Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Microsoft Windows Server 2000 SP4 (Advanced Server) - Message Queue (MS07-065)
Stack-based buffer overflow in the Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4, Window
50RISK
open ↗Referência✓ VexDay Proof
iziContents rc6 - Local/Remote File Inclusion
Multiple incomplete blacklist vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
Sun jre1.6.0_X - isInstalled.dnsResolve Function Overflow
Buffer overflow in the Sun Java Web Start ActiveX control in Java Runtime Environment (JRE) 1.6.0_X allows remote attack
28RISK
open ↗Referência✓ VexDay Proof
ExBB 0.22 - Local/Remote File Inclusion
ExBB Italia 0.22 and earlier only checks GET requests that use the QUERY_STRING for certain path manipulations, which al
23RISK
open ↗Referência✓ VexDay Proof
Mantis Bug Tracker 1.1.1 - Code Execution / Cross-Site Scripting / Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in manage_user_create.php in Mantis 1.1.1 allows remote attackers to cre
23RISK
open ↗Referência✓ VexDay Proof
ablespace 1.0 - Cross-Site Scripting / Blind SQL Injection
Multiple cross-site scripting (XSS) vulnerabilities in AbleSpace 1.0 allow remote attackers to inject arbitrary web scri
23RISK
open ↗Referência✓ VexDay Proof
Apple QuickTime 7.5.5 / iTunes 8.0 - Remote Off-by-One Crash
Buffer overflow in Apple QuickTime 7.5.5 and iTunes 8.0 allows remote attackers to cause a denial of service (browser cr
28RISK
open ↗Referência✓ VexDay Proof
XAMPP for Windows 1.6.0a - 'mssql_connect()' Remote Buffer Overflow
Multiple SQL injection vulnerabilities in XAMPP 1.6.0a for Windows allow remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
OpenBSD 4.2 - 'rtlabel_id2name()' Local Null Pointer Dereference Denial of Service
OpenBSD 4.2 allows local users to cause a denial of service (kernel panic) by calling the SIOCGIFRTLABEL IOCTL on an int
23RISK
open ↗Referência✓ VexDay Proof
NEPT Image Uploader 1.0 - Arbitrary File Upload
Unrestricted file upload vulnerability in uploadp.php in New Earth Programming Team (NEPT) imgupload (aka Image Uploader
23RISK
open ↗Referência✓ VexDay Proof
DGNews 3.0 Beta - 'id' SQL Injection
SQL injection vulnerability in berita.php in Dian Gemilang DGNews 3.0 Beta allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Social Groupie - 'create_album.php' Arbitrary File Upload
Unrestricted file upload vulnerability in Photos/create_album.php in Social Groupie allows remote authenticated users to
23RISK
open ↗Referência✓ VexDay Proof
Q-Shop 3.0 - Cross-Site Scripting / SQL Injection
Cross-site scripting (XSS) vulnerability in search.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attac
23RISK
open ↗Referência✓ VexDay Proof
KwsPHP 1.0 stats Module - SQL Injection
Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via (1) th
23RISK
open ↗Referência✓ VexDay Proof
Ipswitch WS_FTP Home/Professional FTP Client - Remote Format String (PoC)
Buffer overflow in Ipswitch WS_FTP Home client allows remote FTP servers to have an unknown impact via a long "message r
28RISK
open ↗Referência✓ VexDay Proof
T.G.S. CMS 0.1.7 - 'logout.php' SQL Injection
SQL injection vulnerability in logout.php in T.G.S. CMS 0.1.7 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
Q-Shop 3.0 - Cross-Site Scripting / SQL Injection
SQL injection vulnerability in users.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
Web Wiz Rich Text Editor 4.0 - Multiple Vulnerabilities
Directory traversal vulnerability in RTE_file_browser.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to lis
23RISK
open ↗Referência✓ VexDay Proof
PGOSD - '/misc/function.php3' Remote File Inclusion
PHP remote file inclusion vulnerability in misc/function.php3 in PHP Generator of Object SQL Database (PGOSD), when regi
23RISK
open ↗Referência✓ VexDay Proof
XM Easy Personal FTP Server 5.2.1 - Remote Denial of Service
XM Easy Personal FTP Server 5.2.1 and earlier allows remote authenticated users to cause a denial of service via a long
23RISK
open ↗Referência✓ VexDay Proof
bugmall shopping cart 2.5 - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in BugMall Shopping Cart 2.5 and earlier allows remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
CodeBB 1.0 Beta 2 - 'phpbb_root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in CodeBB 1.1b3 and earlier allow remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
Realty Web-Base 1.0 - Authentication Bypass
Multiple SQL injection vulnerabilities in admin/admin.php in Realty Webware Technologies Realty Web-Base 1.0 allow remot
23RISK
open ↗Referência✓ VexDay Proof
SFS EZ Software - 'id' SQL Injection
SQL injection vulnerability in software-description.php in Scripts For Sites (SFS) Hotscripts-like Site allows remote at
23RISK
open ↗Referência✓ VexDay Proof
PHP 4.4.6 - 'crack_opendict()' Local Buffer Overflow
Buffer overflow in the crack extension (CrackLib), as bundled with PHP 4.4.6 and other versions before 5.0.0, might allo
23RISK
open ↗Referência✓ VexDay Proof
ContentNow 1.4.1 - Arbitrary File Upload / Cross-Site Scripting
Unrestricted file upload vulnerability in upload.php in ContentNow CMS 1.4.1 allows remote authenticated users to execut
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows - GDI+ '.ICO' Remote Division By Zero
gdiplus.dll in GDI+ in Microsoft Windows XP SP3 does not properly handle crafted .ico files, which allows remote attacke
28RISK
open ↗Referência✓ VexDay Proof
PHP League 0.82 - 'classement.php' SQL Injection
SQL injection vulnerability in consult/classement.php in Uni-Vert PhpLeague 0.82 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Pre Shopping Mall - Insecure Cookie Handling
Pre Shopping Mall allows remote attackers to bypass authentication and gain administrative access by setting the (1) adm
23RISK
open ↗Referência✓ VexDay Proof
SetCMS 3.6.5 - Remote Command Execution
Directory traversal vulnerability in index.php in SetCMS 3.6.5 allows remote attackers to include and execute arbitrary
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.