Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
OpenGoo 1.1 - Local File Inclusion
Directory traversal vulnerability in upgrade/index.php in OpenGoo 1.1, when register_globals is enabled and magic_quotes
23RISK
open ↗Referência✓ VexDay Proof
NetProxy 4.03 - Web Filter Evasion / Bypass Logging
The connection log file implementation in Grok Developments NetProxy 4.03 does not record requests that omit http:// in
23RISK
open ↗Referência✓ VexDay Proof
ProSysInfo TFTP Server TFTPDWIN 0.4.2 - 'UDP' Denial of Service
tftpd.exe in ProSysInfo TFTP Server TFTPDWIN 0.4.2 allows remote attackers to cause a denial of service via a long UDP p
35RISK
open ↗Referência✓ VexDay Proof
BP Blog 7.0 - 'layout' SQL Injection
SQL injection vulnerability in the heme preview feature for default.asp in BP Blog 7.0 through 7.0.2 allows remote attac
23RISK
open ↗Referência✓ VexDay Proof
wbblog - Cross-Site Scripting / SQL Injection
SQL injection vulnerability in index.php in WBBlog allows remote attackers to execute arbitrary SQL commands via the e_i
23RISK
open ↗Referência✓ VexDay Proof
WebLog - 'index.php' Remote File Disclosure
Directory traversal vulnerability in index.php in Sascha Schroeder (aka CyberTeddy or Cyber-inside) WebLog allows remote
23RISK
open ↗Referência✓ VexDay Proof
Particle Blogger 1.2.0 - 'post.php?postid' SQL Injection
SQL injection vulnerability in post.php in Particle Blogger 1.0.0 through 1.2.0 allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Creative Files 1.2 - 'kommentare.php' SQL Injection
SQL injection vulnerability in kommentare.php in Creative Files 1.2 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
Triologic Media Player 7 - '.m3u' Local Heap Buffer Overflow (PoC)
Stack-based buffer overflow in Triologic Media Player 7 and 8.0.0.0 allows user-assisted remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
Mercur Messaging 2005 (Windows 2000 SP4) - IMAP 'Subscribe' Remote Overflow
Stack-based buffer overflow in Atrium MERCUR IMAPD allows remote attackers to have an unknown impact via a certain SUBSC
35RISK
open ↗Referência✓ VexDay Proof
Mozilla Firefox 3.0.5 - Status Bar Obfuscation / Clickjacking
Mozilla Firefox 3.0.5 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that
23RISK
open ↗Referência✓ VexDay Proof
Active PHP Bookmark Notes 0.2.5 - Remote File Inclusion
PHP remote file inclusion vulnerability in templates/head.php in Active PHP Bookmark Notes (APB) 0.2.5 and earlier allow
23RISK
open ↗Referência✓ VexDay Proof
Active Photo Gallery - 'catid' SQL Injection
SQL injection vulnerability in default.asp in ActiveWebSoftwares Active Photo Gallery allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
RoseOnlineCMS 3 beta2 - 'op' Local File Inclusion
Directory traversal vulnerability in index.php in RoseOnlineCMS 3 B1 allows remote attackers to include arbitrary files
23RISK
open ↗Referência✓ VexDay Proof
ClassWeb 2.0.3 - 'BASE' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in ClassWeb 2.03 and earlier allow remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
osData 2.08 Modules Php121 - Local File Inclusion
PHP remote file inclusion vulnerability in php121db.php in osDate 2.0.8 and possibly earlier versions allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
Philex 0.2.3 - Remote File Inclusion / File Disclosure
download.php in Philex 0.2.3 and earlier allows remote attackers to read arbitrary files and source code, and obtain sen
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component RWCards 2.4.3 - SQL Injection
SQL injection vulnerability in index.php in the RWCards (com_rwcards) 2.4.3 and earlier component for Joomla! allows rem
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Car Manager 1.1 - SQL Injection
SQL injection vulnerability in index.php in the Car Manager (com_resman) 1.1 and earlier component for Joomla! allows re
23RISK
open ↗Referência✓ VexDay Proof
Goople 1.8.2 - 'FrontPage.php' Blind SQL Injection
SQL injection vulnerability in frontpage.php in Goople CMS 1.8.2 and earlier allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
FreeBSD mcweject 0.9 'Eject' - Local Buffer Overflow / Local Privilege Escalation
Buffer overflow in eject.c in Jason W. Bacon mcweject 0.9 on FreeBSD, and possibly other versions, allows local users to
23RISK
open ↗Referência✓ VexDay Proof
C-Arbre 0.6PR7 - 'ROOT_PATH' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in C-Arbre 0.6PR7 and earlier allow remote attackers to execute arbit
28RISK
open ↗Referência✓ VexDay Proof
IceBB 1.0-rc5 - Remote Code Execution
Unrestricted file upload vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to upload arbitra
23RISK
open ↗Referência✓ VexDay Proof
NaviCOPA Web Server 2.01 - Remote Buffer Overflow (Metasploit)
Buffer overflow in InterVations NaviCOPA HTTP Server 2.01 allows remote attackers to execute arbitrary code via a long (
28RISK
open ↗Referência✓ VexDay Proof
eXtremail 2.1.1 - 'memmove()' Remote Denial of Service
Integer overflow in eXtremail 2.1.1 and earlier allows remote attackers to cause a denial of service, and possibly execu
28RISK
open ↗Referência✓ VexDay Proof
KwsPHP 1.0 Module Newsletter - SQL Injection
SQL injection vulnerability in index.php in the newsletter module 1.0 for KwsPHP, when magic_quotes_gpc is disabled, all
23RISK
open ↗Referência✓ VexDay Proof
Web Content System 2.7.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in manage/javascript/formjavascript.php in Ay System Solutions Web Content Syste
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke Module Eve-Nuke 0.1 - 'mysql.php' Remote File Inclusion
PHP remote file inclusion vulnerability in db/mysql.php in the Eve-Nuke 0.1 (EN-Forums) module for PHP-Nuke allows remot
23RISK
open ↗Referência✓ VexDay Proof
SquirrelMail G/PGP Encryption Plugin 2.0 - Command Execution
The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands v
28RISK
open ↗Referência✓ VexDay Proof
ClamAV 0.91.2 - libclamav MEW PE Buffer Overflow
Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.