Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Shop-Script FREE 2.0 - Remote Command Execution
Direct static code injection vulnerability in includes/admin/sub/conf_appearence.php in Shop-Script FREE 2.0 and earlier
23RISK
open ↗Referência✓ VexDay Proof
Macromedia 10.1.4.20 - 'SwDir.dll' Internet Explorer Stack Overflow Denial of Service
Multiple stack-based buffer overflows in an ActiveX control in SwDir.dll 10.1.4.20 in Macromedia Shockwave allow remote
28RISK
open ↗Referência✓ VexDay Proof
artmedic weblog 1.0 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in artmedic webdesign weblog 1.0, when magic_quotes_gpc is disabled, allow
23RISK
open ↗Referência✓ VexDay Proof
Discussion Forums 2k 3.3 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Discussion Forums 2k 3.3, when magic_quotes_gpc is disabled, allow remote atta
23RISK
open ↗Referência✓ VexDay Proof
mBlog 1.2 - 'page' Remote File Disclosure
Directory traversal vulnerability in index.php in mBlog 1.2 allows remote attackers to read arbitrary files via a .. (do
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Thyme 1.0 - SQL Injection
SQL injection vulnerability in the EXtrovert Software Thyme (com_thyme) 1.0 component for Joomla! allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
WordPress Plugin Photoracer 1.0 - 'id' SQL Injection
SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
Hosting Controller 6.1 Hot fix 3.3 and earlier (1) allows remote attackers to change arbitrary user profiles via a reque
23RISK
open ↗Referência✓ VexDay Proof
AEP SmartGate 4.3b - 'GET' Arbitrary File Download
The SSL server in AEP Smartgate 4.3b allows remote attackers to determine existence of directories via a direct request
23RISK
open ↗Referência✓ VexDay Proof
T-Dreams Job Career Package 3.0 - Insecure Cookie Handling
Techno Dreams Job Career Package 3.0 allows remote attackers to bypass authentication and obtain administrative access b
23RISK
open ↗Referência✓ VexDay Proof
WordPress Plugin wp-Table 1.43 - 'inc_dir' Remote File Inclusion
Directory traversal vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin for WordPress, when r
23RISK
open ↗Referência✓ VexDay Proof
CRE Loaded 6.2 - 'products_id' SQL Injection
SQL injection vulnerability in product_info.php in CRE Loaded 6.2 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
HP Software Update Client 3.0.8.4 - Multiple Vulnerabilities
The HPRulesEngine.ContentCollection.1 ActiveX Control in RulesEngine.dll for HP Software Update 4.000.005.007 and earlie
28RISK
open ↗Referência✓ VexDay Proof
SFS EZ Software - 'id' SQL Injection
SQL injection vulnerability in software-description.php in Scripts For Sites (SFS) Hotscripts-like Site allows remote at
23RISK
open ↗Referência✓ VexDay Proof
PHP 4.4.6 - 'crack_opendict()' Local Buffer Overflow
Buffer overflow in the crack extension (CrackLib), as bundled with PHP 4.4.6 and other versions before 5.0.0, might allo
23RISK
open ↗Referência✓ VexDay Proof
PHP League 0.82 - 'classement.php' SQL Injection
SQL injection vulnerability in consult/classement.php in Uni-Vert PhpLeague 0.82 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
impleo music Collection 2.0 - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in admin/login.php in Impleo Music Collection 2.0, when magic_quotes_gpc is disabled, allows
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component com_Musica - 'id' SQL Injection
SQL injection vulnerability in the com_musica module in Joomla! and Mambo allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
Aconon Mail 2004 - Directory Traversal
Directory traversal vulnerability in archiv.cgi in absofort aconon Mail 2007 Enterprise SQL 11.7.0 and Mail 2004 Enterpr
23RISK
open ↗Referência✓ VexDay Proof
Leap CMS 0.1.4 - SQL Injection / Cross-Site Scripting / Arbitrary File Upload
Multiple cross-site scripting (XSS) vulnerabilities in Leap CMS 0.1.4 allow remote attackers to inject arbitrary web scr
23RISK
open ↗Referência✓ VexDay Proof
Pre Shopping Mall - Insecure Cookie Handling
Pre Shopping Mall allows remote attackers to bypass authentication and gain administrative access by setting the (1) adm
23RISK
open ↗Referência✓ VexDay Proof
WiClear 0.10 - 'path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in WiClear 0.10 allow remote attackers to execute arbitrary PHP code
28RISK
open ↗Referência✓ VexDay Proof
Cmaps v8.0 - SQL injection
SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbit
53RISK
open ↗Referência✓ VexDay Proof
OpenEMR 2.8.1 - 'srcdir' Multiple Remote File Inclusions
PHP remote file inclusion vulnerability in library/translation.inc.php in OpenEMR 2.8.1, with register_globals enabled,
23RISK
open ↗Referência✓ VexDay Proof
MyTopix 1.3.0 - SQL Injection
SQL injection vulnerability in index.php in MyTopix 1.3.0 and earlier allows remote authenticated users to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
zeeproperty 1.0 - Arbitrary File Upload / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in view_prop_details.php in Zeeways ZEEPROPERTY 1.0 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
RunCMS 1.6 - Multiple Vulnerabilities
RunCMS before 1.6.1 does not require entry of the old password during a password change, which allows context-dependent
23RISK
open ↗Referência✓ VexDay Proof
PHP-Fusion Mod freshlinks - 'linkid' SQL Injection
SQL injection vulnerability in index.php in the Freshlinks 1.0 RC1 module for PHP-Fusion allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
MailEnable 3.13 SMTP Service - 'VRFY/EXPN' Denial of Service
Multiple unspecified vulnerabilities in the SMTP service in MailEnable Standard Edition 1.x, Professional Edition 3.x an
23RISK
open ↗Referência✓ VexDay Proof
32bit FTP (09.04.24) - 'Banner' Remote Buffer Overflow (PoC)
Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.