Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,057cataloged exploits
36,288CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,460Referência 22,910GitHub PoC 14,997VulnCheck XDB 8,843Nuclei 4,358Metasploit 3,489✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Mercury/32 4.52 IMAPD - 'SEARCH' (Authenticated) Overflow
Stack-based buffer overflow in IMAPD in Mercury/32 4.52 allows remote authenticated users to execute arbitrary code via
23RISK
open ↗Referência✓ VexDay Proof
LunarPoll 1.0 - 'show.php?PollDir' Remote File Inclusion
PHP remote file inclusion vulnerability in show.php in LunarPoll, when register_globals is enabled, allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
idmos-phoenix CMS - 'aural.php' Remote File Inclusion
PHP remote file inclusion vulnerability in core/aural.php in IDMOS 1.0-beta (aka Phoenix) allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
WzdFTPD 0.8.0 - 'USER' Remote Denial of Service
Off-by-one error in the do_login_loop function in libwzd-core/wzd_login.c in wzdftpd 0.8.0, 0.8.2, and possibly other ve
23RISK
open ↗Referência✓ VexDay Proof
Gradman 0.1.3 - 'agregar_info.php' Local File Inclusion
Directory traversal vulnerability in agregar_info.php in GradMan 0.1.3 and earlier allows remote attackers to include an
23RISK
open ↗Referência✓ VexDay Proof
TinyFTPD 1.4 - 'USER' Remote Buffer Overflow (Denial of Service) (PoC)
Buffer overflow in Tiny FTPd 1.4 and earlier allows remote attackers to cause a denial of service (daemon crash) via a l
23RISK
open ↗Referência✓ VexDay Proof
HispaH Model Search - 'cat.php?cat' SQL Injection
SQL injection vulnerability in cat.php in HispaH Model Search allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
Battle Blog 1.25 - 'uploadform.asp' Arbitrary File Upload
Unrestricted file upload vulnerability in admin/uploadform.asp in Battle Blog 1.25 allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
XCMS 1.82 - Local/Remote File Inclusion
Multiple directory traversal vulnerabilities in index.php in XCMS 1.82 and earlier allow remote attackers to read arbitr
23RISK
open ↗Referência✓ VexDay Proof
427bb 2.3.1 - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in showpost.php in 427BB 2.3.1 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
GeBlog 0.1 (Windows) - GLOBALS[tplname] Local File Inclusion
Directory traversal vulnerability in index.php in GeBlog 0.1 allows remote attackers to include and execute arbitrary lo
23RISK
open ↗Referência✓ VexDay Proof
PostNuke pnFlashGames Module 1.5 - SQL Injection
SQL injection vulnerability in index.php in the pnFlashGames 1.5 module for PostNuke allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
YouTube blog 0.1 - Remote File Inclusion / SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in mensaje.php in C. Desseno YouTube Blog (ytb) 0.1 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Libc - 'libc:fts_*()' Local Denial of Service
Integer overflow in the fts_build function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0
23RISK
open ↗Referência✓ VexDay Proof
TLM CMS 3.2 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in TLM CMS 3.2 allow remote attackers to execute arbitrary SQL commands via (1) t
23RISK
open ↗Referência✓ VexDay Proof
PhpHostBot 1.06 - 'svr_rootscript' Remote File Inclusion
PHP remote file inclusion vulnerability in order/login.php in IDevSpot PhpHostBot 1.06 and earlier allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
e107 module 123 flash chat 6.8.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in 123flashchat.php in the 123 Flash Chat 6.8.0 module for e107, when register_g
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Jotloader 1.2.1.a - Blind SQL Injection
SQL injection vulnerability in the JotLoader (com_jotloader) component 1.2.1.a and earlier for Joomla! allows remote att
23RISK
open ↗Referência✓ VexDay Proof
TFT Gallery 0.10 - Password Disclosure
TFT Gallery 0.10 stores sensitive information under the web root with insufficient access control, which allows remote a
23RISK
open ↗Referência✓ VexDay Proof
SezHoo 0.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in SezHooTabsAndActions.php in SezHoo 0.1 allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
TemaTres 1.0.3 - Authentication Bypass / SQL Injection / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in TemaTres 1.0.3 and 1.031 allow remote attackers to inject arbitra
23RISK
open ↗Referência✓ VexDay Proof
PHPMyDesk 1.0 Beta - 'viewticket.php' Local File Inclusion
Directory traversal vulnerability in pmd-config.php in PHPMyDesk 1.0beta allows remote attackers to include arbitrary lo
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Flash Image Gallery - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.wmtgallery.php in the webmaster-tips.net Flash Image Gallery (com_wmtga
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component wmtportfolio 1.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.wmtportfolio.php in the webmaster-tips.net wmtportfolio 1.0 (com_wmtpor
23RISK
open ↗Referência✓ VexDay Proof
Social Engine 2.0 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in Social Engine 2.0 allow remote attackers to include and execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
FlashBlog - 'articulo_id' SQL Injection
SQL injection vulnerability in php/leer_comentarios.php in FlashBlog allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
ISPworker 1.21 - 'download.php' Remote File Disclosure
Multiple directory traversal vulnerabilities in download.php in ISPworker 1.21 allow remote attackers to read arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component equotes 0.9.4 - SQL Injection
SQL injection vulnerability in the eQuotes (com_equotes) component 0.9.4 for Joomla! allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
InteliEditor 1.2.x - 'lib.editor.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in lib.editor.inc.php in Intelimen InteliEditor 1.2.x allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Aigaion 1.2.1 - 'DIR' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Aigaion Web based bibliography management system 1.2.1 and earlier
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.