Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
nightfall personal diary 1.0 - Cross-Site Scripting / File Disclosure
Cross-site scripting (XSS) vulnerability in login.asp in Nightfall Personal Diary 1.0 allows remote attackers to inject
23RISK
open ↗Referência✓ VexDay Proof
PHPmyGallery Gold 1.51 - 'index.php' Directory Traversal
Directory traversal vulnerability in index.php in PHPmyGallery 1.51 gold allows remote attackers to list arbitrary direc
23RISK
open ↗Referência✓ VexDay Proof
Merlix Teamworx Server - File Disclosure/Bypass
SQL injection vulnerability in default.asp in Merlix Teamworx Server allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
QMail Mailing List Manager 1.2 - Database Disclosure
Gazatem QMail Mailing List Manager 1.2 stores sensitive information under the web root with insufficient access control,
23RISK
open ↗Referência✓ VexDay Proof
IrfanView 4.10 - '.fpx' Memory Corruption
fpx.dll 3.9.8.0 in the FlashPix plugin for IrfanView 4.10 allows remote attackers to execute arbitrary code via a crafte
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component com_waticketsystem - Blind SQL Injection
SQL injection vulnerability in the WebAmoeba (WA) Ticket System (com_waticketsystem) component for Joomla! allows remote
23RISK
open ↗Referência✓ VexDay Proof
MySpace Uploader - 'MySpaceUploader.ocx 1.0.0.4' Remote Buffer Overflow
Stack-based buffer overflow in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.5.70 and earlier, as used i
35RISK
open ↗Referência✓ VexDay Proof
GLLCTS2 - 'sort' Blind SQL Injection
SQL injection vulnerability in listing.php in Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
phpAuction 3.2.1 - 'item.php' SQL Injection
SQL injection vulnerability in item.php in PHPAuction 3.2 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
Mega File Hosting Script 1.2 - 'fid' SQL Injection
SQL injection vulnerability in members.php in YABSoft Mega File Hosting Script (aka MFH or MFHS) 1.2 allows remote authe
23RISK
open ↗Referência✓ VexDay Proof
BLOG 1.55B - 'image_upload.php' Arbitrary File Upload
Unrestricted file upload vulnerability in lib/image_upload.php in KafooeyBlog 1.55b allows remote attackers to execute a
28RISK
open ↗Referência✓ VexDay Proof
Ax Developer CMS 0.1.1 - 'index.php?module' Local File Inclusion
Directory traversal vulnerability in index.php in Ax Developer CMS (AxDCMS) 0.1.1 allows remote attackers to include and
23RISK
open ↗Referência✓ VexDay Proof
CoolPlayer 2.19 - '.Skin' Local Buffer Overflow
Stack-based buffer overflow in skin.c in CoolPlayer 2.17 through 2.19 allows remote attackers to execute arbitrary code
23RISK
open ↗Referência✓ VexDay Proof
BloofoxCMS 0.3.4 - 'lang' Local File Inclusion
Directory traversal vulnerability in plugins/spaw2/dialogs/dialog.php in BloofoxCMS 0.3.4 allows remote attackers to rea
28RISK
open ↗Referência✓ VexDay Proof
SCO UnixWare Merge - 'mcd' Local Privilege Escalation
Merge mcd in ReliantHA 1.1.4 in SCO UnixWare 7.1.4 allows local users to gain root privileges via a crafted -d argument
23RISK
open ↗Referência✓ VexDay Proof
PacerCMS 0.6 - 'last_module' Remote Code Execution
Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including
28RISK
open ↗Referência✓ VexDay Proof
Xitami Web Server 2.5 - 'If-Modified-Since' Remote Buffer Overflow
Multiple buffer overflows in iMatix Xitami Web Server 2.5c2 allow remote attackers to execute arbitrary code via a long
60RISK
open ↗Referência✓ VexDay Proof
bubbling library 1.32 - 'uri' Remote File Disclosure
Multiple directory traversal vulnerabilities in Bubbling Library 1.32 allow remote attackers to read arbitrary files via
23RISK
open ↗Referência✓ VexDay Proof
E-Shop Shopping Cart Script - 'search_results.php' SQL Injection
SQL injection vulnerability in search_results.php in E-Php Scripts E-Shop (aka E-Php Shopping Cart) Shopping Cart Script
23RISK
open ↗Referência✓ VexDay Proof
Constructr CMS 3.02.5 stable - Multiple Vulnerabilities
SQL injection vulnerability in index.php in Constructr CMS 3.02.5 and earlier, when register_globals is enabled and magi
23RISK
open ↗Referência✓ VexDay Proof
FreeLyrics 1.0 - Remote File Disclosure
Directory traversal vulnerability in source.php in FreeLyrics 1.0 allows remote attackers to read arbitrary files via di
23RISK
open ↗Referência✓ VexDay Proof
WordPress Plugin Adserve 0.2 - 'adclick.php' SQL Injection
SQL injection vulnerability in adclick.php in the AdServe 0.2 plugin for WordPress allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
Aigaion 1.3.3 - 'topic topic_id' SQL Injection
SQL injection vulnerability in pagetopic.php in Aigaion 1.3.3 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
SyndeoCMS 2.5.01 - 'cmsdir' Remote File Inclusion
PHP remote file inclusion vulnerability in starnet/themes/c-sky/main.inc.php in Fred Stuurman SyndeoCMS 2.5.01 allows re
23RISK
open ↗Referência✓ VexDay Proof
public media manager 1.3 - Remote File Inclusion
PHP remote file inclusion vulnerability in NewsCMS/news/newstopic_inc.php in North Country Public Radio Public Media Man
23RISK
open ↗Referência✓ VexDay Proof
CCProxy 6.2 - 'ping' Remote Buffer Overflow
Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long addre
28RISK
open ↗Referência✓ VexDay Proof
Lanius CMS 1.2.16 - 'FCKeditor' Arbitrary File Upload
Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.
23RISK
open ↗Referência✓ VexDay Proof
Winamp 5.55 - MAKI script Universal Integer Overflow
The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute
50RISK
open ↗Referência✓ VexDay Proof
XOOPS Module Classifieds - 'cid' SQL Injection
SQL injection vulnerability in index.php in the jlmZone Classifieds module for XOOPS allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
WebcamXP 5.3.2.375 - Remote File Disclosure
Directory traversal vulnerability in webcamXP 5.3.2.375 and 5.3.2.410 build 2132 allows remote attackers to read arbitra
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.