Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
MailMachine Pro 2.2.4 - SQL Injection
SQL injection vulnerability in showMsg.php in MailMachine Pro 2.2.4, and other versions before 2.2.6, allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
Softbiz Jobs & Recruitment - SQL Injection
SQL injection vulnerability in browsecats.php in Softbiz Jobs and Recruitment Script allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke 8.0 Final - HTTP Referers SQL Injection
SQL injection vulnerability in index.php in Francisco Burzi PHP-Nuke 8.0 Final and earlier, when the "HTTP Referers" blo
35RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows - '.png' IHDR Block Denial of Service (PoC) (3)
Microsoft Windows 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (cpu consumption) via a
28RISK
open ↗Referência✓ VexDay Proof
MyioSoft EasyBookMarker 4.0 - Authentication Bypass
SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyBookMarker 4.0 allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
WordPress Plugin User Photo Component - Arbitrary File Upload
In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upl
28RISK
open ↗Referência✓ VexDay Proof
Sun xVM VirtualBox < 1.6.4 - Privilege Escalation (PoC)
The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communicat
71RISK
open ↗Referência✓ VexDay Proof
phpAddressBook 2.11 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in CoronaMatrix phpAddressBook 2.11 allow remote attackers to include and e
23RISK
open ↗Referência✓ VexDay Proof
Redaxo 3.2 - 'INCLUDE_PATH' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code vi
23RISK
open ↗Referência✓ VexDay Proof
LiveAlbum 0.9.0 - 'common.php' Remote File Inclusion
PHP remote file inclusion vulnerability in common.php in LiveAlbum 0.9.0, when register_globals is enabled, allows remot
35RISK
open ↗Referência✓ VexDay Proof
Chupix CMS 0.2.3 - 'download.php' Remote File Disclosure
Multiple directory traversal vulnerabilities in download.php in Chupix CMS 0.2.3 allow remote attackers to read or overw
23RISK
open ↗Referência✓ VexDay Proof
Back-End CMS 0.7.2.2 - 'BE_config.php' Remote File Inclusion
PHP remote file inclusion vulnerability in BE_config.php in Back-End CMS 0.7.2.1 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component ionFiles 4.4.2 - File Disclosure
Directory traversal vulnerability in download.php in the ionFiles (com_ionfiles) 4.4.2 component for Joomla! allows remo
43RISK
open ↗Referência✓ VexDay Proof
Elecard AVC HD Player - '.XPL' Stack Buffer Overflow (SEH) (PoC)
Stack-based buffer overflow in Elecard AVC HD Player allows remote attackers to execute arbitrary code via a long MP3 fi
23RISK
open ↗Referência✓ VexDay Proof
Flatchat 3.0 - 'pmscript.php' Local File Inclusion
Directory traversal vulnerability in pmscript.php in Flatchat 3.0 allows remote attackers to include and execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows - '.png' IHDR Block Denial of Service (PoC) (1)
Microsoft Windows 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (cpu consumption) via a
28RISK
open ↗Referência✓ VexDay Proof
Mambo Component com_forum 1.2.4RC3 - Remote File Inclusion
PHP remote file inclusion vulnerability in download.php in the Adam van Dongen Forum (com_forum) component (aka phpBB co
23RISK
open ↗Referência✓ VexDay Proof
Soholaunch Pro 4.9 r36 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Soholaunch Pro Edition 4.9 r46 and earlier, when register_globals
23RISK
open ↗Referência✓ VexDay Proof
ProfileCMS 1.0 - 'id' SQL Injection
Multiple SQL injection vulnerabilities in index.php in ProfileCMS 1.0 and earlier allow remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
CMS Made Simple 1.2.2 Module TinyMCE - SQL Injection
SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote
23RISK
open ↗Referência✓ VexDay Proof
AssoCIateD CMS 1.1.3 - 'ROOT_PATH' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in AssoCIateD (aka ACID) CMS 1.1.3 allow remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
iPrimal Forums - '/admin/index.php' Change User Password
admin/index.php in IPrimal Forums as of 20061105 allows remote attackers to bypass authentication and modify user passwo
23RISK
open ↗Referência✓ VexDay Proof
Brim 2.0.0 - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the Bookmarks plugin in Brim 2.0 allows remote authenticated users to inject
23RISK
open ↗Referência✓ VexDay Proof
Soulseek 157 NS - Remote Buffer Overflow (SEH)
Stack-based buffer overflow in Soulseek 156 and 157 NS allows remote attackers to execute arbitrary code via a long sear
23RISK
open ↗Referência✓ VexDay Proof
FreeWebShop.org script 2.2.2 - Multiple Vulnerabilities
Directory traversal vulnerability in index.php in FreeWebshop 2.2.1 and earlier allows remote attackers to read arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Pragyan CMS 2.6.4 - Multiple SQL Injections
SQL injection vulnerability in index.php Pragyan CMS 2.6.4 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
JAF CMS 4.0 RC2 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in JAF CMS 4.0 and 4.0 RC2 allow remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Cain & Abel 4.9.24 - '.rdp' Local Stack Overflow
Stack-based buffer overflow in the RDP protocol password decoder in Cain & Abel 4.9.23 and 4.9.24, and possibly earlier,
50RISK
open ↗Referência✓ VexDay Proof
PHPenpals 1.1 - 'mail.php?ID' SQL Injection
SQL injection vulnerability in mail.php in PHPenpals 1.1 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
WFTPD Pro Server 3.23.1.1 - 'APPE' Remote Buffer Overflow (PoC)
Buffer overflow in Texas Imperial Software WFTPD Pro Server 3.23.1.1 allows remote authenticated users to execute arbitr
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.