Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Beerwin's PHPLinkAdmin 1.0 - Remote File Inclusion / SQL Injection
Multiple SQL injection vulnerabilities in Beerwin PHPLinkAdmin 1.0 allow remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
Ultimate Fun Book 1.02 - 'function.php' Remote File Inclusion
PHP remote file inclusion vulnerability in function.php in Ultimate Fun Book 1.02 allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
Acc Real Estate 4.0 - Insecure Cookie Handling
admin/Index.php in Acc Real Estate 4.0 allows remote attackers to bypass authentication and gain administrative access b
23RISK
open ↗Referência✓ VexDay Proof
wbstreet 1.0 - SQL Injection / File Disclosure
Wbstreet (aka PHPSTREET Webboard) 1.0 stores sensitive information under the web root with insufficient access control,
23RISK
open ↗Referência✓ VexDay Proof
Joomla! 1.5.x - 'Token' Remote Admin Change Password
components/com_user/models/reset.php in Joomla! 1.5 through 1.5.5 does not properly validate reset tokens, which allows
23RISK
open ↗Referência✓ VexDay Proof
eCentrex VOIP Client module - 'uacomx.ocx 2.0.1' Remote Buffer Overflow
Buffer overflow in the IUAComFormX ActiveX control in uacomx.ocx 2.0.1 in the eCentrex VOIP Client module allows remote
23RISK
open ↗Referência✓ VexDay Proof
CounterPath X-Lite 3.x - SIP phone Remote Denial of Service
CounterPath X-Lite 3.0 34025, and possibly eyeBeam, allows remote attackers to cause a denial of service (device crash)
23RISK
open ↗Referência✓ VexDay Proof
UploadImage/UploadScript 1.0 - Remote Change Admin Password
admin.php in UploadScript 1.0 does not check for the original password before making a change to a new password, which a
23RISK
open ↗Referência✓ VexDay Proof
ErfurtWiki R1.02b - Local File Inclusion
Multiple directory traversal vulnerabilities in ErfurtWiki R1.02b and earlier, when register_globals is enabled, allow r
23RISK
open ↗Referência✓ VexDay Proof
ZeeBuddy 2.1 - 'adid' SQL Injection
SQL injection vulnerability in bannerclick.php in ZeeBuddy 2.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
Yerba SACphp 6.3 - Local File Inclusion
Directory traversal vulnerability in index.php in SAC.php (SACphp), as used in Yerba 6.3 and earlier, allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
Glossword 1.8.1 - 'custom_vars.php' Remote File Inclusion
PHP remote file inclusion vulnerability in custom_vars.php in GlossWord 1.8.1 allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
PHP-Generics 1.0.0 Beta - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in PHP-Generics 1.0 beta allow remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Joomla! / Mambo Component SWmenu 4.0 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the SWmenu (com_swmenupro and com_swmenufree) 4.0 component for Ma
28RISK
open ↗Referência✓ VexDay Proof
Interact 2.4.1 - 'help.php' Local File Inclusion
Multiple directory traversal vulnerabilities in help/help.php in Interact Learning Community Environment Interact 2.4.1
23RISK
open ↗Referência✓ VexDay Proof
basebuilder 2.0.1 - 'main.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in main.inc.php in BaseBuilder 2.0.1 and earlier allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
InteliEditor 1.2.x - 'lib.editor.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in lib.editor.inc.php in Intelimen InteliEditor 1.2.x allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
pragmaMX Module Landkarten 2.1 (Windows) - Local File Inclusion
Directory traversal vulnerability in inc/map.func.php in pragmaMX Landkarten 2.1 module allows remote attackers to inclu
23RISK
open ↗Referência✓ VexDay Proof
e-cart.biz Shopping Cart - Arbitrary File Upload
Unrestricted file upload vulnerability in admin/editor/image.php in e-cart.biz Free Shopping Cart allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
VerliAdmin 0.3 - 'language.php' Local File Inclusion
Directory traversal vulnerability in language.php in VerliAdmin 0.3 and earlier, when magic_quotes_gpc is disabled, allo
23RISK
open ↗Referência✓ VexDay Proof
Aigaion 1.2.1 - 'DIR' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Aigaion Web based bibliography management system 1.2.1 and earlier
23RISK
open ↗Referência✓ VexDay Proof
PHPPeanuts 1.3 Beta - 'Inspect.php' Remote File Inclusion
PHP remote file inclusion vulnerability in pntUnit/Inspect.php in phpPeanuts 1.1 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Xt-Stats 2.4.0.b3 (server_base_dir) - Remote File Inclusion
PHP remote file inclusion vulnerability in xt_counter.php in Xt-Stats 2.3.x up to 2.4.0.b3 allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
Attachmax Dolphin 2.1.0 - Multiple Vulnerabilities
Attachmax Dolphin 2.1.0 and earlier does not properly protect info.php in the main folder, which allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
Natterchat 1.1 - Remote Authentication Bypass
NatterChat 1.1 allows remote attackers to bypass authentication and gain administrator privileges to read or delete room
23RISK
open ↗Referência✓ VexDay Proof
OTSCMS 2.1.3 - Multiple Remote File Inclusions
PHP remote file inclusion vulnerability in OTSCMS/OTSCMS.php in Open Tibia Server Content Management System (OTSCMS) 1.3
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component equotes 0.9.4 - SQL Injection
SQL injection vulnerability in the eQuotes (com_equotes) component 0.9.4 for Joomla! allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
DFF PHP Framework API - 'Data Feed File' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in DataFeedFile (DFF) PHP Framework API allow remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
PHP Realtor 1.5 - 'v_cat' SQL Injection
SQL injection vulnerability in view_cat.php in PHP Realtor 1.5 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
Photocart 3.9 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in PICTURESPRO Photo Cart 3.9, when magic_quotes_gpc is disabled, allow remote at
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.