Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Megabbs Forum 2.2 - SQL Injection / Cross-Site Scripting
Mulatiple cross-site scripting (XSS) vulnerabilities in PD9 Software MegaBBS 2.2 allow remote attackers to inject arbitr
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component JooBB 0.5.9 - Blind SQL Injection
SQL injection vulnerability in the Joomla! Bulletin Board (aka Joo!BB or com_joobb) component 0.5.9 for Joomla! allows r
23RISK
open ↗Referência✓ VexDay Proof
Chilkat FTP ActiveX 2.0 - 'ChilkatCert.dll' Insecure Method
Insecure method vulnerability in the Chilkat FTP 2.0 ActiveX component (ChilkatCert.dll) allows remote attackers to over
23RISK
open ↗Referência✓ VexDay Proof
PHP < 4.4.5/5.2.1 - PHP_binary Session Deserialization Information Leak
The php_binary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-
23RISK
open ↗Referência✓ VexDay Proof
Telephone Directory 2008 - SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in Telephone Directory 2008, when magic_quotes_gpc is disabled, allow remote atta
23RISK
open ↗Referência✓ VexDay Proof
mystats - 'hits.php' Multiple Vulnerabilities
SQL injection vulnerability in hits.php in myWebland myStats allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Referência✓ VexDay Proof
ArabCMS - 'rss.php' Local File Inclusion
Directory traversal vulnerability in rss.php in ArabCMS 2.0 beta 1 allows remote attackers to include and execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
ACGVclick 0.2.0 - 'path' Remote File Inclusion
PHP remote file inclusion vulnerability in function.inc.php in ACGVclick 0.2.0 and earlier allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
phpBB MOD Forum picture and META tags 1.7 - Remote File Inclusion
PHP remote file inclusion vulnerability in MOD_forum_fields_parse.php in the Forum picture and META tags 1.7 module for
23RISK
open ↗Referência✓ VexDay Proof
YAAP 1.5 - '__autoload()' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/common.php in Yaap 1.5 and earlier allows remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
Scallywag - 'template.php?path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Scallywag 2005-04-25 allow remote attackers to execute arbitrary P
23RISK
open ↗Referência✓ VexDay Proof
phpBB Mod OpenID 0.2.0 - 'BBStore.php' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/openid/Auth/OpenID/BBStore.php in phpBB Openid 0.2.0 allows remote a
23RISK
open ↗Referência✓ VexDay Proof
Flat PHP Board 1.2 - Multiple Vulnerabilities
Multiple directory traversal vulnerabilities in index.php in Flat PHP Board 1.2 and earlier allow remote attackers to (1
23RISK
open ↗Referência✓ VexDay Proof
Cyberfolio 7.12 - 'rep' Remote File Inclusion
PHP remote file inclusion vulnerability in portfolio/commentaires/derniers_commentaires.php in Cyberfolio 7.12, when reg
23RISK
open ↗Referência✓ VexDay Proof
D-Link MPEG4 SHM Audio Control - 'VAPGDecoder.dll 1.7.0.5' Remote Buffer Overflow
Stack-based buffer overflow in VATDecoder.VatCtrl.1 ActiveX control in (1) 4xem VatCtrl Class (VATDecoder.dll 1.0.0.27 a
23RISK
open ↗Referência✓ VexDay Proof
OpenBSD 4.5 - IP datagrams Remote Denial of Service
The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirO
23RISK
open ↗Referência✓ VexDay Proof
SonicMailer Pro 3.2.3 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in Triexa SonicMailer Pro 3.2.3 and earlier allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
e107 Plugin EasyShop - 'category_id' Blind SQL Injection
SQL injection vulnerability in easyshop.php in the EasyShop plugin for e107 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Site-Assistant 0990 - 'paths[version]' Remote File Inclusion
PHP remote file inclusion vulnerability in classes/menu.php in Site-Assistant 0990 and earlier allows remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
AssetMan 2.4a - 'download_pdf.php' Remote File Disclosure
Directory traversal vulnerability in download_pdf.php in AssetMan 2.4a and earlier allows remote attackers to read arbit
23RISK
open ↗Referência✓ VexDay Proof
CyBoards PHP Lite 1.21 - 'script_path' Remote File Inclusion
PHP remote file inclusion vulnerability in include/default_header.php in Cyboards PHP Lite 1.21 allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
Sisplet CMS 05.10 - 'site_path' Remote File Inclusion
PHP remote file inclusion vulnerability in main/forum/komentar.php in OneClick CMS (aka Sisplet CMS) 05.10 and earlier a
23RISK
open ↗Referência✓ VexDay Proof
6ALBlog - 'newsid' SQL Injection
PHP remote file inclusion vulnerability in admin/index.php in 6ALBlog allows remote authenticated administrators to exec
23RISK
open ↗Referência✓ VexDay Proof
XOOPS 2.0.18 - Local File Inclusion / URL Redirecting
Directory traversal vulnerability in htdocs/install/index.php in XOOPS 2.0.18 allows remote attackers to include and exe
23RISK
open ↗Referência✓ VexDay Proof
Web Slider 0.6 - Insecure Cookie/Authentication Handling
Admin.php in Web Slider 0.6 allows remote attackers to bypass authentication and gain privileges by setting the admin co
23RISK
open ↗Referência✓ VexDay Proof
txtSQL 2.2 Final - 'startup.php' Remote File Inclusion
PHP remote file inclusion vulnerability in examples/txtSQLAdmin/startup.php in txtSQL 2.2 Final allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
AGENCY4NET WEBFTP 1 - 'download2.php' File Disclosure
Directory traversal vulnerability in download2.php in AGENCY4NET WEBFTP 1 allows remote attackers to read and delete arb
23RISK
open ↗Referência✓ VexDay Proof
asp-project 1.0 - Insecure Cookie Method
Asp Project Management 1.0 allows remote attackers to bypass authentication and gain administrative access by setting th
23RISK
open ↗Referência✓ VexDay Proof
Wysi Wiki Wyg 1.0 - Local File Inclusion / Cross-Site Scripting / PHPInfo
Directory traversal vulnerability in index.php in Easy-Script Wysi Wiki Wyg 1.0 allows remote attackers to read arbitrar
23RISK
open ↗Referência✓ VexDay Proof
BbZL.php 0.92 - Insecure Cookie Handling
BbZL.PhP 0.92 allows remote attackers to bypass authentication and gain administrative access by setting the phorum_admi
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.