Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
RunCMS Module MyAnnonces - 'cid' SQL Injection
SQL injection vulnerability in index.php in the MyAnnonces 1.7 and earlier module for RunCMS allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in BandSite CMS 1.1.4 allows remote attackers to hijack the authenticati
23RISK
open ↗Referência✓ VexDay Proof
PHPmotion 2.1 - Cross-Site Request Forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in password.php in PHPmotion 2.1 and earlier allow remote att
23RISK
open ↗Referência✓ VexDay Proof
FlexPHPNews 0.0.6 / PRO - Authentication Bypass
Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPNews 0.0.6 allow remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
TubeGuru Video Sharing Script - 'UID' SQL Injection
SQL injection vulnerability in ugroups.php in PozScripts TubeGuru Video Sharing Script allows remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
Gradman 0.1.3 - 'agregar_info.php' Local File Inclusion
Directory traversal vulnerability in agregar_info.php in GradMan 0.1.3 and earlier allows remote attackers to include an
23RISK
open ↗Referência✓ VexDay Proof
idmos-phoenix CMS - 'aural.php' Remote File Inclusion
PHP remote file inclusion vulnerability in core/aural.php in IDMOS 1.0-beta (aka Phoenix) allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
QuickTime Player 7.3.1.70 - 'RTSP' Remote Buffer Overflow
Buffer overflow in Apple Quicktime Player 7.3.1.70 and other versions before 7.4.1, when RTSP tunneling is enabled, allo
28RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows XP SP2 - 'win32k.sys' Local Privilege Escalation (MS08-025)
Unspecified vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, through Vista SP
23RISK
open ↗Referência✓ VexDay Proof
WebMatic 2.6 - 'index_album.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in index/index_album.php in Valarsoft WebMatic 2.6 allow remote attac
23RISK
open ↗Referência✓ VexDay Proof
Dayfox Blog 4 - 'postpost.php' Remote Code Execution
Direct static code injection vulnerability in postpost.php in Dayfox Blog (dfblog) 4 allows remote attackers to execute
35RISK
open ↗Referência✓ VexDay Proof
Rising AntiVirus Online Scanner - Insecure Method Flaw
Insecure method vulnerability in the Web Scan Object ActiveX control (OL2005.dll) in Rising Antivirus Online Scanner all
28RISK
open ↗Referência✓ VexDay Proof
Natterchat 1.1 - Authentication Bypass
Multiple SQL injection vulnerabilities in login.asp in NatterChat 1.1 and 1.12 allow remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
GreenCart PHP Shopping Cart - 'id' SQL Injection
Multiple SQL injection vulnerabilities in PozScripts GreenCart PHP Shopping Cart allow remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
LunarPoll 1.0 - 'show.php?PollDir' Remote File Inclusion
PHP remote file inclusion vulnerability in show.php in LunarPoll, when register_globals is enabled, allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
events Calendar 1.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in panel/common/theme/default/header_setup.php in WebBiscuits Software Events Ca
23RISK
open ↗Referência✓ VexDay Proof
OpenImpro 1.1 - 'image.php' SQL Injection
SQL injection vulnerability in image.php in OpenImpro 1.1 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
Alibaba Alipay - Remove ActiveX Remote Code Execution
The Alibaba Alipay PTA Module ActiveX control (PTA.DLL) allows remote attackers to execute arbitrary code via a JavaScri
23RISK
open ↗Referência✓ VexDay Proof
Durian Web Application Server 3.02 - Denial of Service
Buffer overflow in Durian Web Application Server 3.02 freeware on Windows allows remote attackers to execute arbitrary c
23RISK
open ↗Referência✓ VexDay Proof
MyBlog 0.9.8 - Insecure Cookie Handling
add.php in MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication and gain administrative access by s
23RISK
open ↗Referência✓ VexDay Proof
E-topbiz Dating 3 PHP Script - 'mail_id' SQL Injection
SQL injection vulnerability in members/mail.php in E-topbiz Online Dating 3 1.0 allows remote authenticated users to exe
23RISK
open ↗Referência✓ VexDay Proof
Apple Mac OSX 10.5.0 (Leopard) - vpnd Remote Denial of Service (PoC)
The accept_connections function in the virtual private network daemon (vpnd) in Apple Mac OS X 10.5 before 10.5.4 allows
23RISK
open ↗Referência✓ VexDay Proof
VImpX ActiveX (VImpX.ocx 4.7.3.0) - Remote Buffer Overflow
Buffer overflow in the DB Software Laboratory VImpX ActiveX control in VImpX.ocx 4.7.3 allows remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
OpenSiteAdmin 0.9.1.1 - Multiple File Inclusions
Multiple PHP remote file inclusion vulnerabilities in OpenSiteAdmin 0.9.1.1 and earlier allow remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
AJ HYIP ACME - 'topic_detail.php' SQL Injection
SQL injection vulnerability in forum/topic_detail.php in AJ Square aj-hyip (aka AJ HYIP Acme) allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Hunkaray Duyuru Scripti - 'tr' SQL Injection
SQL injection vulnerability in oku.asp in Hunkaray Duyuru Scripti allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
TorrentTrader Classic 1.09 - Multiple Vulnerabilities
account-recover.php in TorrentTrader Classic 1.09 chooses random passwords from an insufficiently large set, which makes
23RISK
open ↗Referência✓ VexDay Proof
MetaForum 0.513 Beta - Arbitrary File Upload
Unrestricted file upload vulnerability in usercp.php in MetaForum 0.513 Beta restricts file types based on the MIME type
23RISK
open ↗Referência✓ VexDay Proof
Devalcms 1.4a - Cross-Site Scripting / Remote Code Execution
modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer
23RISK
open ↗Referência✓ VexDay Proof
pivot 1.40.4-7 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.40.4 and 1.40.7 allow remote attackers to inject arbitrar
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.