Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
OWLLib 1.0 - 'OWLMemoryProperty.php' Remote File Inclusion
PHP remote file inclusion vulnerability in memory/OWLMemoryProperty.php in OWLLib 1.0 allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
BrowseDialog Class - 'ccrpbds6.dll' Multiple Denial of Service Vulnerabilities
A certain ActiveX control in the Common Controls Replacement Project (CCRP) CCRP BrowseDialog Server (ccrpbds6.dll) allo
23RISK
open ↗Referência✓ VexDay Proof
MyBulletinBoard (MyBB) 1.2.3 - Remote Code Execution
SQL injection vulnerability in the create_session function in class_session.php in MyBB (aka MyBulletinBoard) 1.2.3 and
23RISK
open ↗Referência✓ VexDay Proof
Kartli Alisveris Sistemi 1.0 - SQL Injection
SQL injection vulnerability in news.asp in Kartli Alisveris Sistemi (aka Free-PayPal-Shopping-Cart) 1.0 allows remote at
23RISK
open ↗Referência✓ VexDay Proof
ACG-ScriptShop - 'cid' SQL Injection
SQL injection vulnerability in index.php in ACG-ScriptShop E-Gold Script Shop allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
addalink 4 - 'category_id' SQL Injection
SQL injection vulnerability in user_read_links.php in Addalink 1.0 beta 4 and earlier, when magic_quotes_gpc is disabled
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows Media Player - '.mid' Integer Overflow (PoC)
Integer overflow in Microsoft Windows Media Player (WMP) 11.0.5721.5260 allows remote attackers to cause a denial of ser
28RISK
open ↗Referência✓ VexDay Proof
CA Internet Security Suite 2008 - 'SaveToFile()' File Corruption (PoC)
Directory traversal vulnerability in the UmxEventCli.CachedAuditDataList.1 (aka UmxEventCliLib) ActiveX control in UmxEv
28RISK
open ↗Referência✓ VexDay Proof
Wordsmith 1.1b - 'config.inc.php?_path' Remote File Inclusion
PHP remote file inclusion vulnerability in config.inc.php in Wordsmith 1.0 RC1, when register_globals is enabled, allows
35RISK
open ↗Referência✓ VexDay Proof
Dew-NewPHPLinks 2.0 - Local File Inclusion / Cross-Site Scripting
Directory traversal vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to read arbitrary files vi
23RISK
open ↗Referência✓ VexDay Proof
Quick.Cart 2.2 - Local/Remote File Inclusion / Remote Code Execution
config/general.php in Quick.Cart 2.2 and earlier uses a default username and password, which allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Zanfi CMS lite / Jaw Portal free - 'page' SQL Injection
SQL injection vulnerability in index.php in Jaw Portal and Zanfi CMS lite and allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
KwsPHP - 'Upload' Remote Code Execution
Directory traversal vulnerability in help.php in the eskuel module in KwsPHP 1.3.456, as available before 20080416, allo
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module Zmagazine 1.0 - 'print.php' SQL Injection
SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as
23RISK
open ↗Referência✓ VexDay Proof
SineCMS 2.3.4 - Calendar SQL Injection
Multiple cross-site scripting (XSS) vulnerabilities in the guestbook in SineCMS 2.3.4 and earlier allow remote attackers
23RISK
open ↗Referência✓ VexDay Proof
WordPress Plugin Photo album - SQL Injection
Multiple SQL injection vulnerabilities in wppa.php in the WP Photo Album (WPPA) before 1.1 plugin for WordPress allow re
23RISK
open ↗Referência✓ VexDay Proof
MemHT Portal 3.9.0 - Remote Create Shell
cron.php in MemHT Portal 3.9.0 and earlier allows remote attackers to obtain sensitive information via a direct request,
23RISK
open ↗Referência✓ VexDay Proof
GLLCTS2 < 4.2.4 - 'detail' SQL Injection
SQL injection vulnerability in login.php in Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
RoomPHPlanning 1.5 - Arbitrary Add Admin
admin/userform.php in RoomPHPlanning 1.5 does not require administrative credentials, which allows remote authenticated
23RISK
open ↗Referência✓ VexDay Proof
PostNuke Module pnEncyclopedia 0.2.0 - SQL Injection
SQL injection vulnerability in the pnEncyclopedia module 0.2.0 and earlier for PostNuke allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
PollMentor 2.0 - 'pollmentorres.asp?id' SQL Injection
SQL injection vulnerability in admin_poll.asp in PollMentor 2.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
PHPCC 4.2 Beta - 'nickpage.php?npid' SQL Injection
SQL injection vulnerability in nickpage.php in phpCC 4.2 beta and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
AROUNDMe 0.7.7 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in barnraiser AROUNDMe 0.7.7 allow remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
Boa 0.93.15 - HTTP Basic Authentication Bypass
The Intersil isl3893 extensions for Boa 0.93.15, as used on the FreeLan RO80211G-AP and other devices, do not prevent st
50RISK
open ↗Referência✓ VexDay Proof
iScripts EasyIndex - 'produid' SQL Injection
SQL injection vulnerability in detaillist.php in iScripts EasyIndex, possibly 1.0, allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
PrecisionID Datamatrix - ActiveX Arbitrary File Overwrite
Multiple insecure method vulnerabilities in PRECIS~2.DLL in the PrecisionID Datamatrix ActiveX control (DMATRIXLib.Datam
23RISK
open ↗Referência✓ VexDay Proof
IPSwitch IMail Server 8.0x - Remote Heap Overflow
Heap-based buffer overflow in iaspam.dll in the SMTP Server in Ipswitch IMail Server 8.01 through 8.11 allows remote att
23RISK
open ↗Referência✓ VexDay Proof
Mambo Module Weather - 'absolute_path' Remote File Inclusion
PHP remote file inclusion vulnerability in mod_weather.php in the Antonis Ventouris Weather module for Mambo and Joomla!
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke addon Nuke Mobile Entartainment 1.0 - Local File Inclusion
Directory traversal vulnerability in data/compatible.php in the Nuke Mobile Entertainment 1 addon for PHP-Nuke allows re
23RISK
open ↗Referência✓ VexDay Proof
Airsensor M520 - HTTPd Remote Denial of Service / Buffer Overflow (PoC)
Multiple buffer overflows in the AirDefense Airsensor M520 with firmware 4.3.1.1 and 4.4.1.4 allow remote authenticated
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.