Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,864cataloged exploits
40,957CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,439VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Firefly Media Server 0.2.4 - Remote Denial of Service
webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (
23RISK
open ↗Referência✓ VexDay Proof
LBlog 1.05 - 'comments.asp' SQL Injection
SQL injection vulnerability in comments.asp in LBlog 1.05 and earlier allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component 'com_a6mambocredits' 1.0.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.a6mambocredits.php in the a6mambocredits component (com_a6mambocredits)
23RISK
open ↗Referência✓ VexDay Proof
PHP Homepage M 1.0 - 'galerie.php' SQL Injection
SQL injection vulnerability in galerie.php in PHP Homepage M (phpHPm) 1.0, when magic_quotes_gpc is disabled, allows rem
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Internet Explorer 6 - DirectX Media Remote Overflow Denial of Service
Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (crash) via a long Color attrib
35RISK
open ↗Referência✓ VexDay Proof
kubix 0.7 - Multiple Vulnerabilities
SQL injection vulnerability in includes/functions.php in Kubix 0.7 and earlier allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component AgoraGroup 0.3.5.3 - Blind SQL Injection
SQL injection vulnerability in the JoomlaMe AgoraGroups (aka AG or com_agoragroup) component 0.3.5.3 for Joomla! allows
23RISK
open ↗Referência✓ VexDay Proof
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that ge
45RISK
open ↗Referência✓ VexDay Proof
samPHPweb 4.2.2 - 'db.php' Remote File Inclusion
PHP remote file inclusion vulnerability in common/db.php in samPHPweb, possibly 4.2.2 and others, as provided with SAM B
23RISK
open ↗Referência✓ VexDay Proof
Apple iTouch/iPhone 1.1.1 - '.tif' Remote Privilege Escalation 'Jailbreak'
Unspecified vulnerability in Safari on the Apple iPod touch (aka iTouch) and iPhone 1.1.1 allows user-assisted remote at
23RISK
open ↗Referência✓ VexDay Proof
XMB 1.9.6 Final - 'basename()' Remote Command Execution
Directory traversal vulnerability in memcp.php in XMB (Extreme Message Board) 1.9.6 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
Remote Mouse GUI 3.008 - Local Privilege Escalation
Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by using
23RISK
open ↗Referência✓ VexDay Proof
File Upload Manager 1.0.6 - 'detail.asp' SQL Injection
SQL injection vulnerability in detail.asp in Mxmania File Upload Manager (FUM) 1.0.6 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
pSlash 0.7 - 'lvc_include_dir' Remote File Inclusion
PHP remote file inclusion vulnerability in modules/visitors2/include/config.inc.php in pSlash 0.70 allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
XBrite Members 1.1 - 'id' SQL Injection
SQL injection vulnerability in members.php in XBrite Members 1.1 and earlier allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Wikepage Opus 10 < 2006.2a (lng) - Remote Command Execution
Directory traversal vulnerability in index.php for Wikepage 2006.2a Opus 10 allows remote attackers to include arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Phaos 0.9.2 - 'basename()' Remote Command Execution
Directory traversal vulnerability in include_lang.php in Phaos 0.9.2 allows remote attackers to include arbitrary local
23RISK
open ↗Referência✓ VexDay Proof
Ay System CMS 2.6 - 'main.php' Remote File Inclusion
PHP remote file inclusion vulnerability in main.php in Ay System Solutions CMS 2.6 and earlier allows remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
phpGroupWare 0.9.16.010 - 'GLOBALS[]' Remote Code Execution
Directory traversal vulnerability in calendar/inc/class.holidaycalc.inc.php in phpGroupWare 0.9.16.010 and earlier allow
23RISK
open ↗Referência✓ VexDay Proof
Nokia Symbian 60 3rd Edition - Browser Crash (Denial of Service)
The Nokia Browser, possibly Nokia Symbian 60 Browser 3rd edition, allows remote attackers to cause a denial of service (
23RISK
open ↗Referência✓ VexDay Proof
2DayBiz Custom T-shirt Design - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in product.php in 2daybiz Custom T-shirt Design Script allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
Submitter Script - Authentication Bypass
Multiple SQL injection vulnerabilities in admin/index.php in Submitter Script 2 allow remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
Open Auto Classifieds 1.4.3b - SQL Injection
Multiple SQL injection vulnerabilities in Open Auto Classifieds 1.4.3b allow remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
Masir Camp E-Shop Module 3.0 - 'ordercode' SQL Injection
SQL injection vulnerability in index.php in Masir Camp E-Shop Module 3.0 and earlier allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component musepoes - 'aid' SQL Injection
SQL injection vulnerability in index.php in the buslicense (com_buslicense) component for Joomla! allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
my-gesuad 0.9.14 - Authentication Bypass / SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in myGesuad 0.9.14 (aka 0.9) allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
AJchat 0.10 - 'unse' SQL Injection
directory.php in AJchat 0.10 allows remote attackers to bypass input validation and conduct SQL injection attacks via a
23RISK
open ↗Referência✓ VexDay Proof
MaxCMS 2.0 - '/inc/ajax.asp' SQL Injection
SQL injection vulnerability in inc/ajax.asp in MaxCMS 2.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
DELTAScripts PHP Classifieds 7.5 - Authentication Bypass
SQL injection vulnerability in login.php in DeltaScripts PHP Classifieds 7.5 and earlier allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
Domain Seller Pro 1.5 - 'id' SQL Injection
SQL injection vulnerability in index.php in Domain Seller Pro 1.5 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.