.1.1 and 4.4.1.4 allow remote authenticated
23RISK
open ↗Referência✓ VexDay Proof
team 1.x - File Disclosure / Cross-Site Scripting
Team Board 1.x and 2.x stores sensitive information under the web root with insufficient access control, which allows re
23RISK
open ↗Referência✓ VexDay Proof
BaoFeng - ActiveX 'OnBeforeVideoDownload()' Remote Buffer Overflow
Stack-based buffer overflow in the MPS.StormPlayer.1 ActiveX control in mps.dll 3.9.4.27 in Baofeng Storm allows remote
50RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.