Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
JAF CMS 4.0 RC2 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in just another flat file (JAF) CMS 4.0 RC2 allow remote attackers to
35RISK
open ↗Referência✓ VexDay Proof
xKiosk 3.0.1i - 'xkurl.php?PEARPATH' Remote File Inclusion
PHP remote file inclusion vulnerability in system/funcs/xkurl.php in xKiosk WEB 3.0.1i, when register_globals is enabled
23RISK
open ↗Referência✓ VexDay Proof
phpCommunityCalendar 4.0.3 - Cross-Site Scripting / SQL Injection
Multiple SQL injection vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
ZeeReviews - SQL Injection
SQL injection vulnerability in comments.php in ZeeScripts Reviews Opinions Rating Posting Engine Web-Site PHP Script (ak
23RISK
open ↗Referência✓ VexDay Proof
Hammer Software MetaGauge 1.0.0.17 - Directory Traversal
Directory traversal vulnerability in MetaGauge 1.0.0.17, and probably other versions before 1.0.3.38, allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
ViPlay3 < 3.00 - '.vpl' Local Stack Overflow (PoC)
Stack-based buffer overflow in URUWorks ViPlay3 3.0 and earlier allows remote attackers to cause a denial of service (cr
23RISK
open ↗Referência✓ VexDay Proof
PHP121 Instant Messenger 1.4 - Remote Code Execution
SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
Barracuda Web Application Firewall - Authentication Bypass
Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a perm
28RISK
open ↗Referência✓ VexDay Proof
Gateway Weblaunch - ActiveX Control Insecure Method
Multiple stack-based buffer overflows in the WebLaunch.WeblaunchCtl.1 (aka CWebLaunchCtl) ActiveX control in weblaunch.o
28RISK
open ↗Referência✓ VexDay Proof
cPanel 11.x - Cross-Site Scripting / Local File Inclusion
Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Mo
23RISK
open ↗Referência✓ VexDay Proof
osTicket 1.12 - Persistent Cross-Site Scripting via File Upload
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upl
23RISK
open ↗Referência✓ VexDay Proof
zeeproperty - 'adid' SQL Injection
SQL injection vulnerability in bannerclick.php in ZeeScripts Zeeproperty allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
Online Booking Manager 2.2 - 'id' SQL Injection
SQL injection vulnerability in checkavail.php in SoftVisions Software Online Booking Manager (obm) 2.2 allows remote att
23RISK
open ↗Referência✓ VexDay Proof
Dagger CMS 2008 - 'dir_inc' Remote File Inclusion
PHP remote file inclusion vulnerability in skins/default.php in Geody Labs Dagger - The Cutting Edge r12feb2008, when re
23RISK
open ↗Referência✓ VexDay Proof
CMS little 0.0.1 - 'template' Local File Inclusion
Directory traversal vulnerability in index.php in CMS little 0.0.1 allows remote attackers to include and execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
XchangeBoard 1.70 - 'boardID' SQL Injection
SQL injection vulnerability in newThread.php in XchangeBoard 1.70 Final and earlier allows remote authenticated users to
23RISK
open ↗Referência✓ VexDay Proof
OpenInvoice 0.9 - Arbitrary Change User Password
resetpass.php in openInvoice 0.90 beta and earlier allows remote authenticated users to change the passwords of arbitrar
23RISK
open ↗Referência✓ VexDay Proof
PHPfan 3.3.4 - 'init.php' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/init.php in phpFan 3.3.4 allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Efestech Shop 2.0 - 'cat_id' SQL Injection
SQL injection vulnerability in default.asp in EfesTECH Shop 2.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
CMS NetCat 3.12 - Multiple Vulnerabilities
Multiple open redirect vulnerabilities in AIST NetCat 3.12 and earlier allow remote attackers to redirect users to arbit
23RISK
open ↗Referência✓ VexDay Proof
Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit)
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RISK
open ↗Referência✓ VexDay Proof
123tkShop 0.9.1 - Remote Authentication Bypass
SQL injection vulnerability in shop/mainfile.php in 123tkShop 0.9.1 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
2DayBiz Business Community Script - Multiple Vulnerabilities
SQL injection vulnerability in admin/member_details.php in 2daybiz Business Community Script allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
NetHoteles 3.0 - 'ficha.php' SQL Injection
SQL injection vulnerability in publico/ficha.php in NetHoteles 3.0 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component gigCalendar 1.0 - SQL Injection
SQL injection vulnerability in the GigCalendar (com_gigcal) component 1.0 for Mambo and Joomla! allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
wpQuiz 2.7 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the id
23RISK
open ↗Referência✓ VexDay Proof
Intel 2200BG 802.11 - disassociation packet Kernel Memory Corruption
The Intel 2200BG 802.11 Wireless Mini-PCI driver 9.0.3.9 (w29n51.sys) allows remote attackers to cause a denial of servi
23RISK
open ↗Referência✓ VexDay Proof
Domain Seller Pro 1.5 - 'id' SQL Injection
SQL injection vulnerability in index.php in Domain Seller Pro 1.5 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
Pre ADS Portal 2.0 - SQL Injection
Multiple SQL injection vulnerabilities in Pre ADS Portal 2.0 and earlier, when magic_quotes_gpc is disabled, allow remot
23RISK
open ↗Referência✓ VexDay Proof
Mambo 4.6.4 - 'Output.php' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4.6.4 and e
43RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.