Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,865cataloged exploits
40,957CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,440VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
phpclanwebsite 1.23.3 fix pack #5 - Multiple Vulnerabilities
Multiple directory traversal vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quote
23RISK
open ↗Referência✓ VexDay Proof
PHP recommend 1.3 - Authentication Bypass / Remote File Inclusion / Code Injection
PHP remote file inclusion vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
PHPWebThings 1.4 - 'msg'/'forum' SQL Injection
SQL injection vulnerability in forum.php in PHPWebThings 1.4 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Referência✓ VexDay Proof
SiteAdmin CMS - 'art' SQL Injection
SQL injection vulnerability in line2.php in SiteAdmin allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Referência✓ VexDay Proof
nuseo PHP enterprise 1.6 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin/nuseo_admin_d.php in NuSEO PHP Enterprise 1.6 (NuSEO.PHP), when registe
23RISK
open ↗Referência✓ VexDay Proof
wywo inout board 1.0 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in While You Were Out (WYWO) InOut Board 1.0 allow remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
MGB 0.5.4.5 - 'email.php?id' SQL Injection
SQL injection vulnerability in email.php in MGB OpenSource Guestbook 0.5.4.5 and earlier allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
PostNuke 0.764 - Blind SQL Injection
The pnVarPrepForStore function in PostNuke 0.764 and earlier skips input sanitization when magic_quotes_runtime is enabl
23RISK
open ↗Referência✓ VexDay Proof
Danneo CMS 0.5.1 - Blind SQL Injection
SQL injection vulnerability in index.php in Danneo CMS 0.5.1 and earlier, when the Referers statistics option is enabled
23RISK
open ↗Referência✓ VexDay Proof
Linux Kernel 2.6.21.1 - IPv6 Jumbo Bug Remote Denial of Service
The Linux kernel 2.6.20 through 2.6.21.1 allows remote attackers to cause a denial of service (panic) via a certain IPv6
28RISK
open ↗Referência✓ VexDay Proof
PHP-RESIDENCE 0.7.2 - 'Search' SQL Injection
SQL injection vulnerability in visualizza_tabelle.php in php-residence 0.7.2 and 1.0 allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
GrapAgenda 0.1 - 'page' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in GrapAgenda 0.11 and earlier, when register_globals is enabled, a
23RISK
open ↗Referência✓ VexDay Proof
Siteframe CMS 3.2.3 - 'folder.php' SQL Injection
SQL injection vulnerability in folder.php in Siteframe CMS 3.2.3 and earlier, and Siteframe Beaumont 5.0.5 and earlier,
23RISK
open ↗Referência✓ VexDay Proof
clickandemail - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in admin_dblayers.asp in ClickAndEmail allows remote attackers to inject arbitr
23RISK
open ↗Referência✓ VexDay Proof
phpBB2 Plus 1.53 - Acronym Mod SQL Injection
SQL injection vulnerability in admin/admin_acronyms.php in the Acronym Mod 0.9.5 for phpBB2 Plus 1.53 allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
Blog:CMS 4.2.1b - SQL Injection / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in BLOG:CMS 4.2.1b allow remote attackers to inject arbitrary web sc
23RISK
open ↗Referência✓ VexDay Proof
alitalk 1.9.1.1 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in aliTalk 1.9.1.1, when magic_quotes_gpc is disabled, allow remote authenticated
23RISK
open ↗Referência✓ VexDay Proof
Easy-Clanpage 2.2 - 'id' SQL Injection
SQL injection vulnerability in index.php in the gallery module in Easy-Clanpage 2.2 allows remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
KML share 1.1 - 'region.php?layer' Remote File Disclosure
Directory traversal vulnerability in region.php in KML share 1.1 allows remote attackers to read arbitrary files via a .
23RISK
open ↗Referência✓ VexDay Proof
Simple Machines Forum (SMF) 1.1.6 - Code Execution
Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 all
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module XFsection 1.07 - 'articleId' Blind SQL Injection
SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as
23RISK
open ↗Referência✓ VexDay Proof
Yet Another NOCC 0.1.0 - Local File Inclusion
Directory traversal vulnerability in check_lang.php in Yet Another NOCC (YANOCC) 0.1.0 and earlier allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
Mole 2.1.0 - 'viewsource.php' Remote File Disclosure
Multiple directory traversal vulnerabilities in viewsource.php in Make our Life Easy (Mole) 2.1.0 allow remote attackers
23RISK
open ↗Referência✓ VexDay Proof
aflog 1.01 - Cross-Site Scripting / SQL Injection
Multiple SQL injection vulnerabilities in aflog 1.01, and possibly earlier versions, allow remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
Frimousse 0.0.2 - 'explorerdir.php' Local Directory Traversal
Absolute path traversal vulnerability in explorerdir.php in Frimousse 0.0.2 allows remote attackers to read arbitrary fi
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke 8.0 Final - 'sid' SQL Injection
SQL injection vulnerability in index.php in the Search module in PHP-Nuke 8.0 FINAL and earlier, when magic_quotes_gpc i
23RISK
open ↗Referência✓ VexDay Proof
Apple iTunes 8.0.2.20/QuickTime 7.5.5 - '.mov' Multiple Off By Overflows (PoC)
Stack-based buffer overflow in Apple QuickTime Player 7.5.5 and iTunes 8.0.2.20 allows remote attackers to cause a denia
23RISK
open ↗Referência✓ VexDay Proof
OwnRS blog beta3 - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in clanek.php in OwnRS Beta 3 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
Flatnuke 3 - Remote Command Execution / Privilege Escalation
index.php in the File Manager module in Flatnuke 3 allows remote attackers to obtain sensitive information via an invali
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke Module AddressBook 1.2 - Local File Inclusion
Directory traversal vulnerability in addressbook.php in the Addressbook 1.2 module for PHP-Nuke allows remote attackers
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.