Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
zeeproperty 1.0 - Arbitrary File Upload / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in view_prop_details.php in Zeeways ZEEPROPERTY 1.0 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Flexphplink Pro - Arbitrary File Upload
Unrestricted file upload vulnerability in submitlink.php in FlexPHPLink Pro 0.0.7 allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component Sermon 0.2 - 'gid' SQL Injection
SQL injection vulnerability in index.php in the Sermon (com_sermon) 0.2 component for Mambo allows remote attackers to e
23RISK
open ↗Referência✓ VexDay Proof
MailEnable 3.13 SMTP Service - 'VRFY/EXPN' Denial of Service
Multiple unspecified vulnerabilities in the SMTP service in MailEnable Standard Edition 1.x, Professional Edition 3.x an
23RISK
open ↗Referência✓ VexDay Proof
Mobius 1.4.4.1 - SQL Injection
Multiple SQL injection vulnerabilities in Mobius for Mimsy XG 1 1.4.4.1 and earlier allow remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
Professional Download Assistant 0.1 - Database Disclosure
Professional Download Assistant 0.1 stores sensitive information under the web root with insufficient access control, wh
23RISK
open ↗Referência✓ VexDay Proof
Fuzzylime CMS 3.01 - 'commrss.php' Remote Code Execution
Directory traversal vulnerability in commsrss.php in fuzzylime (cms) before 3.01b allows remote attackers to include and
23RISK
open ↗Referência✓ VexDay Proof
SDP Downloader 2.3.0 - '.asx' Local Buffer Overflow (SEH) (1)
Stack-based buffer overflow in Streaming Download Project (SDP) Downloader 2.3.0 allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
dBpowerAMP Audio Player 2 - '.m3u' Remote Buffer Overflow
Buffer overflow in dBpowerAMP Audio Player Release 2 allows remote attackers to execute arbitrary code via a .M3U file w
23RISK
open ↗Referência✓ VexDay Proof
The Merchant 2.2.0 - 'index.php?show' Remote File Inclusion
PHP remote file inclusion vulnerability in help/index.php in The Merchant (themerchant) 2.2 allows remote attackers to e
23RISK
open ↗Referência✓ VexDay Proof
Student Study Center Management System v1.0 - Stored Cross-Site Scripting (XSS)
Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the "Admin Name" f
23RISK
open ↗Referência✓ VexDay Proof
WebCards 1.3 - SQL Injection
Unrestricted file upload vulnerability in the "Add Image Macro" feature in WebCards 1.3 allows remote authenticated admi
23RISK
open ↗Referência✓ VexDay Proof
Simple Customer 1.2 - Authentication Bypass
SQL injection vulnerability in login.php in Simple Customer 1.2 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
Viewpoint Media Player for IE 3.2 - Remote Stack Overflow (PoC)
Multiple stack-based buffer overflows in the AxMetaStream ActiveX control in AxMetaStream.dll 3.3.2.26 in Viewpoint Medi
23RISK
open ↗Referência✓ VexDay Proof
phpMyNewsletter 0.8 (beta5) - Multiple Vulnerabilities
admin/send_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit
23RISK
open ↗Referência✓ VexDay Proof
pecio CMS 1.1.5 - 'index.php?language' Local File Inclusion
Directory traversal vulnerability in index.php in Pecio CMS 1.1.5 allows remote attackers to read arbitrary files via a
23RISK
open ↗Referência✓ VexDay Proof
Norton Ghost Support module for EasySetup wizard - Remote Denial of Service (PoC)
Multiple insecure method vulnerabilities in the Symantec.EasySetup.1 ActiveX control in EasySetupInt.dll 14.0.4.30167 in
23RISK
open ↗Referência✓ VexDay Proof
LightNEasy sqlite / no database 1.2.2 - Multiple Vulnerabilities
SQL injection vulnerability in LightNEasy/lightneasy.php in LightNEasy SQLite 1.2.2 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
X-Forum 0.6.2 - Remote Command Execution
Static code injection vulnerability in X-Forum 0.6.2 allows remote authenticated administrators to inject arbitrary PHP
23RISK
open ↗Referência✓ VexDay Proof
Quake 3 Engine 1.32b - 'R_RemapShader()' Remote Client Buffer Overflow
Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Castle Wolfenstein 1.41, and (3) Quake III
23RISK
open ↗Referência✓ VexDay Proof
Destar 0.2.2-5 - Arbitrary Add New User
DeStar 0.2.2-5 allows remote attackers to add arbitrary users via a direct request to config/add/CfgOptUser.
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component nfnaddressbook 0.4 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the NFN Address Book (com_nfn_addressbook) 0.4 component for Mambo
23RISK
open ↗Referência✓ VexDay Proof
All Club CMS 0.0.2 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in All Club CMS (ACCMS) 0.0.1f and earlier allows remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
phpBB User Viewed Posts Tracker 1.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/functions_user_viewed_posts.php in the Nivisec User Viewed Posts Tra
23RISK
open ↗Referência✓ VexDay Proof
Pie Cart Pro - 'Home_Path' Remote File Inclusion
PHP remote file inclusion vulnerability in enc/content.php in WAHM E-Commerce Pie Cart Pro allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
MiniBB 2.0.5 - 'Language' Local File Inclusion
Directory traversal vulnerability in index.php in MiniBB 2.0.5 allows remote attackers to read arbitrary files via a ..
23RISK
open ↗Referência✓ VexDay Proof
Booking Centre 2.01 - Authentication Bypass
Multiple SQL injection vulnerabilities in admin/checklogin.php in Venalsur Booking Centre Booking System for Hotels Grou
23RISK
open ↗Referência✓ VexDay Proof
ASPSiteWare RealtyListing 1.0/2.0 - SQL Injection
Multiple SQL injection vulnerabilities in ASPSiteWare RealtyListings 1.0 and 2.0 allow remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Google Chrome 1.0.154.53 - Null Pointer Remote Crash
Google Chrome 1.0.154.53 allows remote attackers to cause a denial of service (NULL pointer dereference and application
23RISK
open ↗Referência✓ VexDay Proof
PPC Search Engine 1.61 - 'INC' Multiple Remote File Inclusions
Multiple PHP file inclusion vulnerabilities in WGS-PPC (aka PPC Search Engine), as distributed with other aliases, allow
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.