Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
eLitius 1.0 - 'banner-details.php?id' SQL Injection
SQL injection vulnerability in classes/Xp.php in eLitius 1.0 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Referência✓ VexDay Proof
mxBB Module kb_mods 2.0.2 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/kb_constants.php in the Knowledge Base (mx_kb) 2.0.2 module for mxBB
23RISK
open ↗Referência✓ VexDay Proof
Crob FTP Server 3.6.1 build 263 - 'LIST/NLST' Denial of Service
Crob FTP Server 3.6.1 b.263 allows remote attackers to cause a denial of service via a long series of "?A" sequences in
23RISK
open ↗Referência✓ VexDay Proof
TinyFTPD 1.4 - 'USER' Remote Buffer Overflow (Denial of Service) (PoC)
Buffer overflow in Tiny FTPd 1.4 and earlier allows remote attackers to cause a denial of service (daemon crash) via a l
23RISK
open ↗Referência✓ VexDay Proof
Advanced Poll 2.0.5-dev - Remote Admin Session Generator
admin/index.php in Advanced Poll 2.0.0 through 2.0.5-dev allows remote attackers to bypass authentication and gain admin
23RISK
open ↗Referência✓ VexDay Proof
CuteNews aj-fork 167f - 'cutepath' Remote File Inclusion
PHP remote file inclusion vulnerability in inc/shows.inc.php in cutenews aj-fork (CN:AJ) 167f and earlier allows remote
23RISK
open ↗Referência✓ VexDay Proof
HispaH Model Search - 'cat.php?cat' SQL Injection
SQL injection vulnerability in cat.php in HispaH Model Search allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
Creator CMS 5.0 - 'sideid' SQL Injection
SQL injection vulnerability in index.asp in Creative Mind Creator CMS 5.0 allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
PHP iCalendar 2.24 - Insecure Cookie Handling
PHP iCalendar 2.24 and earlier allows remote attackers to bypass authentication by setting the phpicalendar and phpicale
23RISK
open ↗Referência✓ VexDay Proof
TLM CMS 3.2 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in TLM CMS 3.2 allow remote attackers to execute arbitrary SQL commands via (1) t
23RISK
open ↗Referência✓ VexDay Proof
Libc - 'libc:fts_*()' Local Denial of Service
Integer overflow in the fts_build function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0
23RISK
open ↗Referência✓ VexDay Proof
MemHT Portal 4.0.1 - SQL Injection / Code Execution
SQL injection vulnerability in inc/ajax/ajax_rating.php in MemHT Portal 4.0.1 allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
Jinzora 2.6 - '/extras/mt.php' Remote File Inclusion
PHP remote file inclusion vulnerability in extras/mt.php in Jinzora 2.6 allows remote attackers to execute arbitrary PHP
23RISK
open ↗Referência✓ VexDay Proof
427bb 2.3.1 - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in showpost.php in 427BB 2.3.1 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
PHP Upload Center 2.0 - 'activate.php' File Inclusion
PHP remote file inclusion vulnerability in activate.php in PHP Upload Center 2.0 allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
YouTube blog 0.1 - Remote File Inclusion / SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in mensaje.php in C. Desseno YouTube Blog (ytb) 0.1 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Empire CMS 3.7 - 'checklevel.php' Remote File Inclusion
PHP remote file inclusion vulnerability in e/class/CheckLevel.php in Phome Empire CMS 3.7 and earlier allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
CCLeague Pro 1.2 - Insecure Cookie Authentication
SQL injection vulnerability in admin.php in CCleague Pro 1.2 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Kochsuite 0.9.4 - Remote File Inclusion
PHP remote file inclusion vulnerability in config.kochsuite.php in the Kochsuite (com_kochsuite) 0.9.4 component for Mam
23RISK
open ↗Referência✓ VexDay Proof
phpEventMan 1.0.2 - 'level' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in phpEventMan 1.0.2 allow remote attackers to execute arbitrary PHP
23RISK
open ↗Referência✓ VexDay Proof
moziloCMS 1.11 - Local File Inclusion / Full Path Disclosure / Cross-Site Scripting
moziloCMS 1.11 allows remote attackers to obtain sensitive information via the (1) gal[] parameter to gallery.php, (2) p
23RISK
open ↗Referência✓ VexDay Proof
PowerCHM 5.7 - Long URL Local Stack Overflow (PoC)
Stack-based buffer overflow in Dawningsoft PowerCHM 5.7 allows remote attackers to cause a denial of service (applicatio
23RISK
open ↗Referência✓ VexDay Proof
Simple Text-File Login script (SiTeFiLo) 1.0.6 - File Disclosure / Remote File Inclusion
Simple Text-File Login Script (SiTeFiLo) 1.0.6 stores sensitive information under the web root with insufficient access
23RISK
open ↗Referência✓ VexDay Proof
PromoteWeb MySQL - 'id' SQL Injection
SQL injection vulnerability in go.php in Panuwat PromoteWeb MySQL, when magic_quotes_gpc is disabled, allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
Creator CMS 5.0 - 'sideid' SQL Injection
Unrestricted file upload vulnerability in the file manager in Creative Mind Creator CMS 5.0 allows remote attackers to e
23RISK
open ↗Referência✓ VexDay Proof
Free Bible Search PHP Script - SQL Injection
SQL injection vulnerability in readbible.php in Free Bible Search PHP Script 1.0 allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
Lotus Domino R6 Webmail - Remote Password Hash Dumper
IBM Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores HTTPPassword hashes from names.n
43RISK
open ↗Referência✓ VexDay Proof
FrontAccounting 1.13 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.13, when register_globals is enabled, allow
23RISK
open ↗Referência✓ VexDay Proof
MailBee Objects 5.5 - 'MailBee.dll' Remote Insecure Method
Multiple ActiveX controls in MailBee.dll in MailBee Objects 5.5 allow remote attackers to (1) overwrite arbitrary files
23RISK
open ↗Referência✓ VexDay Proof
SportsPHool 1.0 - 'mainnav' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/layout/plain.footer.php in SportsPHool 1.0 allows remote attackers t
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.