Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Seagull 0.6.3 - 'files' Remote File Disclosure
Directory traversal vulnerability in optimizer.php in Seagull 0.6.3 allows remote attackers to read arbitrary files via
23RISK
open ↗Referência✓ VexDay Proof
Web Wiz Rich Text Editor 4.0 - Multiple Vulnerabilities
Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02,
23RISK
open ↗Referência✓ VexDay Proof
AuraCMS 1.5rc - Multiple SQL Injections
Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Referência✓ VexDay Proof
Pluck CMS 4.6.2 - 'langpref' Local File Inclusion
Multiple directory traversal vulnerabilities in pluck 4.6.2, when register_globals is enabled, allow remote attackers to
28RISK
open ↗Referência✓ VexDay Proof
CandyPress eCommerce suite 4.1.1.26 - Multiple Vulnerabilities
SQL injection vulnerability in admin/utilities_ConfigHelp.asp in CandyPress (CP) 4.1.1.26, and other 4.x and 3.x version
23RISK
open ↗Referência✓ VexDay Proof
DomPHP 0.82 - 'index.php' Local File Inclusion
Directory traversal vulnerability in aides/index.php in DomPHP 0.82 allows remote attackers to include and execute arbit
23RISK
open ↗Referência✓ VexDay Proof
DNS Tools (PHP Digger) - Remote Command Execution
dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the
28RISK
open ↗Referência✓ VexDay Proof
CPCommerce 1.2.x - 'GLOBALS[prefix]' Arbitrary File Inclusion
_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called direc
60RISK
open ↗Referência✓ VexDay Proof
MW6 Technologies QRCode ActiveX 3.0 - Remote File Overwrite
Multiple absolute path traversal vulnerabilities in the MW6QRCode.QRCode.1 ActiveX control in MW6QRCode.dll in MW6 Techn
28RISK
open ↗Referência✓ VexDay Proof
jetAudio 7.x - ActiveX 'DownloadFromMusicStore()' Code Execution
Directory traversal vulnerability in the JetAudio.Interface.1 ActiveX control in JetFlExt.dll in jetAudio 7.0.3 Basic an
35RISK
open ↗Referência✓ VexDay Proof
XOOPS Module myTopics - 'articleId' SQL Injection
SQL injection vulnerability in print.php in the myTopics module for XOOPS allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
phpBB Plus 1.53 - 'phpbb_root_path' Remote File Inclusion
PHP remote file inclusion vulnerability in language/lang_german/lang_main_album.php in phpBB Plus 1.53, and 1.53a before
35RISK
open ↗Referência✓ VexDay Proof
XOOPS Module Classifieds - 'cid' SQL Injection
SQL injection vulnerability in index.php in the jlmZone Classifieds module for XOOPS allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Aigaion 1.3.3 - 'topic topic_id' SQL Injection
SQL injection vulnerability in pagetopic.php in Aigaion 1.3.3 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
public media manager 1.3 - Remote File Inclusion
PHP remote file inclusion vulnerability in NewsCMS/news/newstopic_inc.php in North Country Public Radio Public Media Man
23RISK
open ↗Referência✓ VexDay Proof
Lanius CMS 1.2.16 - 'FCKeditor' Arbitrary File Upload
Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke Module NukeC 2.1 - 'id_catg' SQL Injection
SQL injection vulnerability in modules.php in the NukeC 2.1 module for PHP-Nuke allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Jumi - 'fileid' Blind SQL Injection
SQL injection vulnerability in the Jumi (com_jumi) component 2.0.3 and possibly other versions for Joomla allows remote
23RISK
open ↗Referência✓ VexDay Proof
Getleft 1.2 - Remote Buffer Overflow (PoC)
Multiple buffer overflows in Getleft.exe in Andres Garcia Getleft 1.2 allow remote attackers to cause a denial of servic
23RISK
open ↗Referência✓ VexDay Proof
DB Top Sites 1.0 - 'index.php?u' Local File Inclusion
Multiple directory traversal vulnerabilities in DB Top Sites 1.0, when magic_quotes_gpc is disabled, allow remote attack
23RISK
open ↗Referência✓ VexDay Proof
PHPFK 7.03 - 'page_bottom.php' Local File Inclusion
Directory traversal vulnerability in include/page_bottom.php in phpFK 7.03 allows remote attackers to include and execut
23RISK
open ↗Referência✓ VexDay Proof
PHP-Fusion module Expanded Calendar 2.x - SQL Injection
SQL injection vulnerability in infusions/calendar_events_panel/show_single.php in the Expanded Calendar 2.x module for P
23RISK
open ↗Referência✓ VexDay Proof
JBlog 1.0 - Create / Delete Admin Authentication Bypass
admin/ajoutaut.php in JBlog 1.0 does not require authentication, which allows remote attackers to create arbitrary accou
23RISK
open ↗Referência✓ VexDay Proof
Guestbara 1.2 - Change Admin Login and Password
admin/configuration.php in Guestbara 1.2 and earlier allows remote attackers to modify the e-mail, name, and password of
23RISK
open ↗Referência✓ VexDay Proof
NetVIOS Portal - 'page.asp' SQL Injection
SQL injection vulnerability in News/page.asp in NetVIOS Portal allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
idmos-phoenix CMS - 'aural.php' Remote File Inclusion
Multiple cross-site scripting (XSS) vulnerabilities in IDMOS 1.0-beta (aka Phoenix) allow remote attackers to inject arb
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component wmtportfolio 1.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.wmtportfolio.php in the webmaster-tips.net wmtportfolio 1.0 (com_wmtpor
23RISK
open ↗Referência✓ VexDay Proof
Motorola Timbuktu Pro 8.6.5/8.7 - Directory Traversal / Log Injection
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu P
50RISK
open ↗Referência✓ VexDay Proof
AJ Article 1.0 - Remote Authentication Bypass
AJ Square AJ Article allows remote attackers to bypass authentication and access administrator functionality via a direc
23RISK
open ↗Referência✓ VexDay Proof
TorrentTrader Classic 1.09 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to execute arbitra
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.