Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,495cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,487GitHub PoC 17,244VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Microsoft DNS Server - Dynamic DNS Update/Change
The dynamic DNS update mechanism in the DNS Server service on Microsoft Windows does not properly authenticate clients i
35RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke Modules Manuales 0.1 - 'cid' SQL Injection
SQL injection vulnerability in the Manuales 0.1 module for PHP-Nuke allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
FOSS Gallery Admin 1.0 - Arbitrary File Upload
Unrestricted file upload vulnerability in processFiles.php in FOSS Gallery Admin and FOSS Gallery Public 1.0 beta allows
23RISK
open ↗Referência✓ VexDay Proof
FOSS Gallery Public 1.0 - Arbitrary File Upload
Unrestricted file upload vulnerability in processFiles.php in FOSS Gallery Admin and FOSS Gallery Public 1.0 beta allows
23RISK
open ↗Referência✓ VexDay Proof
PortalApp 4.0 - SQL Injection / Cross-Site Scripting / Authentication Bypass
PortalApp 4.0 does not require authentication for (1) forums.asp and (2) content.asp, which allows remote attackers to c
23RISK
open ↗Referência✓ VexDay Proof
PowerTCP FTP Module - Multiple Techniques (SEH HeapSpray)
Buffer overflow in the ActiveX control (DartFtp.dll) in Dart Communications PowerTCP FTP for ActiveX 2.0.2 0 allows remo
28RISK
open ↗Referência✓ VexDay Proof
XOOPS Module makale 0.26 - SQL Injection
SQL injection vulnerability in makale.php in Makale 0.26 and possibly other versions, a module for XOOPS, allows remote
23RISK
open ↗Referência✓ VexDay Proof
Mambo Module Calendar (Agenda) 1.5.5 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the Calendar Module (com_calendar) 1.5.5 for Mambo allow remote at
23RISK
open ↗Referência✓ VexDay Proof
Flip 3.0 - Remote Password Hash Disclosure
Adam Scheinberg Flip 3.0 and earlier stores sensitive information under the web root with insufficient access control, w
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component com_slideshow - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.slideshow1.php in the Flash Slide Show (com_slideshow) component for Jo
35RISK
open ↗Referência✓ VexDay Proof
Mambo Component 'com_akogallery' 2.5b - SQL Injection
SQL injection vulnerability in index.php in the Arthur Konze AkoGallery (com_akogallery) 2.5 beta component for Mambo an
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component Restaurant 1.0 - SQL Injection
SQL injection vulnerability in index.php in the Restaurant (com_restaurant) 1.0 component for Mambo and Joomla! allows r
23RISK
open ↗Referência✓ VexDay Proof
Pilot Group eTraining - 'news_read.php' SQL Injection
SQL injection vulnerability in news_read.php in Pilot Group (PG) eTraining allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Ourgame GLWorld 2.x - 'hgs_startNotify()' ActiveX Buffer Overflow
Multiple stack-based buffer overflows in the HanGamePluginCn18.HanGamePluginCn18.1 ActiveX control in HanGamePluginCn18.
23RISK
open ↗Referência✓ VexDay Proof
Dovecot IMAP 1.0.10 < 1.1rc2 - Remote Email Disclosure
Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs,
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module tutorials 2.1b - 'printpage.php' SQL Injection
SQL injection vulnerability in the Tutorials 2.1b module for XOOPS allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
acronis pxe server 2.0.0.1076 - Directory Traversal / Null Pointer
Directory traversal vulnerability in the PXE Server (pxesrv.exe) in Acronis Snap Deploy 2.0.0.1076 and earlier allows re
23RISK
open ↗Referência✓ VexDay Proof
TlAds 1.0 - Remote Insecure Cookie Handling
tlAds 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the tlAds_login coo
23RISK
open ↗Referência✓ VexDay Proof
Eznet 3.5.0 - Remote Stack Overflow / Denial of Service
Stack-based buffer overflow in eZnet.exe, as used in eZ (a) eZphotoshare, (b) eZmeeting, (c) eZnetwork, and (d) eZshare
35RISK
open ↗Referência✓ VexDay Proof
Joomla! Component custompages 1.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in the SSTREAMTV custompages (com_custompages) 1.1 and earlier component for Joo
35RISK
open ↗Referência✓ VexDay Proof
iziContents rc6 - Local/Remote File Inclusion
Directory traversal vulnerability in tiny_mce_gzip.php in TinyMCE Compressor PHP before 1.06 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Pro Chat Rooms 3.0.3 - SQL Injection
SQL injection vulnerability in Pro Chat Rooms 3.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
Cisco IP Phone 7940 - Reboot (Denial of Service)
The Cisco IP Phone 7940 allows remote attackers to cause a denial of service (reboot) via a large amount of TCP SYN pack
28RISK
open ↗Referência✓ VexDay Proof
poweraward 1.1.0 rc1 - Local File Inclusion / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in external_vote.php in PowerAward 1.1.0 RC1 allows remote attackers to inject
23RISK
open ↗Referência✓ VexDay Proof
Podcast Generator 1.0 Beta 2 - Remote File Inclusion / File Disclosure
Multiple PHP remote file inclusion vulnerabilities in Podcast Generator 1.0 BETA 2 and earlier allow remote attackers to
28RISK
open ↗Referência✓ VexDay Proof
eazyPortal 1.0 - 'cookie' SQL Injection
SQL injection vulnerability in index.php in eazyPortal 1.0 and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Podcast Generator 1.0 Beta 2 - Remote File Inclusion / File Disclosure
Multiple directory traversal vulnerabilities in Podcast Generator 1.0 BETA 2 and earlier allow remote attackers to read
23RISK
open ↗Referência✓ VexDay Proof
Crysis 1.1.1.5879 - Remote Format String Denial of Service (PoC)
Format string vulnerability in the cryactio function in Crysis 1.1.1.5879 allows remote authenticated users to execute a
23RISK
open ↗Referência✓ VexDay Proof
KwsPHP Module ConcoursPhoto 2.0 - 'C_ID' SQL Injection
SQL injection vulnerability in the ConcoursPhoto module for KwsPHP allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
Clean CMS 1.5 - Blind SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in full_txt.php in Werner Hilversum Clean CMS 1.5 allows remote attackers to in
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.