Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Omnistar Article Manager Software - 'article.php' SQL Injection
SQL injection vulnerability in article.php in OmniStar Article Manager allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component com_Marketplace 1.1.1 - SQL Injection
SQL injection vulnerability in index.php in the Marketplace (com_marketplace) 1.1.1 and 1.1.1-pl1 component for Joomla!
23RISK
open ↗Referência✓ VexDay Proof
Solar Empire 2.9.1.1 - Blind SQL Injection / Hash Retrieve
SQL injection vulnerability in game_listing.php in Solar Empire 2.9.1.1 and earlier allows remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
Easysitenetwork Recipe - 'categoryId' SQL Injection
SQL injection vulnerability in list.php in Easysitenetwork Recipe allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
Foojan Wms 1.0 - 'story' SQL Injection
SQL injection vulnerability in index.php in Foojan WMS PHP Weblog 1.0 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
DomPHP 0.81 - Remote Add Administrator
SQL injection vulnerability in welcome/inscription.php in DomPHP 0.81 and earlier allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
phpMyNewsletter 0.8 (beta5) - Multiple Vulnerabilities
admin/index.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier provides access to configuration modification
23RISK
open ↗Referência✓ VexDay Proof
WebSPELL 4.01.02 - 'picture.php' File Disclosure
Directory traversal vulnerability in picture.php in WebSPELL 4.01.02 and earlier, when PHP before 4.3.0 is used, allows
23RISK
open ↗Referência✓ VexDay Proof
Xforum 1.4 - 'topic' SQL Injection
SQL injection vulnerability in liretopic.php in Xforum 1.4 and possibly others allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
JBlog 1.0 - 'index.php?id' SQL Injection
Multiple SQL injection vulnerabilities in JBlog 1.0 allow (1) remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Template Be2004-2 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in the Be2004-2 template for Joomla! allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
Battle.net Clan Script for PHP 1.5.1 - SQL Injection
SQL injection vulnerability in login.php in Ryan Haudenschilt Battle.net Clan Script for PHP 1.5.1 and earlier allows re
23RISK
open ↗Referência✓ VexDay Proof
Enrollment System Project v1.0 - SQL Injection Authentication Bypass (SQLI)
Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to
53RISK
open ↗Referência✓ VexDay Proof
PHP121 Instant Messenger 2.2 - Local File Inclusion
PHP file inclusion vulnerability in php121db.php in PHP121 Instant Messenger 2.2 allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
BaoFeng2 - 'mps.dll' ActiveX Multiple Remote Buffer Overflows (PoC)
Multiple buffer overflows in the BaoFeng2 storm ActiveX control in Mps.dll allow remote attackers to have an unknown imp
23RISK
open ↗Referência✓ VexDay Proof
WebED 0.8999a - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in WebED in Markus Iser ED Engine 0.8999 alpha allow remote attackers
35RISK
open ↗Referência✓ VexDay Proof
Microsoft SQL Server - Distributed Management Objects Buffer Overflow
Buffer overflow in the SQLServer ActiveX control in the Distributed Management Objects OLE DLL (sqldmo.dll) 2000.085.200
35RISK
open ↗Referência✓ VexDay Proof
Sinapis Forum 2.2 - 'sinapis.php?fuss' Remote File Inclusion
PHP remote file inclusion vulnerability in sinapis.php in Sinapis Forum 2.2 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
TurboFTP Server 5.30 Build 572 - 'newline/LIST' Multiple Remote Denial of Service Vulnerabilities
TurboFTP 5.30 Build 572 allows remote servers to cause a denial of service (CPU consumption) via a response with a large
23RISK
open ↗Referência✓ VexDay Proof
News Bin Pro 5.33 - '.nbi' Local Buffer Overflow
Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
phpCommunityCalendar 4.0.3 - Cross-Site Scripting / SQL Injection
Multiple cross-site scripting (XSS) vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to inject arbit
23RISK
open ↗Referência✓ VexDay Proof
Ottoman CMS 1.1.3 - '?default_path=' Remote File Inclusion (1)
PHP remote file inclusion vulnerability in Ottoman 1.1.2, when register_globals is enabled, allows remote attackers to e
23RISK
open ↗Referência✓ VexDay Proof
DoceboLms 2.0.5 - 'help.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 2.05 allow remote attackers to execute arbitrary PHP co
23RISK
open ↗Referência✓ VexDay Proof
MWOpen E-Commerce - 'leggi_commenti.asp' SQL Injection
SQL injection vulnerability in leggi_commenti.asp in MWOpen 1.4 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Postcast Server Pro 3.0.61 / Quiksoft EasyMail - 'emsmtp.dll 6.0.1' Remote Buffer Overflow
Buffer overflow in the EasyMailSMTPObj ActiveX control in emsmtp.dll 6.0.1 in the Quiksoft EasyMail SMTP Object, as used
50RISK
open ↗Referência✓ VexDay Proof
Remotesoft .NET Explorer 2.0.1 - Local Stack Overflow (PoC)
Stack-based buffer overflow in Remotesoft .NET Explorer 2.0.1 allows user-assisted remote attackers to cause a denial of
23RISK
open ↗Referência✓ VexDay Proof
dB Masters Curium CMS 1.03 - 'c_id' SQL Injection
SQL injection vulnerability in news.php in dB Masters Curium CMS 1.03 and earlier allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
Kaqoo Auction - 'install_root' Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Kaqoo Auction Software Free Edition allow remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
Picture-Engine 1.2.0 - 'wall.php?cat' SQL Injection
SQL injection vulnerability in wall.php in Picture-Engine 1.2.0 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Foro Domus 2.10 - 'phpbb_root_path' Remote File Inclusion
PHP remote file inclusion vulnerability in menu.php in Foro Domus 2.10 allows remote attackers to execute arbitrary PHP
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.