Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Mundi Mail 0.8.2 - 'top' Remote File Inclusion
PHP remote file inclusion vulnerability in template/simpledefault/admin/_masterlayout.php in Mundi Mail 0.8.2, when regi
23RISK
open ↗Referência✓ VexDay Proof
PHPDirector 0.21 - 'videos.php?id' SQL Injection
SQL injection vulnerability in videos.php in PHP Director 0.21 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module PopnupBlog 2.52 - 'postid' Blind SQL Injection
SQL injection vulnerability in index.php in the PopnupBlog 2.52 and earlier module for Xoops allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
PlaySms 0.9.3 - Multiple Local/Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in playSMS 0.9.3 allow remote attackers to execute arbitrary PHP code
28RISK
open ↗Referência✓ VexDay Proof
NuCommunity 1.0 - 'cl_CatListing.asp' SQL Injection
SQL injection vulnerability in cl_CatListing.asp in Dynamic Dataworx NuCommunity 1.0 allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Zenturi NixonMyPrograms Class 'sasatl.dll 1.5.0.531' - Remote Buffer Overflow
Buffer overflow in a certain ActiveX control in the NixonMyPrograms class in sasatl.dll 1.5.0.531 in Zenturi ProgramChec
23RISK
open ↗Referência✓ VexDay Proof
Worldweaver DX Studio Player < 3.0.29.1 Firefox plugin - Command Injection
Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a p
50RISK
open ↗Referência✓ VexDay Proof
Podcast Generator 1.1 - Remote Code Execution
Static code injection vulnerability in index.php in Podcast Generator 1.1 and earlier allows remote authenticated admini
23RISK
open ↗Referência✓ VexDay Proof
Buddy Zone 1.5 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Buddy Zone 1.5 and earlier allow remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
Collabtive 0.4.8 - Cross-Site Scripting / Authentication Bypass / Arbitrary File Upload
Multiple cross-site request forgery (CSRF) vulnerabilities in Collabtive 0.4.8 allow remote attackers to hijack the auth
23RISK
open ↗Referência✓ VexDay Proof
BolinOS 4.6.1 - Local File Inclusion / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in BolinOS 4.6.1 allow remote attackers to inject arbitrary web scri
23RISK
open ↗Referência✓ VexDay Proof
ClipShare 2.6 - Remote User Password Change
ClipShare 2.6 does not properly restrict access to certain functionality, which allows remote attackers to change the pr
23RISK
open ↗Referência✓ VexDay Proof
NuSchool 1.0 - 'CampusNewsDetails.asp' SQL Injection
SQL injection vulnerability in CampusNewsDetails.asp in Dynamic Dataworx NuSchool 1.0 allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
WzdFTPD 0.8.0 - 'USER' Remote Denial of Service
Off-by-one error in the do_login_loop function in libwzd-core/wzd_login.c in wzdftpd 0.8.0, 0.8.2, and possibly other ve
23RISK
open ↗Referência✓ VexDay Proof
Free Hosting Manager 1.2/2.0 - Insecure Cookie Handling
Free Hosting Manager 1.2 and 2.0 allows remote attackers to bypass authentication and gain administrative access by sett
23RISK
open ↗Referência✓ VexDay Proof
cmsWorks 2.2 RC4 - 'mod_root' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/include/lib.module.php in cmsWorks 2.2 RC4, when register_globals is en
23RISK
open ↗Referência✓ VexDay Proof
Interact 2.4.1 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Interact Learning Community Environment Interact 2.4.1, when regis
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Excel 2000/2003 - Sheet Name (PoC)
Unspecified vulnerability in Microsoft Excel 2003 SP2 allows remote attackers to have an unknown impact via unspecified
35RISK
open ↗Referência✓ VexDay Proof
Firefly Media Server 0.2.4 - Remote Denial of Service
webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (
23RISK
open ↗Referência✓ VexDay Proof
Alstrasoft e-Friends 4.21 - Admin Session Retrieve
SQL injection vulnerability in paypal.php in AlstraSoft E-Friends 4.21 and earlier allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
LBlog 1.05 - 'comments.asp' SQL Injection
SQL injection vulnerability in comments.asp in LBlog 1.05 and earlier allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component 'com_a6mambocredits' 1.0.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.a6mambocredits.php in the a6mambocredits component (com_a6mambocredits)
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Internet Explorer 6 - DirectX Media Remote Overflow Denial of Service
Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (crash) via a long Color attrib
35RISK
open ↗Referência✓ VexDay Proof
iFdate 2.0.3 - SQL Injection
SQL injection vulnerability in members_search.php in iFusion Services iFdate 2.0.3 and earlier allows remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
Anata CMS 1.0b5 - 'change.php' Arbitrary Add Admin
change.php in Ananta CMS 1.0b5, with magic_quotes_gpc disabled, allows remote attackers to gain administrator privileges
23RISK
open ↗Referência✓ VexDay Proof
ICQ 6.5 - URL Search Hook (Windows Explorer) Remote Buffer Overflow (PoC)
Stack-based buffer overflow in the URL Search Hook (ICQToolBar.dll) in ICQ 6.5 allows remote attackers to cause a denial
23RISK
open ↗Referência✓ VexDay Proof
Remote Mouse GUI 3.008 - Local Privilege Escalation
Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by using
23RISK
open ↗Referência✓ VexDay Proof
bugmall shopping cart 2.5 - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in BugMall Shopping Cart 2.5 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
pSlash 0.7 - 'lvc_include_dir' Remote File Inclusion
PHP remote file inclusion vulnerability in modules/visitors2/include/config.inc.php in pSlash 0.70 allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
Velocity Web-Server 1.0 - Directory Traversal
Directory traversal vulnerability in the web server 1.0 in Velocity Security Management System allows remote attackers t
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.