Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,107cataloged exploits
36,322CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,464Referência 22,936GitHub PoC 15,010VulnCheck XDB 8,846Nuclei 4,361Metasploit 3,490✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
OCS Inventory NG 1.02 - Remote File Disclosure
Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to re
23RISK
open ↗Referência✓ VexDay Proof
vBulletin Radio and TV Player AddOn - HTML Injection
Cross-site scripting (XSS) vulnerability in forum/radioandtv.php in the Radio and TV Player addon for vBulletin allows r
23RISK
open ↗Referência✓ VexDay Proof
PHPMyReports 3.0.11 - 'lib_head.php' Remote File Inclusion
PHP remote file inclusion vulnerability in include/lib/lib_head.php in phpMyReports 3.0.11 and earlier allows remote att
23RISK
open ↗Referência✓ VexDay Proof
LushiNews 1.01 - 'comments.php' SQL Injection
SQL injection vulnerability in comments.php in LushiNews 1.01 and earlier allows remote authenticated users to inject ar
23RISK
open ↗Referência✓ VexDay Proof
Mambo Module Calendar (Agenda) 1.5.5 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the Calendar Module (com_calendar) 1.5.5 for Mambo allow remote at
23RISK
open ↗Referência✓ VexDay Proof
RicarGBooK 1.2.1 - 'lang' Local File Inclusion
Multiple directory traversal vulnerabilities in header.php in RicarGBooK 1.2.1 allow remote attackers to include and exe
23RISK
open ↗Referência✓ VexDay Proof
Flip 3.0 - Remote Password Hash Disclosure
Adam Scheinberg Flip 3.0 and earlier stores sensitive information under the web root with insufficient access control, w
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component com_slideshow - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.slideshow1.php in the Flash Slide Show (com_slideshow) component for Jo
35RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke addon Nuke Mobile Entartainment 1.0 - Local File Inclusion
Directory traversal vulnerability in data/compatible.php in the Nuke Mobile Entertainment 1 addon for PHP-Nuke allows re
23RISK
open ↗Referência✓ VexDay Proof
NagiosQL 2005 2.00 - 'prepend_adm.php' Remote File Inclusion
PHP remote file inclusion vulnerability in functions/prepend_adm.php in NagiosQL 2005 2.00 allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
CyberLink PowerDVD - CreateNewFile Remote Rewrite Denial of Service
Directory traversal vulnerability in the CLAVSetting.CLSetting.1 ActiveX control in CLAVSetting.DLL 1.00.1829 in the CLA
28RISK
open ↗Referência✓ VexDay Proof
MD-Pro 1.0.76 - SQL Injection
SQL injection vulnerability in index.php in MAXdev MDPro (MD-Pro) 1.0.76 allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
Solaris 8/9/10 - 'fifofs I_PEEK' Local Kernel Memory Leak
Integer signedness error in FIFO filesystems (named pipes) on Sun Solaris 8 through 10 allows local users to read the co
23RISK
open ↗Referência✓ VexDay Proof
PMOS Help Desk 2.4 - Remote Command Execution
form.php in PMOS Help Desk 2.4 and earlier sends a redirect to the web browser but does not exit, which allows remote at
23RISK
open ↗Referência✓ VexDay Proof
Zomplog 3.8.1 - Arbitrary File Upload
admin/upload_files.php in Zomplog 3.8.1 and earlier does not check for administrative credentials, which allows remote a
23RISK
open ↗Referência✓ VexDay Proof
Zomplog 3.8.1 - Arbitrary File Upload
Unrestricted file upload vulnerability in admin/upload_files.php in Zomplog 3.8.1 and earlier allows remote authenticate
23RISK
open ↗Referência✓ VexDay Proof
Web Template Management System 1.3 - SQL Injection
SQL injection vulnerability in index.php in Web Template Management System 1.3 allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
Scout Portal Toolkit 1.4.0 - 'ParentId' SQL Injection
Multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Cmaps v8.0 - SQL injection
SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbit
53RISK
open ↗Referência✓ VexDay Proof
CMS Faethon 2.2 Ultimate - Remote File Inclusion / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in search.php in CMS Faethon 2.2 Ultimate allows remote attackers to inject arb
23RISK
open ↗Referência✓ VexDay Proof
Phpjobscheduler 3.0 - 'installed_config_file' File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Phpjobscheduler 3.0 allow remote attackers to execute arbitrary PH
23RISK
open ↗Referência✓ VexDay Proof
RsGallery2 < 1.11.2 - 'rsgallery.html.php' File Inclusion
PHP remote file inclusion vulnerability in rsgallery2.html.php in the RS Gallery2 component (com_rsgallery2) 1.11.2 for
23RISK
open ↗Referência✓ VexDay Proof
VS-News-System 1.2.1 - 'newsordner' Remote File Inclusion
PHP remote file inclusion vulnerability in show_news_inc.php in VirtualSystem VS-News-System 1.2.1 and earlier allows re
23RISK
open ↗Referência✓ VexDay Proof
EZContents CMS 2.0.0 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in VisualShapers ezContents 2.0.0 allow remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Studio Lounge Address Book 2.5 - 'profile' Arbitrary File Upload
Unrestricted file upload vulnerability in upload-file.php in Adam Patterson Studio Lounge Address Book 2.5, as reachable
23RISK
open ↗Referência✓ VexDay Proof
PrecisionID Barcode ActiveX 1.3 - Denial of Service
Unspecified vulnerability in the PrecisionID Barcode 1.3 ActiveX control in PrecisionID_DataMatrix.DLL allows remote att
23RISK
open ↗Referência✓ VexDay Proof
CentiPaid 1.4.2 - 'centipaid_class.php' Remote File Inclusion
PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.2 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Weblogicnet - 'files_dir' Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Weblogicnet allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗Referência✓ VexDay Proof
Cplinks 1.03 - Authentication Bypass / SQL Injection / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in search.php in cpLinks 1.03 allow remote attackers to inject arbit
23RISK
open ↗Referência✓ VexDay Proof
NULL FTP Server 1.1.0.7 - 'Site' Command Injection
Incomplete blacklist vulnerability in NULL FTP Server Free and Pro 1.1.0.7 allows remote authenticated users to execute
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.