Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
AJ Article 1.0 - Remote Authentication Bypass
AJ Square AJ Article allows remote attackers to bypass authentication and access administrator functionality via a direc
23RISK
open ↗Referência✓ VexDay Proof
TorrentTrader Classic 1.09 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
YourFreeWorld Scrolling Text Ads - SQL Injection
SQL injection vulnerability in tr1.php in YourFreeWorld Scrolling Text Ads Script allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
WinRAR 3.60 Beta 6 - SFX Path Local Stack Overflow
Stack-based buffer overflow in the SFX module in WinRAR before 3.60 beta 8 has unspecified vectors and impact.
23RISK
open ↗Referência✓ VexDay Proof
awzMB 4.2 Beta 1 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in awzMB 4.2 beta 1 and earlier allow remote attackers to execute arb
28RISK
open ↗Referência✓ VexDay Proof
Motorola Timbuktu Pro 8.6.5/8.7 - Directory Traversal / Log Injection
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu P
50RISK
open ↗Referência✓ VexDay Proof
WinRAR 3.60 Beta 6 (French) - SFX Path Local Stack Overflow
Stack-based buffer overflow in the SFX module in WinRAR before 3.60 beta 8 has unspecified vectors and impact.
23RISK
open ↗Referência✓ VexDay Proof
Dokuwiki 2009-02-14 - Local File Inclusion
inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote att
35RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows - NAT Helper Components 'ipnathlp.dll' Remote Denial of Service
Microsoft Windows NAT Helper Components (ipnathlp.dll) on Windows XP SP2, when Internet Connection Sharing is enabled, a
60RISK
open ↗Referência✓ VexDay Proof
IF-CMS 2.0 - 'id' Blind SQL Injection
SQL injection vulnerability in frame.php in Rhadrix If-CMS 2.07 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
OTSCMS 2.1.3 - Multiple Remote File Inclusions
PHP remote file inclusion vulnerability in OTSCMS/OTSCMS.php in Open Tibia Server Content Management System (OTSCMS) 1.0
23RISK
open ↗Referência✓ VexDay Proof
Ol BookMarks Manager 0.7.4 - 'root' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in ol'bookmarks 0.7.4 allow remote attackers to execute arbitrary PHP
28RISK
open ↗Referência✓ VexDay Proof
Torbstoff News 4 - 'pfad' Remote File Inclusion
PHP remote file inclusion vulnerability in news.php in Torbstoff News 4 allows remote attackers to execute arbitrary PHP
23RISK
open ↗Referência✓ VexDay Proof
PHP Live! 3.2.1 - 'help.php' Remote File Inclusion
PHP remote file inclusion vulnerability in OSI Codes PHP Live! 3.2.1 and earlier allows remote attackers to execute arbi
28RISK
open ↗Referência✓ VexDay Proof
Campsite 3.3.0 RC1 - Multiple Remote File Inclusions
Directory traversal vulnerability in admin-files/ad.php in Campsite 3.3.0 RC1 allows remote attackers to read and possib
23RISK
open ↗Referência✓ VexDay Proof
PHP123 Top Sites - 'category.php?cat' SQL Injection
SQL injection vulnerability in category.php in PHP123 Top Sites allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
Etomite CMS 0.6.1 - 'Username' SQL Injection (mq = off)
SQL injection vulnerability in manager/index.php in Etomite CMS 0.6.1 and earlier, with magic_quotes_gpc disabled, allow
23RISK
open ↗Referência✓ VexDay Proof
Audacity 1.2.6 - '.gro' Local Buffer Overflow (PoC)
Stack-based buffer overflow in the String_parse::get_nonspace_quoted function in lib-src/allegro/strparse.cpp in Audacit
28RISK
open ↗Referência✓ VexDay Proof
Opera 9.62 - 'file://' Local Heap Overflow
Heap-based buffer overflow in Opera 9.62 on Windows allows remote attackers to execute arbitrary code via a long file://
35RISK
open ↗Referência✓ VexDay Proof
WholeHogSoftware Password Protect - Insecure Cookie Handling
Whole Hog Password Protect: Enhanced 1.x allows remote attackers to bypass authentication and obtain administrative acce
23RISK
open ↗Referência✓ VexDay Proof
kawf 1.0 - 'main.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Johannes Erdfelt Kawf 1.0 and earlier allow remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
DreamPics Photo/Video Gallery - Blind SQL Injection
SQL injection vulnerability in index.php in Dreampics Gallery Builder allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows Wordpad - '.doc' File Local Denial of Service (PoC)
The WordPad Text Converter for Word 97 files in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2 allows r
35RISK
open ↗Referência✓ VexDay Proof
Enthrallweb eCars 1.0 - 'types.asp' SQL Injection
SQL injection vulnerability in Types.asp in Enthrallweb eCars 1.0 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Live Ticker 1.0 - Blind SQL Injection
SQL injection vulnerability in the Live Ticker (com_liveticker) module 1.0 for Joomla! allows remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
DMXReady Secure Document Library 1.1 - SQL Injection
SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Secure Document Library 1.1 and ear
23RISK
open ↗Referência✓ VexDay Proof
DM FileManager 3.9.2 - Authentication Bypass
Multiple SQL injection vulnerabilities in login.php in DM FileManager 3.9.2, when magic_quotes_gpc is disabled, allow re
23RISK
open ↗Referência✓ VexDay Proof
Kipper 2.01 - Cross-Site Scripting / Local File Inclusion / File Disclosure
Directory traversal vulnerability in index.php in Kipper 2.01 allows remote attackers to include and execute arbitrary l
23RISK
open ↗Referência✓ VexDay Proof
Sepcity Shopping Mall - SQL Injection
SQL injection vulnerability in shpdetails.asp in SepCity Shopping Mall allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Pixel8 Web Photo Album 3.0 - SQL Injection
SQL injection vulnerability in Photo.asp in Jay Patel Pixel8 Web Photo Album 3.0 allows remote attackers to execute arbi
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.