Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Rapid Classified 3.1 - Database Disclosure
Rapid Classified 3.1 and 3.15 stores sensitive information under the web root with insufficient access control, which al
23RISK
open ↗Referência✓ VexDay Proof
AWStats Totals 1.14 - 'AWStatstotals.php' Remote Code Execution
awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences
50RISK
open ↗Referência✓ VexDay Proof
impleo music Collection 2.0 - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Impleo Music Collection 2.0 allows remote attackers to inject a
23RISK
open ↗Referência✓ VexDay Proof
PHPVID 0.9.9 - 'categories_type.php' SQL Injection
SQL injection vulnerability in categories_type.php in phpVID 0.9.9 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
ASP EDGE 1.2b - 'user.asp' SQL Injection
SQL injection vulnerability in user.asp in ASP EDGE 1.2b and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
SQLiteWebAdmin 0.1 - 'tpl.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in tpl.inc.php in Falko Timme and Till Brehm SQLiteWebAdmin 0.1 and earlier allo
23RISK
open ↗Referência✓ VexDay Proof
UBBCentral UBB.Threads 6.4.x < 6.5.2 - 'thispath' Remote File Inclusion
PHP remote file inclusion vulnerability in addpost_newpoll.php in UBB.threads 6.4 through 6.5.2 and 6.5.1.1 (trial) allo
23RISK
open ↗Referência✓ VexDay Proof
WSN Guest 1.21 - 'id' SQL Injection
SQL injection vulnerability in comments.php in WSN Guest 1.02 and 1.21 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
TaskDriver 1.2 - Authentication Bypass / SQL Injection
Multiple SQL injection vulnerabilities in TaskDriver 1.2 and earlier allow remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
LiveCMS 3.4 - 'categoria.php?cid' SQL Injection
SQL injection vulnerability in categoria.php in LiveCMS 3.4 and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Joomlaradio 5.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.joomlaradiov5.php in the Joomla Radio 5 (com_joomlaradiov5) component f
35RISK
open ↗Referência✓ VexDay Proof
PHPwebnews 0.2 MySQL Edition - 'id_kat' SQL Injection
SQL injection vulnerability in index.php in phpWebNews 0.2 MySQL Edition allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
The Net Guys ASPired2Poll - Remote Database Disclosure
The Net Guys ASPired2poll stores sensitive information under the web root with insufficient access control, which allows
23RISK
open ↗Referência✓ VexDay Proof
phpDatingClub 3.7 - SQL Injection / Cross-Site Scripting Injection
Cross-site scripting (XSS) vulnerability in website.php in phpDatingClub 3.7 allows remote attackers to inject arbitrary
23RISK
open ↗Referência✓ VexDay Proof
AdMan 1.1.20070907 - 'campaignId' SQL Injection
SQL injection vulnerability in editCampaign.php in AdMan 1.1.20070907 allows remote authenticated users to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Shop-Script FREE 2.0 - Remote Command Execution
admin.php in Shop-Script FREE 2.0 and earlier sends a redirect to the web browser but does not exit when administrative
23RISK
open ↗Referência✓ VexDay Proof
Matterdaddy Market 1.1 - 'index.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in index.php in Matterdaddy Market 1.1, when magic_quotes_gpc is disabled, allow
23RISK
open ↗Referência✓ VexDay Proof
Squirrelcart 2.2.0 - 'cart_content.php' Remote File Inclusion
PHP remote file inclusion vulnerability in cart_content.php in Squirrelcart 2.2.2 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
DevelopItEasy Photo Gallery 1.2 - SQL Injection
Multiple SQL injection vulnerabilities in DevelopItEasy Photo Gallery 1.2 allow remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
Sepcity Lawyer Portal - SQL Injection
SQL injection vulnerability in deptdisplay.asp in SepCity Faculty Portal allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
TSEP 0.942 - 'colorswitch.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Olaf Noehring The Search Engine Project (TSEP) 0.942 and earlier a
23RISK
open ↗Referência✓ VexDay Proof
Jupiter CMS 1.1.5 - 'Client-IP' SQL Injection
Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
Pligg CMS 9.9.0 - Cross-Site Scripting / Local File Inclusion / SQL Injection
Multiple directory traversal vulnerabilities in Pligg 9.9 and earlier allow remote attackers to (1) determine the existe
23RISK
open ↗Referência✓ VexDay Proof
FlashGameScript 1.7 - 'user' SQL Injection
SQL injection vulnerability in index.php in FlashGameScript 1.7 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
ACG News 1.0 - 'aid'/'catid' SQL Injection
Multiple SQL injection vulnerabilities in index.php in ACG News 1.0 allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
DataLife Engine 4.1 - SQL Injection
SQL injection vulnerability in index.php in DataLife Engine 4.1 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
CPCommerce 1.2.8 - 'id_document' Blind SQL Injection
SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
Md-Pro 1.0.8x - Topics topicid SQL Injection
SQL injection vulnerability in index.php in MAXdev MDPro (MD-Pro) 1.0.8x and earlier before 20070720 allows remote attac
23RISK
open ↗Referência✓ VexDay Proof
Online Keyword Research Tool - 'download.php' File Disclosure
Directory traversal vulnerability in download.php in eMetrix Online Keyword Research Tool allows remote attackers to rea
23RISK
open ↗Referência✓ VexDay Proof
MailMachine Pro 2.2.4 - SQL Injection
SQL injection vulnerability in showMsg.php in MailMachine Pro 2.2.4, and other versions before 2.2.6, allows remote atta
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.