Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
RunCMS 1.5.2 - 'debug_show.php' SQL Injection
The show_files function in RunCms 1.5.2 and earlier allows remote attackers to obtain sensitive information (file existe
23RISK
open ↗Referência✓ VexDay Proof
TemaTres 1.0.3 - Blind SQL Injection
Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magic_quotes_gpc is disabled, allow remote atta
23RISK
open ↗Referência✓ VexDay Proof
Liberum Help Desk 0.97.3 - SQL Injection / File Disclosure
Doug Luxem Liberum Help Desk 0.97.3 stores db/helpdesk2000.mdb under the web root with insufficient access control, whic
23RISK
open ↗Referência✓ VexDay Proof
Quake 3 Engine Client (Windows x86) - CS_ITEms Remote Overflow
Stack-based buffer overflow in Quake 3 Engine as used by Quake 3: Arena 1.32b and 1.32c allows remote attackers to cause
23RISK
open ↗Referência✓ VexDay Proof
ColdFusion Scripts Red_Reservations - Database Disclosure
The Red_Reservations script for ColdFusion stores sensitive information under the web root with insufficient access cont
23RISK
open ↗Referência✓ VexDay Proof
Emefa Guestbook 3.0 - Remote Database Disclosure
Emefa Guestbook 3.0 stores sensitive information under the web root with insufficient access control, which allows remot
23RISK
open ↗Referência✓ VexDay Proof
PMECMS 1.0 - config[pathMod] Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in PMECMS 1.0 and earlier allow remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
PHPNews 0.93 - 'format_menue' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/inc/change_action.php in Andreas Robertz PHPNews 0.93 allows remote att
35RISK
open ↗Referência✓ VexDay Proof
Falt4 CMS rc4 10.9.2007 - Multiple Vulnerabilities
SQL injection vulnerability in (1) index.php, and possibly (2) admin/index.php, in Falt4Extreme RC4 10.9.2007 allows rem
23RISK
open ↗Referência✓ VexDay Proof
FTP Now 2.6 Server - Response Remote Crash (PoC)
Heap-based buffer overflow in Network-Client FTP Now 2.6, and possibly other versions, allows remote FTP servers to caus
23RISK
open ↗Referência✓ VexDay Proof
The Real Estate Script - 'docID' SQL Injection
SQL injection vulnerability in dpage.php in The Real Estate Script allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
SimpleNews 1.0.0 FINAL - 'print.php?news_id' SQL Injection
SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
DELTAScripts PHP Classifieds 7.5 - SQL Injection
SQL injection vulnerability in detail.php in DeltaScripts PHP Classifieds 7.5 and earlier allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
Flat PHP Board 1.2 - Multiple Vulnerabilities
Flat PHP Board 1.2 and earlier stores sensitive information under the web root with insufficient access control, which a
23RISK
open ↗Referência✓ VexDay Proof
XnView 1.93.6 - '.taac' Local Buffer Overflow
Stack-based buffer overflow in NConvert 4.92, GFL SDK 2.82, and XnView 1.93.6 on Windows and 1.70 on Linux and FreeBSD a
28RISK
open ↗Referência✓ VexDay Proof
Prozilla Forum Service - 'forum' SQL Injection
SQL injection vulnerability in forum.php in Prozilla Forum allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
RSSonate - 'xml2rss.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Christopher Fowler (Rhode Island) RSSonate allow remote attackers
28RISK
open ↗Referência✓ VexDay Proof
Grabit 1.7.2 Beta 3 - '.nzb' Local Buffer Overflow (SEH)
Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
DevelopItEasy Membership System 1.3 - Authentication Bypass
Multiple SQL injection vulnerabilities in Develop It Easy Membership System 1.3 allow remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
Free Download Manager 2.5/3.0 - Authorisation Stack Buffer Overflow (PoC)
Stack-based buffer overflow in Remote Control Server in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allo
50RISK
open ↗Referência✓ VexDay Proof
E-topbiz Online Store 1 - Authentication Bypass
SQL injection vulnerability in admin/login.php in E-topbiz Online Store 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component ClickHeat 1.0.1 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in the Clickheat - Heatmap stats (com_clickheat) component 1.0.1 for
28RISK
open ↗Referência✓ VexDay Proof
PHP Forge 3 Beta 2 - 'id' SQL Injection
SQL injection vulnerability in admin/news.php in PHP Forge 3.0 beta 2 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
Mini Web Calendar 1.2 - File Disclosure / Cross-Site Scripting
Directory traversal vulnerability in php/cal_pdf.php in Mini Web Calendar (mwcal) 1.2 allows remote attackers to read ar
23RISK
open ↗Referência✓ VexDay Proof
Qt QuickTeam - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Qt quickteam 2 allow remote attackers to execute arbitrary PHP cod
35RISK
open ↗Referência✓ VexDay Proof
blur6ex 0.3.462 - 'ID' Admin Disclosure / Blind SQL Injection
SQL injection vulnerability in engine/shards/blog.php in blur6ex 0.3.462 allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
AGTC MyShop 3.2 - Insecure Cookie Handling
AGTC MyShop 3.2b allows remote attackers to bypass authentication and obtain administrative access setting the log_accep
23RISK
open ↗Referência✓ VexDay Proof
TopList 1.3.8 - 'phpBB Hack' Remote File Inclusion (1)
PHP remote file inclusion vulnerability in toplist.php in phpBB TopList 1.3.8 and earlier, when register_globals is enab
28RISK
open ↗Referência✓ VexDay Proof
32bit FTP (09.04.24) - 'CWD Response' Remote Buffer Overflow
Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a
23RISK
open ↗Referência✓ VexDay Proof
PHP weather 2.2.2 - Local File Inclusion / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in config/make_config.php in PHP Weather 2.2.2 allows remote attackers to injec
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.