Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
PHPbbBook 1.3 - 'bbcode.php?l' Local File Inclusion
Directory traversal vulnerability in bbcode.php in PHPbbBook 1.3 and 1.3h allows remote attackers to include and execute
23RISK
open ↗Referência✓ VexDay Proof
Elecard AVC HD player - '.m3u' / '.xpl' Local Stack Overflow (PoC)
Stack-based buffer overflow in Elecard AVC HD PLAYER 5.5.90116 allows remote attackers to execute arbitrary code via an
23RISK
open ↗Referência✓ VexDay Proof
Miniweb 0.8.19 - Multiple Vulnerabilities
Heap-based buffer overflow in the _mwProcessReadSocket function in http.c in MiniWeb HTTP Server 0.8.19 allows remote at
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component mosmedia 1.0.8 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia (com_mosmedia) 1.08 and earlier
23RISK
open ↗Referência✓ VexDay Proof
plxAutoReminder 3.7 - 'id' SQL Injection
SQL injection vulnerability in members.php in plx Auto Reminder 3.7 allows remote authenticated users to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
Ourgame GLWorld 2.x - 'hgs_startNotify()' ActiveX Buffer Overflow
Multiple stack-based buffer overflows in the HanGamePluginCn18.HanGamePluginCn18.1 ActiveX control in HanGamePluginCn18.
23RISK
open ↗Referência✓ VexDay Proof
Total Video Player 1.03 - '.m3u' File Local Buffer Overflow
Stack-based buffer overflow in iTinySoft Studio Total Video Player 1.03, and possibly earlier, allows remote attackers t
28RISK
open ↗Referência✓ VexDay Proof
Dovecot IMAP 1.0.10 < 1.1rc2 - Remote Email Disclosure
Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs,
23RISK
open ↗Referência✓ VexDay Proof
phpskelsite 1.4 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in phpSkelSite 1.4 allows remote attackers to inject arbitrary web
23RISK
open ↗Referência✓ VexDay Proof
WikkiTikkiTavi 1.11 - Arbitrary '.PHP' File Upload
Unrestricted file upload vulnerability in upload.php in WikkiTikkiTavi 1.11 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Simple PHP News 1.0 - Remote Command Execution
Static code injection vulnerability in post.php in Simple PHP News 1.0 final allows remote attackers to inject arbitrary
23RISK
open ↗Referência✓ VexDay Proof
blogit! - SQL Injection / File Disclosure / Cross-Site Scripting
SQL injection vulnerability in index.asp in Katy Whitton BlogIt! allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗Referência✓ VexDay Proof
BlueBird Pre-Release - Authentication Bypass
SQL injection vulnerability in login.php in BlueBird Prelease allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
pHNews Alpha 1 - 'genbackup.php' Database Disclosure
pHNews Alpha 1 stores sensitive information under the web root with insufficient access control, which allows remote att
23RISK
open ↗Referência✓ VexDay Proof
JiRo's FAQ Manager eXperience 1.0 - 'fID' SQL Injection
SQL injection vulnerability in read.asp in JiRo's FAQ Manager eXperience 1.0 allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component com_pccookbook - 'recipe_id' Blind SQL Injection
SQL injection vulnerability in the PcCookBook (com_pccookbook) component for Joomla! allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
RhinoSoft Serv-U FTP Server 7.4.0.1 - 'SMNT' (Authenticated) Denial of Service
The FTP server in Serv-U 7.0.0.1 through 7.4.0.1 allows remote authenticated users to cause a denial of service (service
23RISK
open ↗Referência✓ VexDay Proof
OSSIM 0.9.9rc5 - Cross-Site Scripting / SQL Injection
SQL injection vulnerability in port/modifyportform.php in Open Source Security Information Management (OSSIM) 0.9.9 rc5
23RISK
open ↗Referência✓ VexDay Proof
BolinOS 4.6.1 - Local File Inclusion / Cross-Site Scripting
BolinOS 4.6.1 allows remote attackers to obtain sensitive information via a direct request to system/actionspages/_b/con
23RISK
open ↗Referência✓ VexDay Proof
DeluxeBB 1.3 - 'qorder' SQL Injection
SQL injection vulnerability in misc.php in DeluxeBB 1.3 and earlier allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
MW6 Barcode - ActiveX 'Barcode.dll' Insecure Method
Multiple insecure method vulnerabilities in MW6 Technologies 1D Barcode ActiveX control (BARCODELib.MW6Barcode, Barcode.
23RISK
open ↗Referência✓ VexDay Proof
Apple Mac OSX xnu 1228.x - 'vfssysctl' Local Kernel Denial of Service (PoC)
Race condition in the HFS vfs sysctl interface in XNU 1228.8.20 and earlier on Apple Mac OS X 10.5.6 and earlier allows
23RISK
open ↗Referência✓ VexDay Proof
FlexCMS Calendar - 'itemID' Blind SQL Injection
SQL injection vulnerability in FlexCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the ItemId para
23RISK
open ↗Referência✓ VexDay Proof
pSys 0.7.0.a - 'shownews' SQL Injection
SQL injection vulnerability in index.php in pSys 0.7.0 alpha allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Referência✓ VexDay Proof
Lansuite 2.1.0 Beta - 'fid' SQL Injection
SQL injection vulnerability in the board module in LanSuite LanParty Intranet System 2.0.6 and 2.1.0 beta allows remote
23RISK
open ↗Referência✓ VexDay Proof
Adobe Acrobat Reader 8.1.2 - '.PDF' Remote Denial of Service (PoC)
Adobe Acrobat Reader 8.1.2 and earlier, and before 7.1.1, allows remote attackers to cause a denial of service (applicat
35RISK
open ↗Referência✓ VexDay Proof
SmodBIP 1.06 - aktualnosci zoom SQL Injection
SQL injection vulnerability in index.php in the aktualnosci module in SmodBIP 1.06 and earlier allows remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
TLS - Renegotiation
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS
70RISK
open ↗Referência✓ VexDay Proof
Aztek Forum 4.00 - Cross-Site Scripting / SQL Injection
Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a long login value in a register form, which
23RISK
open ↗Referência✓ VexDay Proof
ZYXEL ZyWALL Quagga/Zebra - 'Default Password' Remote Code Execution
ZyXEL ZyWALL 1050 has a hard-coded password for the Quagga and Zebra processes that is not changed when it is set by a u
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.