Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
V3 Chat Live Support 3.0.4 - Insecure Cookie Handling
admin/index.php in V3 Chat Live Support 3.0.4 allows remote attackers to bypass authentication and gain administrative a
23RISK
open ↗Referência✓ VexDay Proof
Siemens C450IP/C475IP - Remote Denial of Service
Siemens C450 IP and C475 IP VoIP devices allow remote attackers to cause a denial of service (disconnected calls and dev
23RISK
open ↗Referência✓ VexDay Proof
Page Manager CMS 2006-02-04 - Arbitrary File Upload
Unrestricted file upload vulnerability in upload.php in Page Manager 2006-02-04 allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Woltlab Burning Board 1.0.2/2.3.6 - 'search.php' SQL Injection (1)
SQL injection vulnerability in search.php in Woltlab Burning Board (wBB) 1.0.2 and earlier, and 2.3.6 and earlier in the
23RISK
open ↗Referência✓ VexDay Proof
ItCMS 1.9 - 'boxpop.php' Remote Code Execution
Static code injection vulnerability in box/minichat/boxpop.php in IT!CMS (aka itcms) 1.9 allows remote attackers to inje
23RISK
open ↗Referência✓ VexDay Proof
vBulletin Radio and TV Player AddOn - HTML Injection
Cross-site scripting (XSS) vulnerability in forum/radioandtv.php in the Radio and TV Player addon for vBulletin allows r
23RISK
open ↗Referência✓ VexDay Proof
PHP Jokesite 2.0 - 'cat_id' SQL Injection
SQL injection vulnerability in jokes_category.php in PHP-Jokesite 2.0 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
NmnNewsletter 1.0.7 - 'output' Remote File Inclusion
PHP remote file inclusion vulnerability in confirmUnsubscription.php in NmnNewsletter 1.0.7 allows remote attackers to e
23RISK
open ↗Referência✓ VexDay Proof
Brim 2.0.0 - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in the Tasks plugin in Brim 2.0.0, when magic_quotes_gpc is disabled, allows remote authenti
23RISK
open ↗Referência✓ VexDay Proof
Google Chrome - 'ChromeHTML://' Remote Parameter Injection
Argument injection vulnerability in Google Chrome 1.0.154.36 on Windows XP SP3 allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
CFAGCMS 1 - SQL Injection
SQL injection vulnerability in right.php in Cant Find A Gaming CMS (CFAGCMS) 1.0 Beta 1 allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
Easy Px 41 CMS 09.00.00B1 - 'fiche' Local File Inclusion
Directory traversal vulnerability in index.php in Easy PX 41 CMS 9.0 B1 allows remote attackers to include and execute a
23RISK
open ↗Referência✓ VexDay Proof
Reciprocal Links Manager 1.1 - 'site' SQL Injection
SQL injection vulnerability in index.php in Reciprocal Links Manager 1.1 allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
FaceBook PhotoUploader 5.0.14.0 - Remote Buffer Overflow
Heap-based buffer overflow in the Facebook PhotoUploader ActiveX control 5.0.14.0 and earlier allows remote attackers to
50RISK
open ↗Referência✓ VexDay Proof
bilboblog 2.1 - Multiple Vulnerabilities
BilboBlog 0.2.1 allows remote attackers to obtain sensitive information via (1) an enable_cache=false query string to fo
23RISK
open ↗Referência✓ VexDay Proof
FlashChat 4.5.7 - 'aedating4CMS.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in FlashChat before 4.6.2 allow remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
EZWebAlbum - Insecure Cookie Handling
constants.inc in EZWebAlbum 1.0 allows remote attackers to bypass authentication and gain administrator privileges by se
23RISK
open ↗Referência✓ VexDay Proof
Bradabra 2.0.5 - '/include/includes.php' Remote File Inclusion
PHP remote file inclusion vulnerability in include/includes.php in Bradabra 2.0.5 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Diesel Joke Site - 'picture_category.php' SQL Injection
SQL injection vulnerability in picture_category.php in Diesel Joke Site allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
WinRemotePC Full+Lite 2008 r.2server - Denial of Service
WRPCServer.exe in WinSoftMagic WinRemotePC (WRPC) Lite 2008 and Full 2008 allows remote attackers to cause a denial of s
28RISK
open ↗Referência✓ VexDay Proof
Frontis 3.9.01.24 - 'source_class' SQL Injection
SQL injection vulnerability in bin/aps_browse_sources.php in Frontis 3.9.01.24 allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
TCPDB 3.8 - Arbitrary Add Admin Account
user/index.php in TCPDB 3.8 does not require administrative authentication, which allows remote attackers to add admin a
23RISK
open ↗Referência✓ VexDay Proof
snap - seccomp BBlacklist for TIOCSTI can be Circumvented
Snapd seccomp filter TIOCSTI ioctl bypass
33RISK
open ↗Referência✓ VexDay Proof
XM Easy Personal FTP Server 5.6.0 - Remote Denial of Service
XM Easy Personal FTP Server 5.6.0 allows remote authenticated users to cause a denial of service via a crafted argument
50RISK
open ↗Referência✓ VexDay Proof
eIQnetworks ESA SEARCHREPORT - Remote Overflow (Metasploit)
Stack-based buffer overflow in eIQNetworks Enterprise Security Analyzer (ESA) 2.5 allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
PolDoc CMS 0.96 - 'download_file.php' File Disclosure
Directory traversal vulnerability in download_file.php in PolDoc CMS (aka PDDMS) 0.96 allows remote attackers to read ar
23RISK
open ↗Referência✓ VexDay Proof
MX-System 2.7.3 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in MxBB (aka MX-System) Portal 2.7.3 allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
ProArcadeScript 1.3 - 'random' SQL Injection
SQL injection vulnerability in ProArcadeScript 1.3 allows remote attackers to execute arbitrary SQL commands via the ran
23RISK
open ↗Referência✓ VexDay Proof
Acoustica Mixcraft 4.2 - Universal Stack Overflow (SEH)
Stack-based buffer overflow in Acoustica Mixcraft 4.1 Build 96 and 4.2 Build 98 allows user-assisted attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
Teraway FileStream 1.0 - Insecure Cookie Handling
Teraway FileStream 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the tw
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.