Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,229cataloged exploits
36,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,465Referência 23,022GitHub PoC 15,030VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
BbZL.php 0.92 - 'lien_2' Local Directory Traversal
Directory traversal vulnerability in index.php in BbZL.PhP 0.92 allows remote attackers to access unauthorized directori
23RISK
open ↗Referência✓ VexDay Proof
VS-Link-Partner 2.1 - 'script_pfad' Remote File Inclusion
PHP remote file inclusion vulnerability in inc/functions_inc.php in VS-Link-Partner 2.1 and earlier allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
WebKalk2 1.9.0 - 'absolute_path' Remote File Inclusion
PHP remote file inclusion vulnerability in engine/engine.inc.php in WebKalk2 1.9.0 allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
TorrentTrader Classic 1.07 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in TorrentTrader Classic 1.07 allows remote attackers to inject arbitrary web s
23RISK
open ↗Referência✓ VexDay Proof
LiveAlbum 0.9.0 - 'common.php' Remote File Inclusion
PHP remote file inclusion vulnerability in common.php in LiveAlbum 0.9.0, when register_globals is enabled, allows remot
35RISK
open ↗Referência✓ VexDay Proof
SG Real Estate Portal 2.0 - Blind SQL Injection / Local File Inclusion
Multiple directory traversal vulnerabilities in SG Real Estate Portal 2.0 allow remote attackers to read arbitrary files
23RISK
open ↗Referência✓ VexDay Proof
Minigal b13 - Remote File Disclosure
Directory traversal vulnerability in index.php in MiniGal b13 (aka MG2) allows remote attackers to read the source code
23RISK
open ↗Referência✓ VexDay Proof
Basic-CMS - SQL Injection
SQL injection vulnerability in pages/index.php in BASIC-CMS allows remote attackers to execute arbitrary SQL commands vi
43RISK
open ↗Referência✓ VexDay Proof
Comparison Engine Power 1.0 - Blind SQL Injection
SQL injection vulnerability in product.detail.php in Kalptaru Infotech Comparison Engine Power Script 1.0 allows remote
23RISK
open ↗Referência✓ VexDay Proof
eroCMS 1.4 - 'site' SQL Injection
SQL injection vulnerability in index.php in eroCMS 1.4 and earlier allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
Pakupaku CMS 0.4 - Arbitrary File Upload / Local File Inclusion
Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and ex
23RISK
open ↗Referência✓ VexDay Proof
X7 Chat 2.0.1A1 - 'mini.php' Local File Inclusion
Directory traversal vulnerability in help/mini.php in X7 Chat 2.0.1 A1 and earlier allows remote attackers to include an
23RISK
open ↗Referência✓ VexDay Proof
falcon CMS 1.4.3 - Remote File Inclusion / Cross-Site Scripting
Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
X7 Chat 2.0.1A1 - Local File Inclusion
Directory traversal vulnerability in help/mini.php in X7 Chat 2.0.1 A1 and earlier allows remote attackers to include an
23RISK
open ↗Referência✓ VexDay Proof
CMS Faethon 2.0 - 'mainpath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in CMS Faethon 2.0 Ultimate and earlier, when register_globals and ma
23RISK
open ↗Referência✓ VexDay Proof
PokerMax Poker League 0.13 - Insecure Cookie Handling
configure.php in PokerMax Poker League Tournament Script 0.13 allows remote attackers to bypass authentication and gain
23RISK
open ↗Referência✓ VexDay Proof
WFTPD Pro Server 3.25 - Site ADMN Remote Denial of Service
Texas Imperial Software WFTPD and WFTPD Pro Server 3.25 and earlier allow remote attackers to cause a denial of service
23RISK
open ↗Referência✓ VexDay Proof
mini-pub 0.3 - File Disclosure / Code Execution
Absolute path traversal vulnerability in mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to read
23RISK
open ↗Referência✓ VexDay Proof
pl-PHP Beta 0.9 - Multiple Vulnerabilities
admin.php in pL-PHP beta 0.9 allows remote attackers to bypass authentication by setting the is_admin parameter to 1.
23RISK
open ↗Referência✓ VexDay Proof
txtshop 1.0b (Windows) - 'Language' Local File Inclusion
Directory traversal vulnerability in header.php in TXTshop beta 1.0 allows remote attackers to include and execute arbit
23RISK
open ↗Referência✓ VexDay Proof
PHP-CON 1.3 - 'include.php' Remote File Inclusion
PHP remote file inclusion vulnerability in Exchange/include.php in PHP_CON 1.3 allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities
import_wbb1.php in Unclassified NewsBoard (UNB) 1.6.4 allows remote attackers to obtain sensitive information via a dire
23RISK
open ↗Referência✓ VexDay Proof
CcMail 1.0.1 - 'functions_dir' Remote File Inclusion
PHP remote file inclusion vulnerability in functions/update.php in Cicoandcico CcMail 1.0 allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
OWL Intranet Engine 0.82 - 'xrms_file_root' Code Execution
PHP remote file inclusion vulnerability in lib/OWL_API.php in OWL Intranet Engine 0.82, when register_globals is enabled
23RISK
open ↗Referência✓ VexDay Proof
FreeCMS.us 0.2 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in FreeCMS 0.2 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Referência✓ VexDay Proof
mystats - 'hits.php' Multiple Vulnerabilities
hits.php in myWebland myStats allows remote attackers to bypass IP address restrictions via a modified X-Forwarded-For H
23RISK
open ↗Referência✓ VexDay Proof
Yerba SACphp 6.3 - Multiple Vulnerabilities
Yerba SACphp 6.3 and earlier allows remote attackers to bypass authentication and gain administrative access via a galle
23RISK
open ↗Referência✓ VexDay Proof
ravennuke 2.3.0 - Multiple Vulnerabilities
Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.3
23RISK
open ↗Referência✓ VexDay Proof
Oxygen 2.0 - 'repquote' SQL Injection
SQL injection vulnerability in post.php in Oxygen (aka O2PHP Bulletin Board) 2.0 allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
BASE 1.2.4 - melissa Snort Frontend Remote File Inclusion
PHP remote file inclusion vulnerability in Basic Analysis and Security Engine (BASE) 1.2.4 and earlier, with register_gl
50RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.