Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Fantastic News 2.1.4 - Multiple Remote File Inclusions
PHP remote file inclusion vulnerability in headlines.php in Fantastic News 2.1.4, and possibly earlier, allows remote at
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module PopnupBlog 2.52 - 'postid' Blind SQL Injection
SQL injection vulnerability in index.php in the PopnupBlog 2.52 and earlier module for Xoops allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
PlaySms 0.9.3 - Multiple Local/Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in playSMS 0.9.3 allow remote attackers to execute arbitrary PHP code
28RISK
open ↗Referência✓ VexDay Proof
MemHT Portal 4.0.1 - Remote Code Execution
Unrestricted file upload vulnerability in index.php in Miltenovik Manojlo MemHT Portal 4.0.1 and earlier allows remote a
23RISK
open ↗Referência✓ VexDay Proof
eSyndiCat Link Exchange Script 2005-2006 - SQL Injection
SQL injection vulnerability in suggest-link.php in eSyndiCat Link Exchange Script allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
SineCMS 2.3.4 - Calendar SQL Injection
Multiple SQL injection vulnerabilities in SineCMS 2.3.4 and earlier allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
NuCommunity 1.0 - 'cl_CatListing.asp' SQL Injection
SQL injection vulnerability in cl_CatListing.asp in Dynamic Dataworx NuCommunity 1.0 allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Joomla! / Mambo Component rsgallery 2.0b5 - 'catid' SQL Injection
SQL injection vulnerability in index.php in the RSGallery (com_rsgallery) 2.0 beta 5 and earlier component for Mambo and
23RISK
open ↗Referência✓ VexDay Proof
PHPCOIN 1.2.3 - 'session_set.php' Remote File Inclusion
PHP remote file inclusion vulnerability in coin_includes/constants.php in phpCOIN 1.2.3 allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
bwired - 'index.php?newsID' SQL Injection
Session fixation vulnerability in bwired allows remote attackers to hijack web sessions by setting the PHPSESSID paramet
23RISK
open ↗Referência✓ VexDay Proof
phpArcadeScript 3.0RC2 - 'userid' SQL Injection
SQL injection vulnerability in index.php in phpArcadeScript 1.0 through 3.0 RC2 allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Vigile CMS 1.4 - Multiple Vulnerabilities
Cross-site request forgery (CSRF) vulnerability in index.php in VigileCMS 1.4 allows remote attackers to change the admi
23RISK
open ↗Referência✓ VexDay Proof
Constructr CMS 3.02.5 stable - Multiple Vulnerabilities
Constructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent atta
23RISK
open ↗Referência✓ VexDay Proof
PHPartenaire 1.0 - 'dix.php3' Remote File Inclusion
PHP remote file inclusion vulnerability in dix.php3 in PHPartenaire 1.0 allows remote attackers to execute arbitrary PHP
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Joomlaboard 1.1.1 - 'sbp' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the Joomlaboard Forum Component (com_joomlaboard) before 1.1.2 for
23RISK
open ↗Referência✓ VexDay Proof
WMNews 0.2a - 'base_datapath' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in WMNews 0.2a and earlier allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
E-Store Kit-1 < 2 PayPal Edition - 'pid' SQL Injection
SQL injection vulnerability in viewdetails.php in MagicScripts E-Store Kit-1, E-Store Kit-2, E-Store Kit-1 Pro PayPal Ed
23RISK
open ↗Referência✓ VexDay Proof
Portail PHP 1.7 - 'chemin' Remote File Inclusion
PHP remote file inclusion vulnerability in mod_membre/inscription.php in PortailPHP 1.7 allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
cpDynaLinks 1.02 - 'category.php' SQL Injection
SQL injection vulnerability in category.php in cpDynaLinks 1.02 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Office 2003 - '.PPT' Local Buffer Overflow (PoC)
PowerPoint in Microsoft Office 2003 does not properly handle a container object whose position value exceeds the record
28RISK
open ↗Referência✓ VexDay Proof
phpBB lat2cyr Mod 1.0.1 - 'lat2cyr.php' Remote File Inclusion
PHP remote file inclusion vulnerability in lat2cyr.php in the lat2cyr 1.0.1 and earlier phpbb module allows remote attac
23RISK
open ↗Referência✓ VexDay Proof
Open Meetings Filing Application - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Rhode Island Open Meetings Filing Application (OMFA) allow remote
28RISK
open ↗Referência✓ VexDay Proof
phpDynaSite 3.2.2 - 'racine' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in phpDynaSite 3.2.2 and earlier allow remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
Buddy Zone 1.5 - 'view_sub_cat.php?cat_id' SQL Injection
SQL injection vulnerability in view_sub_cat.php in Buddy Zone 1.5 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
iPrimal Forums - '/admin/index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in (1) index.php and (2) admin/index.php in IPrimal Forums as of 20061105 allows
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component com_Marketplace 1.1.1 - SQL Injection
SQL injection vulnerability in index.php in the Marketplace (com_marketplace) 1.1.1 and 1.1.1-pl1 component for Joomla!
23RISK
open ↗Referência✓ VexDay Proof
mm chat 1.5 - Local File Inclusion / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in chathead.php in MM Chat 1.5 allow remote attackers to inject arbi
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component com_downloads - SQL Injection
SQL injection vulnerability in index.php in the Downloads (com_downloads) component for Mambo and Joomla! allows remote
23RISK
open ↗Referência✓ VexDay Proof
AlberT-EasySite 1.0a5 - 'PSA_PATH' Remote File Inclusion
PHP remote file inclusion vulnerability in AES/modules/auth/phpsecurityadmin/include/logout.php in AlberT-EasySite (AES)
23RISK
open ↗Referência✓ VexDay Proof
ProManager 0.73 - 'note.php' SQL Injection
SQL injection vulnerability in note.php in ProManager 0.73 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.