Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Kipper 2.01 - Cross-Site Scripting / Local File Inclusion / File Disclosure
Directory traversal vulnerability in index.php in Kipper 2.01 allows remote attackers to include and execute arbitrary l
23RISK
open ↗Referência✓ VexDay Proof
MyKtools 2.4 - 'langage' Local File Inclusion
Directory traversal vulnerability in update.php in MyKtools 2.4 allows remote attackers to include and execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Ice Gallery 0.5b2 - 'catid' Blind SQL Injection
SQL injection vulnerability in the Ice Gallery (com_ice) component 0.5 beta 2 for Joomla! allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
Motorola Wimax modem CPEi300 - File Disclosure / Cross-Site Scripting
Directory traversal vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated users to re
23RISK
open ↗Referência✓ VexDay Proof
Lycos FileUploader Control - ActiveX Remote Buffer Overflow
Heap-based buffer overflow in the FileUploader.FUploadCtl.1 ActiveX control in FileUploader.dll 2.0.0.2 in Lycos FileUpl
28RISK
open ↗Referência✓ VexDay Proof
CMS NetCat 3.0/3.12 - Blind SQL Injection
SQL injection vulnerability in modules/poll/index.php in AIST NetCat 3.0 and 3.12 allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow
Stack-based buffer overflow in the HTML parser in IntelliTamper 2.0.7 allows remote attackers to execute arbitrary code
23RISK
open ↗Referência✓ VexDay Proof
Absolute FAQ Manager 6.0 - Insecure Cookie Handling
Xigla Software Absolute FAQ Manager.NET 6.0 allows remote attackers to bypass authentication and gain administrative acc
23RISK
open ↗Referência✓ VexDay Proof
Absolute News Feed 1.0 - Remote Insecure Cookie Handling
Xigla Software Absolute News Feed 1.0 and possibly 1.5 allows remote attackers to bypass authentication and gain adminis
23RISK
open ↗Referência✓ VexDay Proof
WOW Web On Windows ActiveX Control 2 - Remote Code Execution
Multiple insecure method vulnerabilities in the Web On Windows (WOW) ActiveX control in WOW ActiveX 2 allow remote attac
23RISK
open ↗Referência✓ VexDay Proof
IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow
Stack-based buffer overflow in the HTML parser in IntelliTamper 2.0.7 allows remote attackers to execute arbitrary code
23RISK
open ↗Referência✓ VexDay Proof
QuestCMS - Cross-Site Scripting / Directory Traversal / SQL Injection
Directory traversal vulnerability in main/main.php in QuestCMS allows remote attackers to read arbitrary local files via
23RISK
open ↗Referência✓ VexDay Proof
PHPMyManga 0.8.1 - 'template.php' Multiple File Inclusions
Multiple PHP remote file inclusion vulnerabilities in template.php in Phpmymanga 0.8.1 and earlier allow remote attacker
23RISK
open ↗Referência✓ VexDay Proof
Xfire 1.6.4 - Remote Denial of Service
Xfire 1.64 and earlier allows remote attackers to cause a denial of service (client application crash) via a long string
23RISK
open ↗Referência✓ VexDay Proof
phpBB ACP User Registration Mod 1.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/functions_mod_user.php in the ACP User Registration (MMW) 1.00 modul
23RISK
open ↗Referência✓ VexDay Proof
WinFTP Server 2.3.0 - 'LIST' (Authenticated) Remote Buffer Overflow
Stack-based buffer overflow in WFTPSRV.exe in WinFTP 2.3.0 allows remote authenticated users to execute arbitrary code v
23RISK
open ↗Referência✓ VexDay Proof
Exhibit Engine 1.5 RC 4 - 'photo_comment.php' File Inclusion
PHP remote file inclusion vulnerability in photo_comment.php in Exhibit Engine 1.5 RC 4 and earlier allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
vTiger CRM 4.2 - 'calpath' Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Vtiger CRM 4.2 and earlier allow remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
LoveCMS 1.6.2 Final - Update Settings
LoveCMS 1.6.2 does not require administrative authentication for (1) addblock.php, (2) blocks.php, and (3) themes.php in
23RISK
open ↗Referência✓ VexDay Proof
Script Toko Online 5.01 - SQL Injection
SQL injection vulnerability in shop_display_products.php in Script Toko Online 5.01 allows remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
212Cafe Board 0.07 - 'qID' SQL Injection
SQL injection vulnerability in view.php in 212cafe Board 0.07 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
phpMyTeam 2.0 - 'smileys_dir' Remote File Inclusion
PHP remote file inclusion vulnerability in images/smileys/smileys_packs.php in phpMyTeam 2.0, when register_globals is e
23RISK
open ↗Referência✓ VexDay Proof
Getleft 1.2 - Remote Buffer Overflow (PoC)
Multiple buffer overflows in Getleft.exe in Andres Garcia Getleft 1.2 allow remote attackers to cause a denial of servic
23RISK
open ↗Referência✓ VexDay Proof
vbzoom 1.x - 'forum.php?MainID' SQL Injection
SQL injection vulnerability in forum.php in VBZooM 1.11 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Referência✓ VexDay Proof
2532/Gigs 1.2.2 Stable - Remote Authentication Bypass
Multiple SQL injection vulnerabilities in checkuser.php in 2532designs 2532|Gigs 1.2.2 Stable, when magic_quotes_gpc is
23RISK
open ↗Referência✓ VexDay Proof
Mini-stream RM-MP3 Converter 3.0.0.7 - '.asx' Local Buffer Overflow
Multiple stack-based buffer overflows in Mini-stream Easy RM-MP3 Converter 3.0.0.7 allow remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
MyioSoft Ajax Portal 3.0 - 'page' SQL Injection
SQL injection vulnerability in ajaxp_backend.php in MyioSoft AjaxPortal 3.0 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows - '.chm' Denial of Service (HTML Compiled)
Buffer overflow in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (memory corruption and
35RISK
open ↗Referência✓ VexDay Proof
Xitami Web Server 2.5c2 - LRWP Processing Format String (PoC)
Format string vulnerability in Xitami Web Server 2.2a through 2.5c2, and possibly other versions, allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
A-Blog 2.0 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in A-Blog 2 allow remote attackers to execute arbitrary PHP code via
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.