Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,864cataloged exploits
40,957CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,439VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Borland Interbase 2007 - 'ibserver.exe' Buffer Overflow (PoC)
Stack-based buffer overflow in the database service (ibserver.exe) in Borland InterBase 2007 SP2 allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
cyberBB 0.6 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in cyberBB 0.6 allow remote authenticated users to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
Ad Board - 'id' SQL Injection
SQL injection vulnerability in trr.php in YourFreeWorld Ad Board Script allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows - SmbRelay3 NTLM Replay (MS08-068)
Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 20
50RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows - 'WRITE_ANDX' SMB Command Handling Kernel Denial of Service (Metasploit)
srv.sys in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1
50RISK
open ↗Referência✓ VexDay Proof
Attachmax Dolphin 2.1.0 - Multiple Vulnerabilities
PHP remote file inclusion vulnerability in config.php in Attachmax Dolphin 2.1.0 and earlier, when register_globals is e
23RISK
open ↗Referência✓ VexDay Proof
IP Reg 0.4 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in IP Reg 0.4 and earlier allow remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
EnjoySAP ActiveX rfcguisink.rfcguisink.1 - Remote Heap Overflow (PoC)
Heap-based buffer overflow in the rfcguisink.rfcguisink.1 ActiveX control in the EnjoySAP SAP GUI, on systems using ASCI
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows Explorer - '.zip' Denial of Service
Windows Explorer in Microsoft Windows XP SP3 allows user-assisted attackers to cause a denial of service (application cr
23RISK
open ↗Referência✓ VexDay Proof
Eurologon CMS - 'files.php' Arbitrary File Download
Directory traversal vulnerability in users/files.php in Eurologon CMS allows remote attackers to read arbitrary files vi
23RISK
open ↗Referência✓ VexDay Proof
BIND 9.x - Remote DNS Cache Poisoning
The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windo
60RISK
open ↗Referência✓ VexDay Proof
ibProArcade 3.3.0 - SQL Injection
SQL injection vulnerability in arcade.php in ibProArcade 3.3.0 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component Comments 0.5.8.5g - SQL Injection
SQL injection vulnerability in Phil Taylor Comments (com_comments, aka Review Script) 0.5.8.5g and earlier component for
23RISK
open ↗Referência✓ VexDay Proof
mIRC 6.34 - Remote Buffer Overflow
Stack-based buffer overflow in mIRC 6.34 allows remote attackers to execute arbitrary code via a long hostname in a PRIV
50RISK
open ↗Referência✓ VexDay Proof
ESET SysInspector 1.1.1.0 - 'esiadrv.sys' (PoC)
The SysInspector AntiStealth driver (esiasdrv.sys) 3.0.65535.0 in ESET System Analyzer Tool 1.1.1.0 allows local users t
23RISK
open ↗Referência✓ VexDay Proof
eXV2 Module WebChat 1.60 - 'roomid' SQL Injection
SQL injection vulnerability in index.php in the WebChat 1.60 module for eXV2 allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Real Estate Manager 1.01 - 'cat_id' SQL Injection
SQL injection vulnerability in realestate-index.php in Conkurent Real Estate Manager 1.01 allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
DESlock+ < 3.2.6 - Local Kernel Ring0 link list zero SYSTEM
DESlock+ 3.2.6 and earlier, when DLMFENC.sys 1.0.0.26 and DLMFDISK.sys 1.2.0.27 are present, allows local users to gain
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke Modules Okul 1.0 - 'okulid' SQL Injection
SQL injection vulnerability in modules.php in the Okul 1.0 module for PHP-Nuke allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
PHPcounter 1.3.2 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in PHPcounter 1.3.2 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
YourFreeWorld Classifieds Blaster - SQL Injection
SQL injection vulnerability in tr.php in YourFreeWorld Classifieds Blaster Script allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component Ricette 1.0 - SQL Injection
SQL injection vulnerability in index.php in the Giorgio Nordo Ricette (com_ricette) 1.0 component for Joomla! and Mambo
23RISK
open ↗Referência✓ VexDay Proof
phpQLAdmin 2.2.7 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in phpQLAdmin 2.2.7 allow remote attackers to execute arbitrary PHP c
28RISK
open ↗Referência✓ VexDay Proof
BlogPHP 2 - 'id' Cross-Site Scripting / SQL Injection
Cross-site scripting (XSS) vulnerability in index.php in BlogPHP 2.0 allows remote attackers to inject arbitrary web scr
23RISK
open ↗Referência✓ VexDay Proof
elvin bts 1.2.0 - Multiple Vulnerabilities
Elvin 1.2.0 allows remote attackers to read the PHP source code of (1) login.ei, (2) jump_bug.ei, or (3) create_account.
23RISK
open ↗Referência✓ VexDay Proof
GROUP-E 1.6.41 - 'head_auth.php' Remote File Inclusion
PHP remote file inclusion vulnerability in lib/head_auth.php in GROUP-E 1.6.41 allows remote attackers to execute arbitr
35RISK
open ↗Referência✓ VexDay Proof
The Everything Development System Pre-1.0 - SQL Injection
SQL injection vulnerability in cms/index.pl in The Everything Development Engine in The Everything Development System Pr
23RISK
open ↗Referência✓ VexDay Proof
bilboblog 2.1 - Multiple Vulnerabilities
admin/login.php in BilboBlog 0.2.1, when register_globals is enabled, allows remote attackers to bypass authentication a
23RISK
open ↗Referência✓ VexDay Proof
SafeNet 10.4.0.12 - 'IPSecDrv.sys' Local kernel Ring0 SYSTEM
IPSecDrv.sys 10.4.0.12 in SafeNET HighAssurance Remote and SoftRemote allows local users to gain privileges via a crafte
23RISK
open ↗Referência✓ VexDay Proof
Eurologon CMS - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Eurologon CMS allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.