Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
CMS NetCat 3.12 - Multiple Vulnerabilities
Multiple directory traversal vulnerabilities in AIST NetCat 3.12 and earlier, when magic_quotes_gpc is disabled and regi
23RISK
open ↗Referência✓ VexDay Proof
PHP-Fusion Mod E-Cart 1.3 - 'items.php' SQL Injection
SQL injection vulnerability in items.php in the E-Cart module 1.3 for PHP-Fusion allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
Blogator-script 0.95 - 'id_art' SQL Injection
SQL injection vulnerability in _blogadata/include/sond_result.php in Blogator-script 0.95 allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
phpAtm 1.30 - 'downloadfile' Remote File Disclosure
Directory traversal vulnerability in index.php in PHP Advanced Transfer Manager (phpATM) 1.30 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
VicFTPS < 5.0 - 'CWD' Remote Buffer Overflow (PoC)
Stack-based buffer overflow in VicFTPS before 5.0 allows remote attackers to cause a denial of service (application cras
23RISK
open ↗Referência✓ VexDay Proof
PHP recommend 1.3 - Authentication Bypass / Remote File Inclusion / Code Injection
PHP remote file inclusion vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
phpBB Prillian French Mod 0.8.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in language/lang_french/lang_prillian_faq.php in the Prillian French 0.8.0 and e
23RISK
open ↗Referência✓ VexDay Proof
PHP-CMS 1 - 'Username' Blind SQL Injection
SQL injection vulnerability in admin/login.php in PHP-CMS Project 1 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
phpBB Shadow Premod 2.7.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/functions_portal.php in Premod Shadow 2.7.1 and earlier allows remot
23RISK
open ↗Referência✓ VexDay Proof
MGB 0.5.4.5 - 'email.php?id' SQL Injection
SQL injection vulnerability in email.php in MGB OpenSource Guestbook 0.5.4.5 and earlier allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
Siteframe CMS 3.2.3 - 'folder.php' SQL Injection
SQL injection vulnerability in folder.php in Siteframe CMS 3.2.3 and earlier, and Siteframe Beaumont 5.0.5 and earlier,
23RISK
open ↗Referência✓ VexDay Proof
LogMeIn Remote Access Utility - ActiveX Memory Corruption (Denial of Service)
LogMeIn Remote Access Utility ActiveX control (RACtrl.dll) allows remote attackers to cause a denial of service (crash)
23RISK
open ↗Referência✓ VexDay Proof
PsNews 1.1 - 'show.php?newspath' Local File Inclusion
Directory traversal vulnerability in news/show.php in PsNews 1.1 allows remote attackers to include and execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
clickandemail - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in admin_dblayers.asp in ClickAndEmail allows remote attackers to inject arbitr
23RISK
open ↗Referência✓ VexDay Proof
mini-pub 0.3 - File Disclosure / Code Execution
mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to execute arbitrary commands via shell metachara
23RISK
open ↗Referência✓ VexDay Proof
Autodesk DWF Viewer Control / LiveUpdate Module - Remote Code Execution
Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer ActiveX control (AdView.dll 9.0.0
23RISK
open ↗Referência✓ VexDay Proof
Simple Machines Forum (SMF) 1.1.6 - Code Execution
Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 all
23RISK
open ↗Referência✓ VexDay Proof
visualpic 0.3.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in VisualPic 0.3.1 allows remote attackers to execute arbitrary PHP
28RISK
open ↗Referência✓ VexDay Proof
Joovili 3.0.6 - 'joovili.images.php' Remote File Disclosure
Directory traversal vulnerability in include/images.inc.php in Joovili 2.x allows remote attackers to read arbitrary fil
23RISK
open ↗Referência✓ VexDay Proof
TalkBack 2.2.7 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in TalkBack 2.2.7 allow remote attackers to execute arbitrary PHP cod
23RISK
open ↗Referência✓ VexDay Proof
eboli - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in eboli allows remote attackers to execute arbitrary PHP code via
23RISK
open ↗Referência✓ VexDay Proof
CoreHTTP 0.5.3alpha - HTTPd Remote Buffer Overflow
Multiple buffer overflows in the HttpSprockMake function in http.c in Frank Yaul corehttp 0.5.3alpha allow remote attack
23RISK
open ↗Referência✓ VexDay Proof
FreshView 7.15 - '.psp' Local Buffer Overflow
Buffer overflow in Fresh View 7.15 allows user-assisted remote attackers to execute arbitrary code via a crafted .PSP fi
23RISK
open ↗Referência✓ VexDay Proof
The Gemini Portal 4.7 - Insecure Cookie Handling
admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain
23RISK
open ↗Referência✓ VexDay Proof
ccTiddly 1.7.4 - 'cct_base' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in ccTiddly 1.7.4 and 1.7.6 allow remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
FlexPHPDirectory 0.0.1 - Authentication Bypass
Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPDirectory 0.0.1, when magic_quotes_gpc is disabl
23RISK
open ↗Referência✓ VexDay Proof
Prediction Football 1.x - 'matchid' SQL Injection
SQL injection vulnerability in showpredictionsformatch.php in Prediction Football 1.x allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
PowerPoint Viewer OCX 3.2 - ActiveX Control Denial of Service
Multiple stack-based buffer overflows in the PowerPointOCX ActiveX control in PowerPointViewer.ocx 3.1.0.3 allow remote
23RISK
open ↗Referência✓ VexDay Proof
aspwebalbum 3.2 - Multiple Vulnerabilities
Unrestricted file upload vulnerability in Full Revolution aspWebAlbum 3.2 allows remote attackers to execute arbitrary c
23RISK
open ↗Referência✓ VexDay Proof
AllMyVisitors 0.4.0 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in AllMyVisitors 0.4.0 allows remote attackers to execute arbitrary
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.