Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
blogme 3.0 - Cross-Site Scripting / Authentication Bypass
Multiple cross-site scripting (XSS) vulnerabilities in comments.asp in BlogMe 3.0 allow remote attackers to inject arbit
23RISK
open ↗Referência✓ VexDay Proof
PHPManta 1.0.2 - 'view-sourcecode.php' Local File Inclusion
Directory traversal vulnerability in Mdoc/view-sourcecode.php for phpManta 1.0.2 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Evince Document Viewer - 'DocumentMedia' Remote Buffer Overflow
Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows u
28RISK
open ↗Referência✓ VexDay Proof
BBaCE 3.5 - '/includes/functions.php' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/functions.php in Bulletin Board Ace (BBaCE) 3.5 and earlier allows r
23RISK
open ↗Referência✓ VexDay Proof
phpDynaSite 3.2.2 - 'racine' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in phpDynaSite 3.2.2 and earlier allow remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
BolinOS 4.6.1 - Local File Inclusion / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in BolinOS 4.6.1 allow remote attackers to inject arbitrary web scri
23RISK
open ↗Referência✓ VexDay Proof
Free Image Hosting 1.0 - 'forgot_pass.php' File Inclusion
PHP remote file inclusion vulnerability in forgot_pass.php in Free Image Hosting 1.0 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
QnECMS 2.5.6 - 'adminfolderpath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in QnECMS 2.5.6 and earlier allow remote attackers to execute arbitra
28RISK
open ↗Referência✓ VexDay Proof
Open Meetings Filing Application - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Rhode Island Open Meetings Filing Application (OMFA) allow remote
28RISK
open ↗Referência✓ VexDay Proof
ClipShare 2.6 - Remote User Password Change
ClipShare 2.6 does not properly restrict access to certain functionality, which allows remote attackers to change the pr
23RISK
open ↗Referência✓ VexDay Proof
phpBB lat2cyr Mod 1.0.1 - 'lat2cyr.php' Remote File Inclusion
PHP remote file inclusion vulnerability in lat2cyr.php in the lat2cyr 1.0.1 and earlier phpbb module allows remote attac
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Office 2003 - '.PPT' Local Buffer Overflow (PoC)
PowerPoint in Microsoft Office 2003 does not properly handle a container object whose position value exceeds the record
28RISK
open ↗Referência✓ VexDay Proof
LiveCMS 3.4 - 'categoria.php?cid' SQL Injection
Cross-site scripting (XSS) vulnerability in LiveCMS 3.4 and earlier allows remote attackers to inject arbitrary web scri
23RISK
open ↗Referência✓ VexDay Proof
EnjoySAP ActiveX rfcguisink.rfcguisink.1 - Remote Heap Overflow (PoC)
Multiple unspecified vulnerabilities in ActiveX controls in the EnjoySAP SAP GUI allow remote attackers to create certai
23RISK
open ↗Referência✓ VexDay Proof
Globsy 1.0 - 'file' Remote File Disclosure
Directory traversal vulnerability in globsy_edit.php in Globsy 1.0 allows remote attackers to read arbitrary files via a
23RISK
open ↗Referência✓ VexDay Proof
LiveCMS 3.4 - 'categoria.php?cid' SQL Injection
Unrestricted file upload vulnerability in LiveCMS 3.4 and earlier allows remote attackers to upload and execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
pivot 1.40.4-7 - Multiple Vulnerabilities
pivot/tb.php in Pivot 1.40.4 and 1.40.7 allows remote attackers to obtain sensitive information via an invalid url param
23RISK
open ↗Referência✓ VexDay Proof
NuSchool 1.0 - 'CampusNewsDetails.asp' SQL Injection
SQL injection vulnerability in CampusNewsDetails.asp in Dynamic Dataworx NuSchool 1.0 allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
faceStones personal 2.0.42 - 'fs_form_links.php' File Inclusion
PHP remote file inclusion vulnerability in fsl2/objects/fs_form_links.php in faceStones Personal 2.0.42 and earlier allo
23RISK
open ↗Referência✓ VexDay Proof
vm Watermark for Gallery 0.4.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in watermark.php in the vm (aka Jean-Francois Laflamme) watermark 0.4.1 mod for
23RISK
open ↗Referência✓ VexDay Proof
TinyPHP Forum 3.6 - 'profile.php' Remote Code Execution
Directory traversal vulnerability in profile.php in TinyPHPforum 3.6 and earlier allows remote attackers to include and
23RISK
open ↗Referência✓ VexDay Proof
PHlyMail Lite 3.4.4 - 'mod.listmail.php' Remote File Inclusion
PHP remote file inclusion vulnerability in handlers/email/mod.listmail.php in PHlyMail Lite 3.4.4 and earlier (Build 3.0
23RISK
open ↗Referência✓ VexDay Proof
NES Game and NES System c108122 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in NES Game and NES System c108122 and earlier allow remote attackers
28RISK
open ↗Referência✓ VexDay Proof
aspwebalbum 3.2 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in album.asp in Full Revolution aspWebAlbum 3.2 allows remote attackers to inje
23RISK
open ↗Referência✓ VexDay Proof
Kjtechforce mailman b1 - Delete Row 'code' SQL Injection
Multiple SQL injection vulnerabilities in Kjtechforce mailman beta1, when magic_quotes_gpc is disabled, allow remote att
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component User Home Pages 0.5 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in (1) uhp_config.php, and possibly (2) footer.php, (3) functions.php
28RISK
open ↗Referência✓ VexDay Proof
Mambo Component Sitemap 2.0.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in sitemap.xml.php in Sitemap component (com_sitemap) 2.0.0 for Mambo 4.5.1 CMS,
23RISK
open ↗Referência✓ VexDay Proof
Free Hosting Manager 1.2/2.0 - Insecure Cookie Handling
Free Hosting Manager 1.2 and 2.0 allows remote attackers to bypass authentication and gain administrative access by sett
23RISK
open ↗Referência✓ VexDay Proof
cmsWorks 2.2 RC4 - 'mod_root' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/include/lib.module.php in cmsWorks 2.2 RC4, when register_globals is en
23RISK
open ↗Referência✓ VexDay Proof
GameSiteScript 3.1 - profile id SQL Injection
SQL injection vulnerability in index.php in GameSiteScript (gss) 3.1 and earlier allows remote attackers to execute arbi
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.