Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
VideoScript 4.0.1.50 - Change Admin Password
The password change feature (admin/cp.php) in VideoScript 4.0.1.50 and earlier does not check for administrative authent
23RISK
open ↗Referência✓ VexDay Proof
ADN Forum 1.0b - Insecure Cookie Handling
index.php in ADN Forum 1.0b and earlier allows remote attackers to bypass authentication and gain sysop access via a fpu
23RISK
open ↗Referência✓ VexDay Proof
mxBB Module mx_blogs 2.0.0-beta - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/functions_weblog.php in mxBB mx_blogs 2.0.0 beta allows remote attac
23RISK
open ↗Referência✓ VexDay Proof
minimal ablog 0.4 - SQL Injection / Arbitrary File Upload / Authentication Bypass
uploader.php in minimal-ablog 0.4 does not properly restrict access, which allows remote attackers to gain administrativ
23RISK
open ↗Referência✓ VexDay Proof
K&S Shopsysteme - Arbitrary File Upload
Unrestricted file upload vulnerability in admin/editor/images.php in K&S Shopsoftware allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
The Rat CMS Alpha 2 - Authentication Bypass
Multiple SQL injection vulnerabilities in login.php in The Rat CMS Alpha 2 allow remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
OmniWeb 5.5.1 - JavaScript alert() Remote Format String (PoC)
Format string vulnerability in OmniGroup OmniWeb 5.5.1 allows remote attackers to cause a denial of service (application
23RISK
open ↗Referência✓ VexDay Proof
Mini-stream RM-MP3 Converter 3.0.0.7 - '.m3u' Local Stack Overflow (PoC)
Stack-based buffer overflow in Mini-stream RM-MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary code vi
23RISK
open ↗Referência✓ VexDay Proof
S-CMS 1.1 Stable - Insecure Cookie Handling / Mass Page Delete
S-Cms 1.1 Stable allows remote attackers to bypass authentication and obtain administrative access via an OK value for t
23RISK
open ↗Referência✓ VexDay Proof
ID Automation Linear Barcode - ActiveX Denial of Service
Unspecified vulnerability in the ID Automation Linear Barcode 1.6.0.5 ActiveX control in IDAutomationLinear6.dll allows
23RISK
open ↗Referência✓ VexDay Proof
IMGallery 2.5 - Create Uploader Script
users_adm/start1.php in IMGallery 2.5 and earlier does not properly handle files with multiple extensions, which allows
23RISK
open ↗Referência✓ VexDay Proof
Quick TFTP Server Pro 2.1 - Remote Overflow (SEH)
Stack-based buffer overflow in TallSoft Quick TFTP Server Pro 2.1 allows remote attackers to cause a denial of service o
50RISK
open ↗Referência✓ VexDay Proof
phpBazar 2.0.2 - 'adid' SQL Injection
SQL injection vulnerability in classified.php in phpBazar 2.0.2 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
PHP DB Designer 1.02 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in PHP DB Designer 1.02 and earlier allow remote attackers to execute
28RISK
open ↗Referência✓ VexDay Proof
Photocart 3.9 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in PICTURESPRO Photo Cart 3.9, when magic_quotes_gpc is disabled, allow remote at
23RISK
open ↗Referência✓ VexDay Proof
DreamAccount 3.1 - 'da_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in DreamAccount 3.1 and earlier, when register_globals is enabled, al
28RISK
open ↗Referência✓ VexDay Proof
Discuz! - Remote Reset User Password
member.php in Crossday Discuz! Board allows remote attackers to reset passwords of arbitrary users via crafted (1) lostp
23RISK
open ↗Referência✓ VexDay Proof
LimeSurvey 1.52 - 'language.php' Remote File Inclusion
PHP remote file inclusion vulnerability in classes/core/language.php in LimeSurvey 1.5.2 and earlier allows remote attac
23RISK
open ↗Referência✓ VexDay Proof
Media Commands - '.m3u' / '.m3l' / '.TXT' / '.LRC' Local Heap Overflow (PoC)
Multiple heap-based buffer overflows in Media Commands 1.0 allow remote attackers to execute arbitrary code or cause a d
23RISK
open ↗Referência✓ VexDay Proof
PHPMyphorum 1.5a - '/mep/frame.php' Remote File Inclusion
PHP remote file inclusion vulnerability in mep/frame.php in PHPMyphorum 1.5a allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Wireshark < 0.99.5 - DNP3 Dissector Infinite Loop
Integer signedness error in the DNP3 dissector in Wireshark (formerly Ethereal) 0.10.12 to 0.99.6 allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
Net-Side.net CMS - 'index.php?cms' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Net Side Content Management System (Net-Side.net CMS) allows rem
23RISK
open ↗Referência✓ VexDay Proof
Virtual DJ 5.0 - '.m3u' Local Buffer Overflow
Buffer overflow in Next Generation Software Virtual DJ (VDJ) 5.0 allows user-assisted remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
EHCP 0.22.8 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Easy Hosting Control Panel for Ubuntu (EHCP) 0.22.8 and earlier al
23RISK
open ↗Referência✓ VexDay Proof
Affiliate Market 0.1 Beta - 'Language' Local File Inclusion
Directory traversal vulnerability in user/header.php in Affiliate Market 0.1 BETA allows remote attackers to include and
23RISK
open ↗Referência✓ VexDay Proof
Clever Copy 3.0 - 'results.php' SQL Injection
SQL injection vulnerability in results.php in Clever Copy 3.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
LokiCMS 0.3.4 - 'admin.php' Create Local File Inclusion
Directory traversal vulnerability in admin.php in LokiCMS 0.3.4, when magic_quotes_gpc is disabled, allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
CodeAvalanche RateMySite - Database Disclosure
CodeAvalanche RateMySite stores sensitive information under the web root with insufficient access control, which allows
23RISK
open ↗Referência✓ VexDay Proof
Ocean FTP Server 1.00 - Denial of Service
Code Ocean FTP server 1.0 allows remote attackers to cause a denial of service via a large number of connections.
23RISK
open ↗Referência✓ VexDay Proof
Boite de News 4.0.1 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in boitenews4/index.php in Boite de News 4.0.1 allows remote attackers to execut
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.