Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
creative Guestbook 1.0 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in Guestbook.php in Creative Guestbook 1.0 allows remote attackers to inject ar
23RISK
open ↗Referência✓ VexDay Proof
Emefa Guestbook 3.0 - Remote Database Disclosure
Emefa Guestbook 3.0 stores sensitive information under the web root with insufficient access control, which allows remot
23RISK
open ↗Referência✓ VexDay Proof
The Real Estate Script - 'docID' SQL Injection
SQL injection vulnerability in dpage.php in The Real Estate Script allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
DELTAScripts PHP Classifieds 7.5 - SQL Injection
SQL injection vulnerability in detail.php in DeltaScripts PHP Classifieds 7.5 and earlier allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
MiniWeb HTTP Server 0.8.x - Remote Denial of Service
http.c in MiniWeb Http Server 0.8.x allows remote attackers to cause a denial of service (application crash) via a negat
23RISK
open ↗Referência✓ VexDay Proof
Picturesolution 2.1 - 'config.php?path' Remote File Inclusion
PHP remote file inclusion vulnerability in install/config.php in Picturesolution 2.1 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
XnView 1.93.6 - '.taac' Local Buffer Overflow
Stack-based buffer overflow in NConvert 4.92, GFL SDK 2.82, and XnView 1.93.6 on Windows and 1.70 on Linux and FreeBSD a
28RISK
open ↗Referência✓ VexDay Proof
Prozilla Forum Service - 'forum' SQL Injection
SQL injection vulnerability in forum.php in Prozilla Forum allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
Grabit 1.7.2 Beta 3 - '.nzb' Local Buffer Overflow (SEH)
Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
kontakt formular 1.4 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/function.php in Kontakt Formular 1.4 allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
E-topbiz Online Store 1 - Authentication Bypass
SQL injection vulnerability in admin/login.php in E-topbiz Online Store 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
ibase 2.03 - Remote File Disclosure
Directory traversal vulnerability in download.php in Interface Medien ibase 2.03 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component ClickHeat 1.0.1 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in the Clickheat - Heatmap stats (com_clickheat) component 1.0.1 for
28RISK
open ↗Referência✓ VexDay Proof
PHP Forge 3 Beta 2 - 'id' SQL Injection
SQL injection vulnerability in admin/news.php in PHP Forge 3.0 beta 2 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
Qt QuickTeam - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Qt quickteam 2 allow remote attackers to execute arbitrary PHP cod
35RISK
open ↗Referência✓ VexDay Proof
blur6ex 0.3.462 - 'ID' Admin Disclosure / Blind SQL Injection
SQL injection vulnerability in engine/shards/blog.php in blur6ex 0.3.462 allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
AGTC MyShop 3.2 - Insecure Cookie Handling
AGTC MyShop 3.2b allows remote attackers to bypass authentication and obtain administrative access setting the log_accep
23RISK
open ↗Referência✓ VexDay Proof
PHP weather 2.2.2 - Local File Inclusion / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in config/make_config.php in PHP Weather 2.2.2 allows remote attackers to injec
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component MailTo - 'article' SQL Injection
SQL injection vulnerability in the MailTo (aka com_mailto) component in Joomla! allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module Amevents - SQL Injection
SQL injection vulnerability in print.php in the AM Events (aka Amevents) module 0.22 for XOOPS allows remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
iDB 0.2.5pa SVN 243 - 'skin' Local File Inclusion
Directory traversal vulnerability in inc/profilemain.php in Game Maker 2k Internet Discussion Boards (iDB) 0.2.5 Pre-Alp
23RISK
open ↗Referência✓ VexDay Proof
OpenEMR 2.8.1 - 'fileroot' Remote File Inclusion
PHP remote file inclusion vulnerability in contrib/forms/evaluation/C_FormEvaluation.class.php in OpenEMR 2.8.1 and earl
23RISK
open ↗Referência✓ VexDay Proof
BulletProof FTP Client 2009 - '.bps' Local Buffer Overflow (SEH)
Stack-based buffer overflow in BulletProof FTP Client allows user-assisted attackers to execute arbitrary code via a .bp
23RISK
open ↗Referência✓ VexDay Proof
Avant Browser 11.0 build 26 - Remote Stack Overflow Crash
Stack-based buffer overflow in Avant Browser 11.0 build 26 allows remote attackers to cause a denial of service (crash)
23RISK
open ↗Referência✓ VexDay Proof
phpAddressBook 2.11 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in CoronaMatrix phpAddressBook 2.11 allow remote attackers to include and e
23RISK
open ↗Referência✓ VexDay Proof
PowerBook 1.21 - 'index.php' Local File Inclusion
Directory traversal vulnerability in pb_inc/admincenter/index.php in PowerScripts PowerBook 1.21 allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
Redaxo 3.2 - 'INCLUDE_PATH' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code vi
23RISK
open ↗Referência✓ VexDay Proof
Multi-Page Comment System 1.1.0 - Insecure Cookie Handling
admin.php in Multi-Page Comment System (MPCS) 1.0 and 1.1 allows remote attackers to bypass authentication and gain priv
23RISK
open ↗Referência✓ VexDay Proof
Back-End CMS 0.7.2.2 - 'BE_config.php' Remote File Inclusion
PHP remote file inclusion vulnerability in BE_config.php in Back-End CMS 0.7.2.1 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Galatolo Web Manager 1.0 - SQL Injection
SQL injection vulnerability in view.php in Galatolo WebManager 1.0 and earlier allows remote attackers to execute arbitr
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.