Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
SyntaxCMS 1.3 - '0004_init_urls.php' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/testing/tests/0004_init_urls.php in syntaxCMS 1.1.1 through 1.3 allows
23RISK
open ↗Referência✓ VexDay Proof
BrudaNews 1.1 - '/admin/index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/index.php in Brudaswen (1) BrudaNews 1.1 and earlier and (2) BrudaGB 1.
23RISK
open ↗Referência✓ VexDay Proof
sma-db 0.3.12 - Remote File Inclusion / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in startpage.php in SMA-DB 0.3.12 allows remote attackers to inject arbitrary w
23RISK
open ↗Referência✓ VexDay Proof
Polaring 0.04.03 - 'general.php' Remote File Inclusion
PHP remote file inclusion vulnerability in view/general.php in Kristian Niemi Polaring 00.04.03 and earlier allows remot
23RISK
open ↗Referência✓ VexDay Proof
paBugs 2.0 Beta 3 - 'class.mysql.php' Remote File Inclusion
PHP remote file inclusion vulnerability in class.mysql.php in Matt Humphrey paBugs 2.0 Beta 3 and earlier allows remote
23RISK
open ↗Referência✓ VexDay Proof
evoBB 0.3 - 'path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in evoBB 0.3 and earlier allow remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
PHP Krazy Image Hosting 0.7a - 'display.php' SQL Injection
SQL injection vulnerability in display.php in Lappy512 PHP Krazy Image Host Script (phpkimagehost) 0.7a allows remote at
23RISK
open ↗Referência✓ VexDay Proof
sk.log 0.5.3 - 'skin_url' Remote File Inclusion
PHP remote file inclusion vulnerability in php-inc/log.inc.php in sk.log 0.5.3 and earlier allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
ClanSphere 2007.4 - 'cat_id' SQL Injection
SQL injection vulnerability in mods/banners/navlist.php in Clansphere 2007.4 allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Newswriter SW 1.4.2 - 'main.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in include/main.inc.php in Sebastian Baumann and Philipp Wolfer Newswriter SW 1.
23RISK
open ↗Referência✓ VexDay Proof
phpBB Minerva Mod 2.0.21 build 238a - SQL Injection
SQL injection vulnerability in forum.php in the Minerva mod 2.0.21 build 238a and earlier for phpBB allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
Online Web Building 2.0 - 'id' SQL Injection
SQL injection vulnerability in user_pages/page.asp in Online Web Building 2.0 allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
PHP Classifieds 7.1 - 'index.php' SQL Injection
Multiple SQL injection vulnerabilities in PHP Classifieds 7.1 allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Referência✓ VexDay Proof
Quick.CMS.Lite 0.5 - 'id' SQL Injection
SQL injection vulnerability in index.php in Quick.Cms.Lite 0.5 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
WebYep 1.1.9 - 'webyep_sIncludePath' File Inclusion
Multiple PHP remote file inclusion vulnerabilities in WebYep 1.1.9, when register_globals is enabled, allow remote attac
28RISK
open ↗Referência✓ VexDay Proof
Click&Rank - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in user.asp in Click&Rank allows remote attackers to inject arbitrary web scrip
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component com_registration_detailed 4.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in registration_detailed.inc.php in Mark Van Bellen Detailed User Registration (
23RISK
open ↗Referência✓ VexDay Proof
Ciamos CMS 0.9.6b - 'config.php' Remote File Inclusion
PHP remote file inclusion vulnerability in modules/forum/include/config.php in Ciamos Content Management System (CMS) 0.
23RISK
open ↗Referência✓ VexDay Proof
MemHT Portal 3.9.0 - Remote Create Shell
SQL injection vulnerability in inc/inc_statistics.php in MemHT Portal 3.9.0 and earlier, when magic_quotes_gpc is disabl
23RISK
open ↗Referência✓ VexDay Proof
phpMyAgenda 3.1 - '/templates/header.php3' Local File Inclusion
Directory traversal vulnerability in templates/header.php3 in phpMyAgenda 3.1 and earlier allows remote attackers to inc
23RISK
open ↗Referência✓ VexDay Proof
HomePH Design 2.10 RC2 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in HomePH Design 2.10 RC2 allow remote attackers to inject arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Snort 2.6.1 - DCE/RPC Preprocessor Remote Buffer Overflow (Denial of Service) (PoC)
Stack-based buffer overflow in the DCE/RPC preprocessor in Snort before 2.6.1.3, and 2.7 before beta 2; and Sourcefire I
60RISK
open ↗Referência✓ VexDay Proof
elvin bts 1.2.0 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in show_activity.php in Elvin 1.2.0 allows remote attackers to inject arbitrary
23RISK
open ↗Referência✓ VexDay Proof
n@board 3.1.9e - 'naboard_pnr.php' Remote File Inclusion
PHP remote file inclusion vulnerability in naboard_pnr.php in n@board 3.1.9e and earlier allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
SH-News 3.1 - 'scriptpath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in SH-News 3.1 and earlier allow remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Redaction System 1.0 - 'lang_prefix' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Redaction System 1.0000 allow remote attackers to execute arbitrar
28RISK
open ↗Referência✓ VexDay Proof
OpenDock FullCore 4.4 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in OpenDock FullCore 4.4 and earlier allow remote attackers to execut
28RISK
open ↗Referência✓ VexDay Proof
Easynews 4.4.1 - 'admin.php' Authentication Bypass
admin.php in PHP Outburst Easynews 4.4.1 and earlier, when register_globals is enabled, allows remote attackers to bypas
23RISK
open ↗Referência✓ VexDay Proof
WSN Forum 1.3.4 - 'prestart.php' Remote Code Execution
WSN Forum 1.3.4 and earlier allows remote attackers to execute arbitrary PHP code via a modified pathname in the pathtoc
23RISK
open ↗Referência✓ VexDay Proof
ALiCE-CMS 0.1 - 'CONFIG[local_root]' Remote File Inclusion
PHP remote file inclusion vulnerability in modules/guestbook/index.php in ALiCE-CMS 0.1 allows remote attackers to execu
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.