Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
public media manager 1.3 - Remote File Inclusion
PHP remote file inclusion vulnerability in NewsCMS/news/newstopic_inc.php in North Country Public Radio Public Media Man
23RISK
open ↗Referência✓ VexDay Proof
Lanius CMS 1.2.16 - 'FCKeditor' Arbitrary File Upload
Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.
23RISK
open ↗Referência✓ VexDay Proof
2532/Gigs 1.2.2 Stable - Remote Authentication Bypass
Multiple SQL injection vulnerabilities in checkuser.php in 2532designs 2532|Gigs 1.2.2 Stable, when magic_quotes_gpc is
23RISK
open ↗Referência✓ VexDay Proof
impleo music Collection 2.0 - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in admin/login.php in Impleo Music Collection 2.0, when magic_quotes_gpc is disabled, allows
23RISK
open ↗Referência✓ VexDay Proof
JBlog 1.0 - Create / Delete Admin Authentication Bypass
admin/ajoutaut.php in JBlog 1.0 does not require authentication, which allows remote attackers to create arbitrary accou
23RISK
open ↗Referência✓ VexDay Proof
Guestbara 1.2 - Change Admin Login and Password
admin/configuration.php in Guestbara 1.2 and earlier allows remote attackers to modify the e-mail, name, and password of
23RISK
open ↗Referência✓ VexDay Proof
NetVIOS Portal - 'page.asp' SQL Injection
SQL injection vulnerability in News/page.asp in NetVIOS Portal allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
idmos-phoenix CMS - 'aural.php' Remote File Inclusion
Multiple cross-site scripting (XSS) vulnerabilities in IDMOS 1.0-beta (aka Phoenix) allow remote attackers to inject arb
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component wmtportfolio 1.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.wmtportfolio.php in the webmaster-tips.net wmtportfolio 1.0 (com_wmtpor
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows - GDI Image Parsing Stack Overflow (MS08-021)
Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 200
35RISK
open ↗Referência✓ VexDay Proof
eWebquiz 8 - 'eWebQuiz.asp' SQL Injection
SQL injection vulnerability in eWebQuiz.asp in eWebQuiz 8 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
ttCMS 4 - 'ez_sql.php?lib_path' Remote File Inclusion
PHP remote file inclusion vulnerability in lib/db/ez_sql.php in ttCMS 4 and earlier allows remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
Blog System 1.x - 'index.php?news_id' SQL Injection
SQL injection vulnerability in index.php in BlogSite Professional (aka Blog System) 1.x allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
Apache Tomcat - 'WebDAV' Remote File Disclosure
Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.
35RISK
open ↗Referência✓ VexDay Proof
eXtremail 2.1.1 - 'LOGIN' Remote Stack Overflow
Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending
28RISK
open ↗Referência✓ VexDay Proof
Fuzzylime CMS 3.03a - Local Inclusion / Arbitrary File Corruption
code/display.php in fuzzylime (cms) 3.03a and earlier, when magic_quotes_gpc is disabled, allows remote attackers to con
23RISK
open ↗Referência✓ VexDay Proof
phpDatingClub 3.7 - SQL Injection / Cross-Site Scripting Injection
SQL injection vulnerability in search.php in phpDatingClub 3.7 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
Simple Machines Forum (SMF) 1.1.3 - Blind SQL Injection
SQL injection vulnerability in Sources/Search.php in Simple Machines Forum (SMF) 1.1.3, when MySQL 5 is used, allows rem
23RISK
open ↗Referência✓ VexDay Proof
JW Player - 'playerready' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attackers
23RISK
open ↗Referência✓ VexDay Proof
Star Articles 6.0 - Blind SQL Injection (2)
Multiple SQL injection vulnerabilities in Kalptaru Infotech Ltd. Star Articles 6.0 allow remote attackers to inject arbi
23RISK
open ↗Referência✓ VexDay Proof
Campsite 3.3.0 RC1 - Multiple Remote File Inclusions
Directory traversal vulnerability in admin-files/ad.php in Campsite 3.3.0 RC1 allows remote attackers to read and possib
23RISK
open ↗Referência✓ VexDay Proof
PHP123 Top Sites - 'category.php?cat' SQL Injection
SQL injection vulnerability in category.php in PHP123 Top Sites allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
phpMyNewsletter 0.8b5 - 'msg_id' SQL Injection
SQL injection vulnerability in archives.php in Gregory Kokanosky (aka Greg's Place) phpMyNewsletter 0.8 beta 5 and earli
23RISK
open ↗Referência✓ VexDay Proof
Nero ShowTime 5.0.15.0 - '.m3u' Playlist File Remote Buffer Overflow (PoC)
Buffer overflow in Nero ShowTime 5.0.15.0 allows remote attackers to cause a denial of service (crash) and possibly exec
23RISK
open ↗Referência✓ VexDay Proof
Docebo 3.5.0.3 - '/lib.regset.php/non-blind' SQL Injection
SQL injection vulnerability in the autoDetectRegion function in doceboCore/lib/lib.regset.php in Docebo 3.5.0.3 and earl
23RISK
open ↗Referência✓ VexDay Proof
Apple QuickTime 7.2/7.3 - RTSP Response Remote Overwrite (SEH)
Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac
50RISK
open ↗Referência✓ VexDay Proof
SunOS 5.10 Sun Cluster - 'rpc.metad' Denial of Service (PoC)
rpc.metad in Sun Solaris 10 allows remote attackers to cause a denial of service (daemon crash) via a malformed RPC requ
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Nice Talk 0.9.3 - 'tagid' SQL Injection
SQL injection vulnerability in index.php in the Nice Talk component (com_nicetalk) 0.9.3 and earlier for Joomla! allows
23RISK
open ↗Referência✓ VexDay Proof
ftp Admin 0.1.0 - Local File Inclusion / Cross-Site Scripting / Authentication Bypass
index.php in FTP Admin 0.1.0 allows remote attackers to bypass authentication and obtain administrative access via a log
23RISK
open ↗Referência✓ VexDay Proof
RealPlayer 11 - '.au' Denial of Service
A certain ActiveX control in RealNetworks RealPlayer 11 allows remote attackers to cause a denial of service (applicatio
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.