Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
@lex Guestbook 4.0.2 - Remote Command Execution
SQL injection vulnerability in index.php in @lex Guestbook 4.0.2 and earlier, when magic_quotes_gpc is disabled, allows
23RISK
open ↗Referência✓ VexDay Proof
Integramod 1.4.x - Insecure Directory Download Database
IntegraMOD 1.4.x stores sensitive information under the web root with insufficient access control, which allows remote a
23RISK
open ↗Referência✓ VexDay Proof
GuppY 4.5.16 - Remote Command Execution
Multiple static code injection vulnerabilities in error.php in GuppY 4.5.16 and earlier allow remote attackers to inject
23RISK
open ↗Referência✓ VexDay Proof
EDraw Flowchart ActiveX Control 2.0 - Insecure Method
Absolute path traversal vulnerability in the EDraw Flowchart ActiveX control in EDImage.ocx 2.0.2005.1104 allows remote
23RISK
open ↗Referência✓ VexDay Proof
Google Chrome 0.2.149.27 - Inspect Element Denial of Service
Google Chrome 0.2.149.27 allows user-assisted remote attackers to cause a denial of service (browser crash) via an IMG t
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Internet Explorer 7 - Memory Corruption (PoC) (MS09-002)
Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows r
60RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows Server 2000/2003 - Code Execution (MS08-067)
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 20
100RISK
open ↗Referência✓ VexDay Proof
Weblosninger 4 - Cross-Site Scripting / SQL Injection
Multiple SQL injection vulnerabilities in Simpel Side Weblosning 1 through 4 allow remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
FlashGet 1.9.0.1012 - 'FTP PWD Response' Remote Buffer Overflow (SafeSEH)
Buffer overflow in FlashGet (formerly JetCar) FTP 1.9 allows remote FTP servers to execute arbitrary code via a long res
23RISK
open ↗Referência✓ VexDay Proof
Fullaspsite Asp Hosting Sitesi - 'tr' SQL Injection
SQL injection vulnerability in windows.asp in Fullaspsite Asp Hosting Sitesi allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Atomic Photo Album 1.1.0pre4 - Cross-Site Scripting / SQL Injection
SQL injection vulnerability in album.php in Atomic Photo Album (APA) 1.1.0pre4 allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
AuraCMS 2.1 - Remote File Attachment / Local File Inclusion
Directory traversal vulnerability in index.php in AuraCMS 2.1 and earlier allows remote attackers to include and execute
23RISK
open ↗Referência✓ VexDay Proof
AJ HYIP ACME - 'topic_detail.php' SQL Injection
SQL injection vulnerability in forum/topic_detail.php in AJ Square aj-hyip (aka AJ HYIP Acme) allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
openPHPNuke 2.3.3 - Remote File Inclusion
PHP remote file inclusion vulnerability in master.php in OpenPHPNuke and 2.3.3 earlier allows remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
MyBlog 0.9.8 - Insecure Cookie Handling
add.php in MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication and gain administrative access by s
23RISK
open ↗Referência✓ VexDay Proof
VUPlayer 2.49 - '.asx' 'HREF' Universal Buffer Overflow
Stack-based buffer overflow in VUPlayer 2.49 allows remote attackers to execute arbitrary code via a long .asf URI in th
28RISK
open ↗Referência✓ VexDay Proof
Synactis All_IN_THE_BOX ActiveX 3.0 - Null Byte File Overwrite
The SaveDoc method in the All_In_The_Box.AllBox ActiveX control in ALL_IN_THE_BOX.OCX in Synactis ALL In-The-Box ActiveX
23RISK
open ↗Referência✓ VexDay Proof
Hunkaray Duyuru Scripti - 'tr' SQL Injection
SQL injection vulnerability in oku.asp in Hunkaray Duyuru Scripti allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
Chicken of the VNC 2.0 - 'NULL-pointer' Remote Denial of Service
Chicken of the VNC (cotv) 2.0 allows remote attackers to cause a denial of service (application crash) via a large compu
23RISK
open ↗Referência✓ VexDay Proof
Gradman 0.1.3 - 'agregar_info.php' Local File Inclusion
Directory traversal vulnerability in agregar_info.php in GradMan 0.1.3 and earlier allows remote attackers to include an
23RISK
open ↗Referência✓ VexDay Proof
LunarPoll 1.0 - 'show.php?PollDir' Remote File Inclusion
PHP remote file inclusion vulnerability in show.php in LunarPoll, when register_globals is enabled, allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
AvailScript Article Script - 'articles.php' Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in articles.php in AvailScript Article Script allows remote attackers to inject
23RISK
open ↗Referência✓ VexDay Proof
idmos-phoenix CMS - 'aural.php' Remote File Inclusion
PHP remote file inclusion vulnerability in core/aural.php in IDMOS 1.0-beta (aka Phoenix) allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
TinyFTPD 1.4 - 'USER' Remote Buffer Overflow (Denial of Service) (PoC)
Buffer overflow in Tiny FTPd 1.4 and earlier allows remote attackers to cause a denial of service (daemon crash) via a l
23RISK
open ↗Referência✓ VexDay Proof
HispaH Model Search - 'cat.php?cat' SQL Injection
SQL injection vulnerability in cat.php in HispaH Model Search allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
Creator CMS 5.0 - 'sideid' SQL Injection
SQL injection vulnerability in index.asp in Creative Mind Creator CMS 5.0 allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
Advanced Poll 2.0.5-dev - Remote Admin Session Generator
admin/index.php in Advanced Poll 2.0.0 through 2.0.5-dev allows remote attackers to bypass authentication and gain admin
23RISK
open ↗Referência✓ VexDay Proof
CPCommerce 1.1.0 - Cross-Site Scripting / Local File Inclusion
Multiple directory traversal vulnerabilities in cpCommerce 1.1.0 allow remote attackers to include and execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
OpenDock Easy Blog 1.4 - 'doc_directory' File Inclusion
Multiple PHP remote file inclusion vulnerabilities in OpenDock Easy Blog 1.4 and earlier, when register_globals is enabl
23RISK
open ↗Referência✓ VexDay Proof
PHP Visit Counter 0.4 - 'datespan' SQL Injection
SQL injection vulnerability in read.php in PHP Visit Counter 0.4 and earlier allows remote attackers to execute arbitrar
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.