Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Joomla! Component DT Register - SQL Injection
SQL injection vulnerability in the DT Register (com_dtregister) 2.2.3 component for Joomla! allows remote attackers to e
23RISK
open ↗Referência✓ VexDay Proof
Crafty Syntax Image Gallery 3.1g - Remote Code Execution
SQL injection vulnerability in slides.php in Eric Gerdes Crafty Syntax Image Gallery (CSIG) (aka PHP thumbnail Photo Gal
23RISK
open ↗Referência✓ VexDay Proof
PHP Simple Shop 2.0 - 'abs_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools PHP Simple Shop 2.0 and earlier allow remote att
28RISK
open ↗Referência✓ VexDay Proof
PHPSherpa - '/include/config.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in include/config.inc.php in PhpSherpa allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
PhotoFiltre Studio 8.1.1 - '.tif' Local Buffer Overflow
Buffer overflow in Photofiltre Studio 8.1.1 allows user-assisted remote attackers to execute arbitrary code via a crafte
23RISK
open ↗Referência✓ VexDay Proof
SAPID Shop 1.2 - 'ROOT_PATH' Remote File Inclusion
PHP remote file inclusion vulnerability in usr/extensions/get_tree.inc.php in Dmitry Sheiko SAPID Shop 1.2 and earlier a
23RISK
open ↗Referência✓ VexDay Proof
ContentNow 1.4.1 - Arbitrary File Upload / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in upload/file/language_menu.php in ContentNow CMS 1.4.1 allow remot
23RISK
open ↗Referência✓ VexDay Proof
ACDSee 9.0 - '.xpm' Local Buffer Overflow
Stack-based buffer overflow in the ID_X.apl plugin in ACDSee 9.0 Build 108, Pro 8.1 Build 99, and Photo Editor 4.0 Build
50RISK
open ↗Referência✓ VexDay Proof
XnView 1.90.3 - '.xpm' Local Buffer Overflow
Stack-based buffer overflow in XnView 1.90.3 allows user-assisted remote attackers to execute arbitrary code via a craft
28RISK
open ↗Referência✓ VexDay Proof
Photoshop CS2/CS3 / Paint Shop Pro 11.20 - '.png' Local Buffer Overflow
Buffer overflow in Adobe Photoshop CS2 and CS3, Photoshop Elements 5.0, Illustrator CS3, and GoLive 9 allows user-assist
35RISK
open ↗Referência✓ VexDay Proof
Mole Group Hotel Script 1.0 - SQL Injection
SQL injection vulnerability in index.php in Mole Group Hotel Script 1.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
PHPmotion 2.0 - 'update_profile.php' Arbitrary File Upload
SQL injection vulnerability in play.php in PHPmotion 2.0 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
PHPmotion 2.0 - 'update_profile.php' Arbitrary File Upload
Unrestricted file upload vulnerability in update_profile.php in PHPmotion 2.0 and earlier allows remote authenticated us
23RISK
open ↗Referência✓ VexDay Proof
Visual Basic Enterprise Edition SP6 - 'vb6skit.dll' Buffer Overflow (PoC)
Buffer overflow in a certain ActiveX control (vb6skit.dll) in Microsoft Visual Basic Enterprise Edition 6.0 SP6 might al
28RISK
open ↗Referência✓ VexDay Proof
Dana IRC 1.3 - Remote Buffer Overflow (PoC)
Stack-based buffer overflow in artegic Dana IRC client 1.3 and earlier allows remote attackers to cause a denial of serv
23RISK
open ↗Referência✓ VexDay Proof
Spaminator 1.7 - 'page' Remote File Inclusion
PHP remote file inclusion vulnerability in Login.php in Spaminator 1.7 and earlier allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
Photoshop CS2/CS3 / Paint Shop Pro 11.20 - '.png' Local Buffer Overflow
Buffer overflow in Corel Paint Shop Pro 11.20 allows user-assisted remote attackers to execute arbitrary code via a craf
35RISK
open ↗Referência✓ VexDay Proof
Joomla! Component EXP Shop - 'catid' SQL Injection
SQL injection vulnerability in the EXP Shop (com_expshop) component 1.0 for Joomla! allows remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
Wheatblog 1.1 - 'session.php' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/session.php in Wheatblog (wB) 1.1 and earlier, when register_globals
23RISK
open ↗Referência✓ VexDay Proof
aeDating 4.1 - dir[inc] Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in AEDating 4.1, and possibly earlier versions, allow remote attacker
28RISK
open ↗Referência✓ VexDay Proof
WebSPELL 4.01.02 - 'picture.php' File Disclosure
picture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the file parameter.
23RISK
open ↗Referência✓ VexDay Proof
OwnRS blog beta3 - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in clanek.php in OwnRS Beta 3 allows remote attackers to inject arbitrary web s
23RISK
open ↗Referência✓ VexDay Proof
traindepot 0.1 - Local File Inclusion / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the search module in Traindepot 0.1 allows remote attackers to inject arbitr
23RISK
open ↗Referência✓ VexDay Proof
WebCalendar 1.0.4 - 'includedir' Remote File Inclusion
PHP remote file inclusion vulnerability in send_reminders.php in WebCalendar 1.0.4 allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
IGSuite 3.2.4 - Reverse Shell / Blind SQL Injection
SQL injection vulnerability in cgi-bin/igsuite in IGSuite 3.2.4 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
CKGold Shopping Cart 2.5 - 'category_id' SQL Injection
SQL injection vulnerability in item.php in CartKeeper CKGold Shopping Cart 2.5 and 2.7 allows remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
JAMM CMS - 'id' Blind SQL Injection
SQL injection vulnerability in index.php in JAMM CMS allows remote attackers to execute arbitrary SQL commands via the i
23RISK
open ↗Referência✓ VexDay Proof
BrowserCRM 5.002.00 - 'clients.php' Remote File Inclusion
PHP remote file inclusion vulnerability in pub/clients.php in BrowserCRM 5.002.00 allows remote attackers to execute arb
35RISK
open ↗Referência✓ VexDay Proof
XOOPS Module WF-Links 1.03 - 'cid' SQL Injection
SQL injection vulnerability in viewcat.php in the WF-Links (wflinks) 1.03 and earlier module for XOOPS allows remote att
23RISK
open ↗Referência✓ VexDay Proof
WTcom 0.2.4-alpha - 'torrents.php' SQL Injection
SQL injection vulnerability in torrents.php in WebTorrent (WTcom) 0.2.4 and earlier allows remote attackers to execute a
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.