Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
TurnkeyForms Web Hosting Directory - Multiple Vulnerabilities
TurnkeyForms Web Hosting Directory allows remote attackers to bypass authentication and (1) gain administrative privileg
23RISK
open ↗Referência✓ VexDay Proof
POP Peeper 3.4.0.0 - Date Remote Buffer Overflow
Stack-based buffer overflow in POP Peeper 3.4.0.0 and earlier allows remote POP3 servers to execute arbitrary code via a
50RISK
open ↗Referência✓ VexDay Proof
Stash 1.0.3 - Multiple SQL Injections
SQL injection vulnerability in Stash 1.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
Scriptsez Easy Image Downloader - Local File Download
Directory traversal vulnerability in main.php in ScriptsEz Easy Image Downloader allows remote attackers to read arbitra
23RISK
open ↗Referência✓ VexDay Proof
FreeBSD 7.0/7.1 - 'ktimer' Local Privilege Escalation
The ktimer feature (sys/kern/kern_time.c) in FreeBSD 7.0, 7.1, and 7.2 allows local users to overwrite arbitrary kernel
23RISK
open ↗Referência✓ VexDay Proof
KDPics 1.11 - 'exif.php?lib_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in KDPics 1.16 and earlier allow remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
FlashFXP 3.4.0 build 1145 - Remote Buffer Overflow (Denial of Service) (PoC)
FlashFXP 3.4.0 build 1145 allows remote servers to cause a denial of service (CPU consumption) via a response to a PWD c
23RISK
open ↗Referência✓ VexDay Proof
TorrentTrader Classic 1.07 - Multiple Vulnerabilities
Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic Edition 1.07 allows remote att
23RISK
open ↗Referência✓ VexDay Proof
ExBB 0.22 - Local/Remote File Inclusion
ExBB Italia 0.22 and earlier only checks GET requests that use the QUERY_STRING for certain path manipulations, which al
23RISK
open ↗Referência✓ VexDay Proof
Mantis Bug Tracker 1.1.1 - Code Execution / Cross-Site Scripting / Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in manage_user_create.php in Mantis 1.1.1 allows remote attackers to cre
23RISK
open ↗Referência✓ VexDay Proof
Observer 0.3.2.1 - Multiple Remote Command Execution Vulnerabilities
Observer 0.3.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the query
28RISK
open ↗Referência✓ VexDay Proof
XOOPS Module Tutoriais - 'viewcat.php' SQL Injection
SQL injection vulnerability in viewcat.php in the Tutoriais module for Xoops allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows Server 2000 SP4 (Advanced Server) - Message Queue (MS07-065)
Stack-based buffer overflow in the Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4, Window
50RISK
open ↗Referência✓ VexDay Proof
cPanel 11.x - 'Fantastico' Local File Inclusion
Directory traversal vulnerability in includes/xml.php in the Netenberg Fantastico De Luxe module before 2.10.4 r19 for c
23RISK
open ↗Referência✓ VexDay Proof
GeoVision LiveAudio - ActiveX Remote Freed-Memory Access
Use-after-free vulnerability in the LIVEAUDIO.LiveAudioCtrl.1 ActiveX control in LIVEAU~1.OCX 7.0 for GeoVision DVR syst
23RISK
open ↗Referência✓ VexDay Proof
BBClone 0.31 - 'selectlang.php' Remote File Inclusion
PHP remote file inclusion vulnerability in lib/selectlang.php in BBClone 0.31 allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
AT Contenator 1.0 - 'Root_To_Script' Remote File Inclusion
PHP remote file inclusion vulnerability in _admin/nav.php in AT Contenator 1.0 and earlier allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
CenterIM 4.22.3 - Remote Command Execution
CenterIM 4.22.3 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters
23RISK
open ↗Referência✓ VexDay Proof
Flat Chat 2.0 - 'include online.txt' Remote Code Execution
Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
OWLLib 1.0 - 'OWLMemoryProperty.php' Remote File Inclusion
PHP remote file inclusion vulnerability in memory/OWLMemoryProperty.php in OWLLib 1.0 allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Mozilla Firefox XSL - Parsing Remote Memory Corruption (PoC) (1)
The txMozillaXSLTProcessor::TransformToDoc function in Mozilla Firefox before 3.0.8 and SeaMonkey before 1.1.16 allows r
28RISK
open ↗Referência✓ VexDay Proof
BrowseDialog Class - 'ccrpbds6.dll' Multiple Denial of Service Vulnerabilities
A certain ActiveX control in the Common Controls Replacement Project (CCRP) CCRP BrowseDialog Server (ccrpbds6.dll) allo
23RISK
open ↗Referência✓ VexDay Proof
MyBulletinBoard (MyBB) 1.2.3 - Remote Code Execution
SQL injection vulnerability in the create_session function in class_session.php in MyBB (aka MyBulletinBoard) 1.2.3 and
23RISK
open ↗Referência✓ VexDay Proof
Kartli Alisveris Sistemi 1.0 - SQL Injection
SQL injection vulnerability in news.asp in Kartli Alisveris Sistemi (aka Free-PayPal-Shopping-Cart) 1.0 allows remote at
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module Zmagazine 1.0 - 'print.php' SQL Injection
SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as
23RISK
open ↗Referência✓ VexDay Proof
SineCMS 2.3.4 - Calendar SQL Injection
Multiple cross-site scripting (XSS) vulnerabilities in the guestbook in SineCMS 2.3.4 and earlier allow remote attackers
23RISK
open ↗Referência✓ VexDay Proof
WordPress Plugin Photo album - SQL Injection
Multiple SQL injection vulnerabilities in wppa.php in the WP Photo Album (WPPA) before 1.1 plugin for WordPress allow re
23RISK
open ↗Referência✓ VexDay Proof
pPIM 1.0 - Upload/Change Password
Unrestricted file upload vulnerability in upload.php in Phlatline's Personal Information Manager (pPIM) 1.0 and earlier
23RISK
open ↗Referência✓ VexDay Proof
Mambo Module Weather - 'absolute_path' Remote File Inclusion
PHP remote file inclusion vulnerability in mod_weather.php in the Antonis Ventouris Weather module for Mambo and Joomla!
23RISK
open ↗Referência✓ VexDay Proof
PrecisionID Datamatrix - ActiveX Arbitrary File Overwrite
Multiple insecure method vulnerabilities in PRECIS~2.DLL in the PrecisionID Datamatrix ActiveX control (DMATRIXLib.Datam
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.