Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Advanced Webhost Billing System (AWBS) 2.7.1 - 'news.php' SQL Injection
SQL injection vulnerability in news.php in Advanced Webhost Billing System (AWBS) 2.3.3 through 2.7.1, when magic_quotes
23RISK
open ↗Referência✓ VexDay Proof
Studio Lounge Address Book 2.5 - 'profile' Arbitrary File Upload
Unrestricted file upload vulnerability in upload-file.php in Adam Patterson Studio Lounge Address Book 2.5, as reachable
23RISK
open ↗Referência✓ VexDay Proof
Password Protector SD 1.3.1 - Insecure Cookie Handling
Ascad Networks Password Protector SD 1.3.1 allows remote attackers to bypass authentication and gain administrative acce
23RISK
open ↗Referência✓ VexDay Proof
How2ASP.net WebBoard 4.1 - SQL Injection
SQL injection vulnerability in showQAnswer.asp in How2ASP.net Webboard 4.1 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities
SQL injection vulnerability in the UnbDbEncode function in unb_lib/database.lib.php in Unclassified NewsBoard (UNB) 1.6.
23RISK
open ↗Referência✓ VexDay Proof
DUcalendar 1.0 - 'iEve' SQL Injection
SQL injection vulnerability in detail.asp in DUware DUcalendar 1.0 and possibly earlier allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
CMS-BRD - 'menuclick' SQL Injection
SQL injection vulnerability in index.php in CMS-BRD allows remote attackers to execute arbitrary SQL commands via the me
23RISK
open ↗Referência✓ VexDay Proof
ZoomStats 1.0.2 - 'mysql.php' Remote File Inclusion
PHP remote file inclusion vulnerability in libs/dbmax/mysql.php in ZoomStats 1.0.2 and earlier, when register_globals is
23RISK
open ↗Referência✓ VexDay Proof
Easy Scripts Answer and Question Script - Multiple Vulnerabilities
Unrestricted file upload vulnerability in myaccount.php in Easy Scripts Answer and Question Script allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
Axigen 2.0.0b1 - Remote Denial of Service (1)
Heap-based buffer underflow in axigen 1.2.6 through 2.0.0b1 allows remote attackers to cause a denial of service (applic
23RISK
open ↗Referência✓ VexDay Proof
SiteDepth CMS 3.44 - 'ShowImage.php?name' File Disclosure
Directory traversal vulnerability in ShowImage.php in SiteDepth CMS 3.44 allows remote attackers to read arbitrary files
23RISK
open ↗Referência✓ VexDay Proof
Vbgooglemap Hotspot Edition 1.0.3 - SQL Injection
SQL injection vulnerability in VBGooglemap Hotspot Edition 1.0.3, a vBulletin module, allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
DNS Tools (PHP Digger) - Remote Command Execution
dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the
28RISK
open ↗Referência✓ VexDay Proof
Hummingbird Deployment Wizard 2008 - ActiveX File Execution(2)
Multiple insecure method vulnerabilities in the DeployRun.DeploymentSetup.1 (DeployRun.dll) ActiveX control 10.0.0.44 in
35RISK
open ↗Referência✓ VexDay Proof
R2K Gallery 1.7 - 'galeria.php?lang2' Local File Inclusion
Directory traversal vulnerability in galeria.php in R2K Gallery 1.7 allows remote attackers to read arbitrary files via
23RISK
open ↗Referência✓ VexDay Proof
phpQuiz 0.1.2 - SQL Injection / Code Execution
Multiple unrestricted file upload vulnerabilities in (1) back/upload_img.php and (2) admin/upload_img.php in Walter Besc
23RISK
open ↗Referência✓ VexDay Proof
Pritlog 0.4 - 'Filename' Remote File Disclosure
Directory traversal vulnerability in index.php in Pritlog 0.4 and earlier, when magic_quotes_gpc is disabled, allows rem
23RISK
open ↗Referência✓ VexDay Proof
RPG.Board 0.0.8Beta2 - 'showtopic' SQL Injection
SQL injection vulnerability in index.php in RPG.Board 0.8 Beta2 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
PHP 5.2.3 - 'bz2 com_print_typeinfo()' Denial of Service
The com_print_typeinfo function in the bz2 extension in PHP 5.2.3 allows context-dependent attackers to cause a denial o
23RISK
open ↗Referência✓ VexDay Proof
Xilisoft Video Converter Wizard 3 - '.cue' Stack Buffer Overflow (PoC)
Stack-based buffer overflow in ape_plugin.plg in Xilisoft Video Converter 3.1.53.0704n and 5.1.23.0402 allows remote att
23RISK
open ↗Referência✓ VexDay Proof
Kmita Mail 3.0 - 'file' Remote File Inclusion
PHP remote file inclusion vulnerability in kmitaadmin/kmitam/htmlcode.php in Kmita Mail 3.0 and earlier, when register_g
23RISK
open ↗Referência✓ VexDay Proof
Winamp 5.551 - MAKI Parsing Integer Overflow
The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute
50RISK
open ↗Referência✓ VexDay Proof
XNova 0.8 sp1 - 'xnova_root_path' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/todofleetcontrol.php in an older version of Xnova, possibly 0.8 sp1,
23RISK
open ↗Referência✓ VexDay Proof
LE.CMS 1.4 - Arbitrary File Upload
admin/upload.php in le.cms 1.4 and earlier allows remote attackers to bypass administrative authentication, and upload a
23RISK
open ↗Referência✓ VexDay Proof
Apple Mac OSX - 'mount_smbfs' Local Stack Buffer Overflow
Stack-based buffer overflow in SMB in Apple Mac OS X 10.4.11 allows local users to execute arbitrary code via (1) a long
23RISK
open ↗Referência✓ VexDay Proof
Aj RSS Reader - 'url' SQL Injection
SQL injection vulnerability in EditUrl.php in AJ Square RSS Reader allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component FlippingBook 1.0.4 - SQL Injection
SQL injection vulnerability in index.php in the FlippingBook (com_flippingbook) 1.0.4 component for Joomla! allows remot
23RISK
open ↗Referência✓ VexDay Proof
maGAZIn 2.0 - 'PHPThumb.php?src' Remote File Disclosure
Directory traversal vulnerability in phpThumb.php in PinkCrow Designs Gallery or maGAZIn 2.0 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
XZero Community Classifieds 4.95.11 - Remote File Inclusion
PHP remote file inclusion vulnerability in config.inc.php in XZero Community Classifieds 4.95.11 and earlier allows remo
23RISK
open ↗Referência✓ VexDay Proof
Freelance Auction Script 1.0 - 'browseproject.php' SQL Injection
Freelance Auction Script 1.0 stores user passwords in plaintext in the tbl_users table, which allows attackers to gain p
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.