Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
DesignWorks Professional 4.3.1 - '.CCT' File Local Stack Buffer Overflow (PoC)
Stack-based buffer overflow in DesignWorks Professional 4.3.1 and 5.0.7 allows remote attackers to execute arbitrary cod
23RISK
open ↗Referência✓ VexDay Proof
E-Smart Cart 1.0 - 'Product_ID' SQL Injection
SQL injection vulnerability in productdetail.asp in E-SMARTCART 1.0 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
Social Site Generator 2.0 - Multiple Remote File Disclosure Vulnerabilities
Social Site Generator (SSG) 2.0 allows remote attackers to read arbitrary files via the file parameter to (1) filedload.
23RISK
open ↗Referência✓ VexDay Proof
e107 Plugin BLOG Engine 2.1.4 - SQL Injection
SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows re
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component versioning 1.0.2 - 'id' SQL Injection
SQL injection vulnerability in the Versioning component (com_versioning) 1.0.2 in Joomla! and Mambo allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
Easy News Content Management - Database Disclosure
Easy Content Management Publishing stores sensitive information under the web root with insufficient access control, whi
23RISK
open ↗Referência✓ VexDay Proof
BosClassifieds - 'cat_id' SQL Injection
SQL injection vulnerability in index.php in BosDev BosClassifieds allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
living Local 1.1 - Cross-Site Scripting / Arbitrary File Upload
Cross-site scripting (XSS) vulnerability in listtest.php in eZoneScripts Living Local 1.1 allows remote attackers to inj
23RISK
open ↗Referência✓ VexDay Proof
living Local 1.1 - Cross-Site Scripting / Arbitrary File Upload
Unrestricted file upload vulnerability in editimage.php in eZoneScripts Living Local 1.1 allows remote authenticated adm
23RISK
open ↗Referência✓ VexDay Proof
xweblog 2.1 - 'kategori.asp' SQL Injection
SQL injection vulnerability in kategori.asp in xweblog 2.1 and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Woltlab Burning Board 3.0.x - Blind SQL Injection
SQL injection vulnerability in index.php in WoltLab Burning Board 3.0.3 PL 1 allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Worldweaver DX Studio Player < 3.0.29.1 Firefox plugin - Command Injection
Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a p
50RISK
open ↗Referência✓ VexDay Proof
THoRCMS 1.3.1 - 'phpbb_root_path' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/functions_cms.php in THoRCMS 1.3.1 allows remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
Podcast Generator 1.1 - Remote Code Execution
Static code injection vulnerability in index.php in Podcast Generator 1.1 and earlier allows remote authenticated admini
23RISK
open ↗Referência✓ VexDay Proof
Winamp 5.21 - '.Midi' File Header Handling Buffer Overflow (PoC)
Buffer overflow in in_midi.dll for WinAmp 2.90 up to 5.23, including 5.21, allows remote attackers to execute arbitrary
28RISK
open ↗Referência✓ VexDay Proof
Quintessential Player 4.50.1.82 - Playlist Denial of Service (PoC)
Buffer overflow in Quintessential Player 4.50.1.82 and earlier allows remote attackers to cause a denial of service (cra
23RISK
open ↗Referência✓ VexDay Proof
yogurt 0.3 - Cross-Site Scripting / SQL Injection
SQL injection vulnerability in writemessage.php in Yogurt 0.3, when register_globals is enabled, allows remote authentic
23RISK
open ↗Referência✓ VexDay Proof
GPS CMS 1.2 - 'print.asp' SQL Injection
SQL injection vulnerability in print.asp in Guo Xu Guos Posting System (GPS) 1.2 allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Rapid Recipe 1.6.5 - SQL Injection
Multiple SQL injection vulnerabilities in the Rapid Recipe (com_rapidrecipe) 1.6.5 and earlier component for Joomla! all
23RISK
open ↗Referência✓ VexDay Proof
WebspotBlogging 3.0.1 - 'path' Remote File Inclusion
PHP remote file inclusion vulnerability in Webspotblogging 3.0.1 allows remote attackers to execute arbitrary PHP code v
28RISK
open ↗Referência✓ VexDay Proof
Apple iOS 4.0.3 - DPAP Server Denial of Service
The Digital Photo Access Protocol (DPAP) server for iPhoto 4.0.3 allows remote attackers to cause a denial of service (c
23RISK
open ↗Referência✓ VexDay Proof
MoinMoin 1.5.x - 'MOIND_ID' Cookie Login Bypass
Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via
28RISK
open ↗Referência✓ VexDay Proof
Buddy Zone 1.5 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Buddy Zone 1.5 and earlier allow remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
ITechBids 6.0 - 'item_id' SQL Injection
SQL injection vulnerability in detail.php in iTechBids Gold 6.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
PHP 5.2.1 with PECL PHPDOC - Local Buffer Overflow
Buffer overflow in the confirm_phpdoc_compiled function in the phpDOC extension (PECL phpDOC) in PHP 5.2.1 allows contex
23RISK
open ↗Referência✓ VexDay Proof
CaLogic Calendars 1.2.2 - 'CLPath' Remote File Inclusion
PHP remote file inclusion vulnerability in CaLogic Calendars 1.2.2 allows remote attackers to execute arbitrary PHP code
23RISK
open ↗Referência✓ VexDay Proof
ActualAnalyzer - 'ant' Cookie Command Execution (Metasploit)
Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for pa
68RISK
open ↗Referência✓ VexDay Proof
Collabtive 0.4.8 - Cross-Site Scripting / Authentication Bypass / Arbitrary File Upload
Multiple cross-site request forgery (CSRF) vulnerabilities in Collabtive 0.4.8 allow remote attackers to hijack the auth
23RISK
open ↗Referência✓ VexDay Proof
Buddy Zone 1.5 - 'view_sub_cat.php?cat_id' SQL Injection
SQL injection vulnerability in view_sub_cat.php in Buddy Zone 1.5 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
pafileDB 2.0.1 - 'mxBB'/'phpBB' Remote File Inclusion
PHP remote file inclusion vulnerability in pafiledb_constants.php in Download Manager (mxBB pafiledb) integration, as us
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.