Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Mobius 1.4.4.1 - SQL Injection
Multiple SQL injection vulnerabilities in Mobius for Mimsy XG 1 1.4.4.1 and earlier allow remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
zeeproperty 1.0 - Arbitrary File Upload / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in view_prop_details.php in Zeeways ZEEPROPERTY 1.0 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Bubla 0.9.2 - 'bu_dir' Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Vladimir Menshakov buratinable templator (aka bubla) 0.9.1 allow r
23RISK
open ↗Referência✓ VexDay Proof
eNdonesia 8.4 - '/mod.php/friend.php/admin.php' Multiple Vulnerabilities
Directory traversal vulnerability in mod.php in eNdonesia 8.4 allows remote attackers to read arbitrary files via a .. (
23RISK
open ↗Referência✓ VexDay Proof
Apple Safari - RSS 'feed://' Buffer Overflow via libxml2 (PoC)
Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-de
28RISK
open ↗Referência✓ VexDay Proof
simple file manager 0.24a - Multiple Vulnerabilities
Multiple directory traversal vulnerabilities in fm.php in Simple File Manager (SFM) 0.24a allow remote attackers to use
23RISK
open ↗Referência✓ VexDay Proof
CentiPaid 1.4.2 - 'centipaid_class.php' Remote File Inclusion
PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.2 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
e-Vision CMS 2.02 - SQL Injection / Remote Code Execution
Multiple directory traversal vulnerabilities in e-Vision CMS 2.02 and earlier allow remote attackers to (1) include and
23RISK
open ↗Referência✓ VexDay Proof
X-Forum 0.6.2 - Remote Command Execution
Static code injection vulnerability in X-Forum 0.6.2 allows remote authenticated administrators to inject arbitrary PHP
23RISK
open ↗Referência✓ VexDay Proof
Quake 3 Engine 1.32b - 'R_RemapShader()' Remote Client Buffer Overflow
Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Castle Wolfenstein 1.41, and (3) Quake III
23RISK
open ↗Referência✓ VexDay Proof
phpBB User Viewed Posts Tracker 1.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/functions_user_viewed_posts.php in the Nivisec User Viewed Posts Tra
23RISK
open ↗Referência✓ VexDay Proof
MiniBB 2.0.5 - 'Language' Local File Inclusion
Directory traversal vulnerability in index.php in MiniBB 2.0.5 allows remote attackers to read arbitrary files via a ..
23RISK
open ↗Referência✓ VexDay Proof
IP Reg 0.3 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Ip Reg 0.3 allow remote attackers to execute arbitrary SQL commands via the vl
23RISK
open ↗Referência✓ VexDay Proof
k-links directory - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Qsoft K-Links allows remote attackers to inject arbitrary web s
23RISK
open ↗Referência✓ VexDay Proof
ravennuke 2.3.0 - Multiple Vulnerabilities
images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array paramet
23RISK
open ↗Referência✓ VexDay Proof
wget 1.10.2 - Unchecked Boundary Condition Denial of Service
The ftp_syst function in ftp-basic.c in Free Software Foundation (FSF) GNU wget 1.10.2 allows remote attackers to cause
23RISK
open ↗Referência✓ VexDay Proof
exV2 < 2.0.4.3 - 'extract()' Remote Command Execution
Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite
28RISK
open ↗Referência✓ VexDay Proof
Freelance Auction Script 1.0 - 'browseproject.php' SQL Injection
SQL injection vulnerability in browseproject.php in Freelance Auction Script 1.0 allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
Etomite CMS 0.6.1 - 'rfiles.php' Remote Command Execution
Unrestricted file upload vulnerability in manager/media/ibrowser/scripts/rfiles.php in Etomite CMS 0.6.1 and earlier all
23RISK
open ↗Referência✓ VexDay Proof
PHP-Stats 0.1.9.2 - Multiple Vulnerabilities
Multiple eval injection vulnerabilities in Php-Stats 0.1.9.2 allow remote authenticated administrators to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
68 Classifieds 4.0 - 'category.php' SQL Injection
SQL injection vulnerability in category.php in 68 Classifieds 4.0.1 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
plusphp url shortening software 1.6 - Remote File Inclusion
PHP remote file inclusion vulnerability in plus.php in plusPHP Short URL Multi-User Script 1.6 allows remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
AllMyGuests 0.4.1 - 'cfg_serverpath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in AllMyGuests 0.4.1 and earlier allow remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
PHP Live Helper 2.0.1 - Multiple Vulnerabilities
SQL injection vulnerability in onlinestatus_html.php in Turnkey PHP Live Helper 2.0.1 and earlier allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
Webfwlog 0.92 - 'debug.php' Remote File Disclosure
include/debug.php in Webfwlog 0.92 and earlier, when register_globals is enabled, allows remote attackers to obtain sour
23RISK
open ↗Referência✓ VexDay Proof
Jamroom 3.3.5 - Remote File Inclusion
PHP remote file inclusion vulnerability in include/plugins/jrBrowser/purchase.php in Jamroom 3.3.0 through 3.3.5, when r
23RISK
open ↗Referência✓ VexDay Proof
Pluck CMS 4.5.2 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in Pluck CMS 4.5.2 on Windows allow remote attackers to include and execute
23RISK
open ↗Referência✓ VexDay Proof
HockeySTATS Online 2.0 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in TheHockeyStop HockeySTATS Online 2.0 Basic and Advanced allow remote attackers
23RISK
open ↗Referência✓ VexDay Proof
Vastal I-Tech Shaadi Zone 1.0.9 - 'tage' SQL Injection
SQL injection vulnerability in keyword_search_action.php in Vastal I-Tech Shaadi Zone 1.0.9 allows remote attackers to e
23RISK
open ↗Referência✓ VexDay Proof
PHPRecipeBook 2.35 - 'g_rb_basedir' Remote File Inclusion
PHP remote file inclusion vulnerability in classes/Import_MM.class.php in PHPRecipeBook 2.36, when register_globals is e
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.