Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Sabdrimer PRO 2.2.4 - 'pluginpath' Remote File Inclusion
PHP remote file inclusion vulnerability in skins/advanced/advanced1.php in Sabdrimer Pro 2.2.4, when register_globals is
23RISK
open ↗Referência✓ VexDay Proof
DCFM Blog 0.9.4 - SQL Injection
SQL injection vulnerability in comments.php in DCFM Blog 0.9.4 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
CCMS 3.1 Demo - SQL Injection
SQL injection vulnerability in admin.php/vars.php in CustomCMS (CCMS) 3.1 Demo allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
Active Auction Pro 7.1 - 'default.asp?catid' SQL Injection
SQL injection vulnerability in default.asp in ActiveWebSoftwares Active Auction Pro 7.1 allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
NMDeluxe 2.0.0 - 'id' SQL Injection
SQL injection vulnerability in index.php in NMDeluxe 2.0.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
runawaysoft haber portal 1.0 - 'tr' Multiple Vulnerabilities
SQL injection vulnerability in devami.asp in RunawaySoft Haber portal 1.0 allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
Nabopoll 1.2 - 'result.php?surv' Blind SQL Injection
SQL injection vulnerability in result.php in Nabopoll 1.2 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
Leap CMS 0.1.4 - SQL Injection / Cross-Site Scripting / Arbitrary File Upload
Unrestricted file upload vulnerability in Leap CMS 0.1.4 allows remote attackers to execute arbitrary code by uploading
23RISK
open ↗Referência✓ VexDay Proof
eNdonesia 8.4 - '/mod.php/friend.php/admin.php' Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in mod.php in eNdonesia 8.4 allow remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
QuickTime Player 7.3.1.70 - 'RTSP' Remote Buffer Overflow
Buffer overflow in Apple Quicktime Player 7.3.1.70 and other versions before 7.4.1, when RTSP tunneling is enabled, allo
28RISK
open ↗Referência✓ VexDay Proof
MyPHP CMS 0.3 - 'domain' Remote File Inclusion
PHP remote file inclusion vulnerability in styles/default/global_header.php in MyPHP CMS 0.3 and earlier, when register_
23RISK
open ↗Referência✓ VexDay Proof
See-Commerce 1.0.625 - 'owimg.php3' Remote File Inclusion
PHP remote file inclusion vulnerability in owimg.php3 in See-Commerce 1.0.625 and earlier allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
Globsy 1.0 - 'file' Remote File Disclosure
Directory traversal vulnerability in globsy_edit.php in Globsy 1.0 allows remote attackers to read arbitrary files via a
23RISK
open ↗Referência✓ VexDay Proof
THoRCMS 1.3.1 - 'phpbb_root_path' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/functions_cms.php in THoRCMS 1.3.1 allows remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke Module Docum - 'artid' SQL Injection
SQL injection vulnerability in the Docum module in PHP-Nuke allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Referência✓ VexDay Proof
Apple Mac OSX 10.5.0 (Leopard) - vpnd Remote Denial of Service (PoC)
The accept_connections function in the virtual private network daemon (vpnd) in Apple Mac OS X 10.5 before 10.5.4 allows
23RISK
open ↗Referência✓ VexDay Proof
OpenSiteAdmin 0.9.1.1 - Multiple File Inclusions
Multiple PHP remote file inclusion vulnerabilities in OpenSiteAdmin 0.9.1.1 and earlier allow remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
Woltlab Burning Board 3.0.x - Blind SQL Injection
SQL injection vulnerability in index.php in WoltLab Burning Board 3.0.3 PL 1 allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke Module My_eGallery 2.7.9 - SQL Injection
SQL injection vulnerability in the My_eGallery module for PHP-Nuke allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
Winamp 5.21 - '.Midi' File Header Handling Buffer Overflow (PoC)
Buffer overflow in in_midi.dll for WinAmp 2.90 up to 5.23, including 5.21, allows remote attackers to execute arbitrary
28RISK
open ↗Referência✓ VexDay Proof
Quintessential Player 4.50.1.82 - Playlist Denial of Service (PoC)
Buffer overflow in Quintessential Player 4.50.1.82 and earlier allows remote attackers to cause a denial of service (cra
23RISK
open ↗Referência✓ VexDay Proof
MDaemon POP3 Server < 9.06 - 'USER' Remote Buffer Overflow (PoC)
Multiple heap-based buffer overflows in the POP3 server in Alt-N Technologies MDaemon before 9.0.6 allow remote attacker
35RISK
open ↗Referência✓ VexDay Proof
aspWebLinks 2.0 - SQL Injection / Admin Pass Change
SQL injection vulnerability in links.asp in aspWebLinks 2.0 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Referência✓ VexDay Proof
Fastpublish CMS 1.6.9 - config[fsBase] Remote File Inclusion
PHP remote file inclusion vulnerability in Fastpublish CMS 1.6.9.d allows remote attackers to include arbitrary files vi
28RISK
open ↗Referência✓ VexDay Proof
MoinMoin 1.5.x - 'MOIND_ID' Cookie Login Bypass
Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via
28RISK
open ↗Referência✓ VexDay Proof
ITechBids 6.0 - 'item_id' SQL Injection
SQL injection vulnerability in detail.php in iTechBids Gold 6.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
CaLogic Calendars 1.2.2 - 'CLPath' Remote File Inclusion
PHP remote file inclusion vulnerability in CaLogic Calendars 1.2.2 allows remote attackers to execute arbitrary PHP code
23RISK
open ↗Referência✓ VexDay Proof
ActualAnalyzer - 'ant' Cookie Command Execution (Metasploit)
Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for pa
68RISK
open ↗Referência✓ VexDay Proof
pafileDB 2.0.1 - 'mxBB'/'phpBB' Remote File Inclusion
PHP remote file inclusion vulnerability in pafiledb_constants.php in Download Manager (mxBB pafiledb) integration, as us
23RISK
open ↗Referência✓ VexDay Proof
ImageStation - 'SonyISUpload.cab' 1.0.0.38 ActiveX Buffer Overflow
Buffer overflow in the Sony AxRUploadServer.AxRUploadControl.1 ActiveX control in AxRUploadServer.dll 1.0.0.38 in SonyIS
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.