Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
BackLinkSpider 1.1 - 'cat_id' SQL Injection
SQL injection vulnerability in BackLinkSpider allows remote attackers to execute arbitrary SQL commands via the cat_id p
23RISK
open ↗Referência✓ VexDay Proof
CaLogic Calendars 1.2.2 - 'langsel' SQL Injection
SQL injection vulnerability in userreg.php in CaLogic Calendars 1.2.2 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component yvComment 1.16 - Blind SQL Injection
SQL injection vulnerability in the yvComment (com_yvcomment) component 1.16.0 and earlier for Joomla! allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
TNT Forum 0.9.4 - Local File Inclusion
Directory traversal vulnerability in index.php in TNT Forum 0.9.4, when magic_quotes_gpc is disabled, allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
ASPPortal Free Version - 'Topic_Id' SQL Injection
SQL injection vulnerability in content/forums/reply.asp in ASPPortal allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
Bloginator 1a - Cookie Bypass / SQL Injection
SQL injection vulnerability in articleCall.php in Bloginator 1A allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
Job Script 2.0 - Arbitrary Change Admin Password
admin/changepassword.php in Job Script Job Board Software 2.0 allows remote attackers to change the administrator passwo
23RISK
open ↗Referência✓ VexDay Proof
Wysi Wiki Wyg 1.0 - Local File Inclusion / Cross-Site Scripting / PHPInfo
Wysi Wiki Wyg 1.0 allows remote attackers to obtain system information via an invalid categup parameter to index.php, wh
23RISK
open ↗Referência✓ VexDay Proof
WU-FTPD 2.6.2 - 'wuftpd-freezer.c' Remote Denial of Service
ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, w
23RISK
open ↗Referência✓ VexDay Proof
OpenH323 Opal SIP Protocol - Remote Denial of Service
The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remo
28RISK
open ↗Referência✓ VexDay Proof
Black Ice Software Inc Barcode SDK - 'BITiff.ocx' Remote Buffer Overflow (2)
Stack-based buffer overflow in the BITIFF.BITiffCtrl.1 ActiveX control in BITiff.ocx 10.9.3.0 in Black Ice Barcode SDK 5
28RISK
open ↗Referência✓ VexDay Proof
Mercury/32 4.52 IMAPD - 'SEARCH' (Authenticated) Overflow
Stack-based buffer overflow in IMAPD in Mercury/32 4.52 allows remote authenticated users to execute arbitrary code via
23RISK
open ↗Referência✓ VexDay Proof
Arcadwy Arcade Script - 'Username' Static Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in register.php in Arcadwy Arcade Script CMS allows remote attackers to inject
23RISK
open ↗Referência✓ VexDay Proof
BaoFeng - ActiveX 'OnBeforeVideoDownload()' Remote Buffer Overflow
Stack-based buffer overflow in the MPS.StormPlayer.1 ActiveX control in mps.dll 3.9.4.27 in Baofeng Storm allows remote
50RISK
open ↗Referência✓ VexDay Proof
Airsensor M520 - HTTPd Remote Denial of Service / Buffer Overflow (PoC)
Multiple buffer overflows in the AirDefense Airsensor M520 with firmware 4.3.1.1 and 4.4.1.4 allow remote authenticated
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke addon Nuke Mobile Entartainment 1.0 - Local File Inclusion
Directory traversal vulnerability in data/compatible.php in the Nuke Mobile Entertainment 1 addon for PHP-Nuke allows re
23RISK
open ↗Referência✓ VexDay Proof
IPSwitch IMail Server 8.0x - Remote Heap Overflow
Heap-based buffer overflow in iaspam.dll in the SMTP Server in Ipswitch IMail Server 8.01 through 8.11 allows remote att
23RISK
open ↗Referência✓ VexDay Proof
PostNuke Module pnEncyclopedia 0.2.0 - SQL Injection
SQL injection vulnerability in the pnEncyclopedia module 0.2.0 and earlier for PostNuke allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
RoomPHPlanning 1.5 - Arbitrary Add Admin
admin/userform.php in RoomPHPlanning 1.5 does not require administrative credentials, which allows remote authenticated
23RISK
open ↗Referência✓ VexDay Proof
GLLCTS2 < 4.2.4 - 'detail' SQL Injection
SQL injection vulnerability in login.php in Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
Dew-NewPHPLinks 2.0 - Local File Inclusion / Cross-Site Scripting
Directory traversal vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to read arbitrary files vi
23RISK
open ↗Referência✓ VexDay Proof
Wordsmith 1.1b - 'config.inc.php?_path' Remote File Inclusion
PHP remote file inclusion vulnerability in config.inc.php in Wordsmith 1.0 RC1, when register_globals is enabled, allows
35RISK
open ↗Referência✓ VexDay Proof
CA Internet Security Suite 2008 - 'SaveToFile()' File Corruption (PoC)
Directory traversal vulnerability in the UmxEventCli.CachedAuditDataList.1 (aka UmxEventCliLib) ActiveX control in UmxEv
28RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows Media Player - '.mid' Integer Overflow (PoC)
Integer overflow in Microsoft Windows Media Player (WMP) 11.0.5721.5260 allows remote attackers to cause a denial of ser
28RISK
open ↗Referência✓ VexDay Proof
PAD Site Scripts 3.6 - Insecure Cookie Handling
PAD Site Scripts 3.6 allows remote attackers to bypass authentication and gain privileges as other users, including admi
23RISK
open ↗Referência✓ VexDay Proof
Extreme phpBB 3.0.1 - 'functions.php' Remote File Inclusion
PHP remote file inclusion vulnerability in functions.php in Extreme phpBB (aka phpBB Extreme) 3.0.1 allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
Zomplog 3.8.1 - Arbitrary File Upload
Zomplog 3.8.1 and earlier stores potentially sensitive information under the web root with insufficient access control,
23RISK
open ↗Referência✓ VexDay Proof
IMGallery 2.5 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in IMGallery 2.5, when magic_quotes_gpc is disabled, allow remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
SCO UnixWare Reliant HA 1.1.4 - Local Privilege Escalation
Untrusted search path vulnerability in (1) hvdisp and (2) rcvm in ReliantHA 1.1.4 in SCO UnixWare 7.1.4 allows local use
23RISK
open ↗Referência✓ VexDay Proof
XChat 2.8.7b - 'URI Handler' Remote Code Execution (Internet Explorer 6/7)
Argument injection vulnerability in XChat 2.8.7b and earlier on Windows, when Internet Explorer is used, allows remote a
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.