Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to register arbitrary users via a request to host
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Office Products - Array Index Bounds Error (PoC)
MSO.DLL in Microsoft Office 2000, Office XP (2002), and Office 2003 allows user-assisted attackers to cause a denial of
28RISK
open ↗Referência✓ VexDay Proof
PG Matchmaking Script - Multiple SQL Injections
SQL injection vulnerability in PG Matchmaking allows remote attackers to execute arbitrary SQL commands via the id param
23RISK
open ↗Referência✓ VexDay Proof
Apple Mac OSX Safari 2.0.3 (417.9.2) - 'ROWSPAN' Denial of Service (PoC)
Apple Mac OS X Safari 2.0.3, 1.3.1, and possibly other versions allows remote attackers to cause a denial of service (CP
23RISK
open ↗Referência✓ VexDay Proof
Limbo CMS 1.0.4.2 - 'sql.php' Remote File Inclusion
PHP remote file inclusion vulnerability in classes/adodbt/sql.php in Limbo CMS 1.04 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
Aardvark Topsites PHP 4.2.2 - 'lostpw.php' Remote File Inclusion
PHP remote file inclusion vulnerability in sources/lostpw.php in Aardvark Topsites PHP 4.2.2 and earlier, when register_
23RISK
open ↗Referência✓ VexDay Proof
PhpReactor 1.2.7pl1 - 'pathtohomedir' Remote File Inclusion
PHP remote file inclusion vulnerability in editprofile.php in php(Reactor) 1.27pl1 allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
ACal 2.2.6 - 'day.php' Remote File Inclusion
PHP remote file inclusion vulnerability in day.php in ACal 2.2.6 allows remote attackers to execute arbitrary PHP code v
23RISK
open ↗Referência✓ VexDay Proof
GuildFTPd 0.999.8.11/0.999.14 - Heap Corruption (PoC) / Denial of Service
GuildFTPd 0.999.14, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possib
50RISK
open ↗Referência✓ VexDay Proof
Flat PHP Board 1.2 - Multiple Vulnerabilities
index.php in Flat PHP Board 1.2 and earlier allows remote authenticated users to obtain the password for the current use
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component JD-Wiki 1.0.2 - Remote File Inclusion
PHP remote file inclusion vulnerability in lib/tpl/default/main.php in the JD-Wiki Component (com_jd-wiki) 1.0.2 and ear
23RISK
open ↗Referência✓ VexDay Proof
MVCnPHP 3.0 - glConf[path_libraries] Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Tony Bibbs and Vincent Furia MVCnPHP 3.0 allow remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
phpPrintAnalyzer 1.2 - Remote File Inclusion
PHP remote file inclusion vulnerability in inc/header.inc.php in phpPrintAnalyzer 1.2 and earlier allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
CityWriter 0.9.7 - 'head.php' Remote File Inclusion
PHP remote file inclusion vulnerability in head.php in CityWriter 0.9.7 allows remote attackers to execute arbitrary PHP
23RISK
open ↗Referência✓ VexDay Proof
ftp Admin 0.1.0 - Local File Inclusion / Cross-Site Scripting / Authentication Bypass
Cross-site scripting (XSS) vulnerability in index.php in FTP Admin 0.1.0 allows remote attackers to inject arbitrary web
23RISK
open ↗Referência✓ VexDay Proof
tellmatic 1.0.7 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in tellmatic 1.0.7 allow remote attackers to execute arbitrary PHP co
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component User Home Pages 0.5 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in (1) uhp_config.php, and possibly (2) footer.php, (3) functions.php
28RISK
open ↗Referência✓ VexDay Proof
SFS EZ Auction - Blind SQL Injection
SQL injection vulnerability in viewfaqs.php in Scripts for Sites (SFS) EZ Auction allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
E-topbiz Number Links 1 - 'id' SQL Injection
SQL injection vulnerability in admin/admin_catalog.php in e-topbiz Number Links 1 Php Script allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Apple Safari / QuickTime 7.3 - RTSP Content-Type Remote Buffer Overflow
Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac
50RISK
open ↗Referência✓ VexDay Proof
Fantastic News 2.1.4 - Multiple Remote File Inclusions
PHP remote file inclusion vulnerability in headlines.php in Fantastic News 2.1.4, and possibly earlier, allows remote at
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component live chat - SQL Injection / Open Proxy
SQL injection vulnerability in the Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
MyCard 1.0.2 - 'id' SQL Injection
SQL injection vulnerability in gallery.php in MyCard 1.0.2 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
deeemm CMS (dmcms) 0.7.4 - Multiple Vulnerabilities
SQL injection vulnerability in index.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
ASPSiteWare Home Builder 1.0/2.0 - SQL Injection
Multiple SQL injection vulnerabilities in ASPSiteWare HomeBuilder 1.0 and 2.0 allow remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
PHPKIT 1.6.4pl1 - 'article.php' SQL Injection
SQL injection vulnerability in pkinc/public/article.php in PHPKIT 1.6.4pl1 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
DevMass Shopping Cart 1.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin/kfm/initialise.php in DevMass Shopping Cart 1.0 and earlier allows remo
23RISK
open ↗Referência✓ VexDay Proof
AJSquare Free Polling Script - 'DB' Multiple Vulnerabilities
SQL injection vulnerability in admin/include/newpoll.php in AJ Square Free Polling Script (AJPoll) Database version allo
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component mambads 1.0 RC1 Beta - SQL Injection
SQL injection vulnerability in the MambAds (com_mambads) component 1.0 RC1 Beta and 1.0 RC1 for Mambo allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
myEvent 1.6 - 'eventdate' SQL Injection
SQL injection vulnerability in viewevent.php in myEvent 1.6 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.