Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
metajour 2.1 - 'system_path' Remote File Inclusion
PHP remote file inclusion vulnerability in METAjour 2.1, when register_globals is enabled, allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
BASE 1.2.4 - melissa Snort Frontend Remote File Inclusion
PHP remote file inclusion vulnerability in Basic Analysis and Security Engine (BASE) 1.2.4 and earlier, with register_gl
50RISK
open ↗Referência✓ VexDay Proof
WSN Links 2.22/2.23 - 'vote.php' SQL Injection
SQL injection vulnerability in vote.php in WSN Links 2.22 and 2.23 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
open-medium.CMS 0.25 - '404.php' Remote File Inclusion
PHP remote file inclusion vulnerability in 404.php in open-medium.CMS 0.25 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
gCards 1.45 - Multiple Vulnerabilities
Directory traversal vulnerability in inc/setLang.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
Mozilla Firefox 3.0.x - XML Parser Memory Corruption / Denial of Service (PoC)
Mozilla Firefox 3.0.8 and earlier 3.0.x versions allows remote attackers to cause a denial of service (memory corruption
23RISK
open ↗Referência✓ VexDay Proof
Gallery 2.0.3 - 'stepOrder[]' Remote Command Execution
Directory traversal vulnerability in Gallery 2.0.3 and earlier, and 2.1 before RC-2a, allows remote attackers to include
23RISK
open ↗Referência✓ VexDay Proof
isiAJAX 1 - 'praises.php?id' SQL Injection
SQL injection vulnerability in ejemplo/paises.php in isiAJAX 1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
e107 Plugin BLOG Engine 2.2 - 'rid' Blind SQL Injection
SQL injection vulnerability in comment.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
SoftComplex PHP Image Gallery 1.0 - Authentication Bypass
SQL injection vulnerability in index.php in SoftComplex PHP Image Gallery 1.0 allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
barcodegen 2.0.0 - Local File Inclusion
Directory traversal vulnerability in image.php in Barcode Generator 1D (barcodegen) 2.0.0 and earlier allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
wbstreet 1.0 - SQL Injection / File Disclosure
SQL injection vulnerability in show.php in Wbstreet (aka PHPSTREET Webboard) 1.0 allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
Mantis Bug Tracker 1.1.1 - Code Execution / Cross-Site Scripting / Cross-Site Request Forgery
Cross-site scripting (XSS) vulnerability in return_dynamic_filters.php in Mantis before 1.1.2 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Philex 0.2.3 - Remote File Inclusion / File Disclosure
PHP remote file inclusion vulnerability in header.inc.php in Philex 0.2.3 and earlier allows remote attackers to execute
45RISK
open ↗Referência✓ VexDay Proof
Spice Classifieds - 'cat_path' SQL Injection
SQL injection vulnerability in index.php in Spice Classifieds allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
ask_rave 0.9 PR - 'end.php?footfile' Remote File Inclusion
PHP remote file inclusion vulnerability in end.php in ask_rave 0.9 PR, and other versions before 0.9b, allows remote att
23RISK
open ↗Referência✓ VexDay Proof
AllMyGuests 0.3.0 - 'AMG_serverpath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in AllMyGuests 0.3.0 and earlier allow remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
Aztek Forum 4.00 - Cross-Site Scripting / SQL Injection
Cross-site scripting (XSS) vulnerability in Aztek Forum 4.0 allows remote attackers to inject arbitrary web script or HT
23RISK
open ↗Referência✓ VexDay Proof
webframe 0.76 - Multiple File Inclusions
Multiple PHP remote file inclusion vulnerabilities in WebFrame 0.76 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗Referência✓ VexDay Proof
Amaya 11.1 - W3C Editor/Browser (defer) Stack Overflow (PoC)
Stack-based buffer overflow in W3C Amaya Web Browser 11.1 allows remote attackers to execute arbitrary code via a script
28RISK
open ↗Referência✓ VexDay Proof
Multi SEO phpBB 1.1.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in include/global.php in Multi SEO phpBB 1.1.0 allows remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
DBImageGallery 1.2.2 - 'donsimg_base_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in DBImageGallery 1.2.2 allow remote attackers to execute arbitrary P
23RISK
open ↗Referência✓ VexDay Proof
FLDS 1.2a - 'report.php' SQL Injection
SQL injection vulnerability in report.php in Free Links Directory Script (FLDS) 1.2a allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
BXCP 0.2.9.9 - 'tid' SQL Injection
SQL injection vulnerability in index.php in BXCP 0.299 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Referência✓ VexDay Proof
BlogHelper - Remote Configuration File Disclosure
BlogHelper stores common_db.inc under the web root with insufficient access control, which allows remote attackers to do
23RISK
open ↗Referência✓ VexDay Proof
Calendar Script 1.1 - Authentication Bypass
SQL injection vulnerability in index.php in Nodstrum MySQL Calendar 1.1 and 1.2 allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Cartweaver 2.16.11 - 'ProdID' SQL Injection
Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote at
23RISK
open ↗Referência✓ VexDay Proof
SAWStudio 3.9i - '.prf' Local Buffer Overflow (PoC)
Buffer overflow in SAWStudio 3.9i allows user-assisted remote attackers to cause a denial of service (application crash)
28RISK
open ↗Referência✓ VexDay Proof
verlihub 0.9.8d-RC2 - Remote Command Execution
The cTrigger::DoIt function in src/ctrigger.cpp in the trigger mechanism in the daemon in Verlihub 0.9.8d-RC2 and earlie
23RISK
open ↗Referência✓ VexDay Proof
TxtBlog 1.0 Alpha - Local File Inclusion
Directory traversal vulnerability in index.php in TxtBlog 1.0 Alpha allows remote attackers to read arbitrary files via
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.