Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,230cataloged exploits
36,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
TorrentFlux 2.2 - 'downloaddetails.php' Local File Disclosure
Directory traversal vulnerability in downloaddetails.php in TorrentFlux 2.2 allows remote authenticated users to read ar
23RISK
open ↗Referência✓ VexDay Proof
mxBB Module Activity Games 0.92 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/act_constants.php in the Activity Games (mx_act) 0.92 module for mxB
23RISK
open ↗Referência✓ VexDay Proof
AstonSoft DeepBurner 1.8.0 - '.dbr' File Parsing Buffer Overflow
Buffer overflow in Astonsoft DeepBurner Pro and Free 1.8.0 and earlier allows user-assisted remote attackers to execute
50RISK
open ↗Referência✓ VexDay Proof
VerliAdmin 0.3 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in VerliAdmin 0.3 and earlier allows remote authenticated users to
23RISK
open ↗Referência✓ VexDay Proof
TextSend 1.5 - '/config/sender.php' Remote File Inclusion
PHP remote file inclusion vulnerability in sender.php in Carsen Klock TextSend 1.5 allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
RealPlayer 10.5 - ActiveX Control Denial of Service
A certain ActiveX control in rpau3260.dll in RealNetworks RealPlayer 10.5 allows remote attackers to cause a denial of s
23RISK
open ↗Referência✓ VexDay Proof
PHPMyManga 0.8.1 - 'template.php' Multiple File Inclusions
Multiple PHP remote file inclusion vulnerabilities in template.php in Phpmymanga 0.8.1 and earlier allow remote attacker
23RISK
open ↗Referência✓ VexDay Proof
Pagetool CMS 1.07 - 'pt_upload.php' Remote File Inclusion
Multiple PHP file inclusion vulnerabilities in src/admin/pt_upload.php in Pagetool 1.07 allow remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
Jinzora 2.7 - 'INCLUDE_PATH' Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Jinzora Media Jukebox 2.7 and earlier, when register_globals is en
23RISK
open ↗Referência✓ VexDay Proof
Irokez Blog 0.7.1 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Irokez CMS 0.7.1 and earlier, when register_globals is enabled, al
23RISK
open ↗Referência✓ VexDay Proof
Ciberia Content Federator 1.0.1 - 'path' Remote File Inclusion
PHP remote file inclusion vulnerability in socios/maquetacion_socio.php (members/maquetacion_member.php) in Ciberia Cont
23RISK
open ↗Referência✓ VexDay Proof
acFTP FTP Server 1.5 - 'REST/PBSZ' Remote Denial of Service
acFTP 1.5 allows remote authenticated users to cause a denial of service via a crafted argument to the (1) REST or (2) P
23RISK
open ↗Referência✓ VexDay Proof
open NewsLetter 2.5 - Multiple Vulnerabilities (2)
The (1) settings.php and (2) subscribers.php scripts in Open Newsletter 2.5 and earlier do not exit when authentication
23RISK
open ↗Referência✓ VexDay Proof
Calendar MX BASIC 1.0.2 - 'ID' SQL Injection
SQL injection vulnerability in calendar_detail.asp in Calendar MX BASIC 1.0.2 and earlier allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
myPHPNuke Module My_eGallery 2.5.6 - 'basepath' Remote File Inclusion
PHP remote file inclusion vulnerability in gallery/displayCategory.php in the My_eGallery 2.5.6 module in myPHPNuke (MPN
23RISK
open ↗Referência✓ VexDay Proof
MTCMS 2.0 - '/admin/admin_settings.php' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/admin_settings.php in MTCMS 2.0 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
SH-News 0.93 - 'misc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in misc.php in SH-News 0.93, when register_globals is enabled, allows remote att
23RISK
open ↗Referência✓ VexDay Proof
Enthrallweb ePages - 'actualpic.asp' SQL Injection
SQL injection vulnerability in actualpic.asp in Enthrallweb ePages allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
Enthrallweb eCars 1.0 - 'types.asp' SQL Injection
SQL injection vulnerability in Types.asp in Enthrallweb eCars 1.0 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
Dragon Business Directory 3.01.12 - 'ID' SQL Injection
SQL injection vulnerability in bus_details.asp in Dragon Business Directory - Pro (aka Dragon Internet Business Search D
23RISK
open ↗Referência✓ VexDay Proof
Enthrallweb eJobs - 'newsdetail.asp' SQL Injection
SQL injection vulnerability in newsdetail.asp in Enthrallweb eJobs allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
Ananda Real Estate 3.4 - 'agent' SQL Injection
SQL injection vulnerability in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 and earlier all
23RISK
open ↗Referência✓ VexDay Proof
Bubla 1.0.0rc2 - '/bu/process.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in process.php in Vladimir Menshakov buratinable templator (aka bubla
23RISK
open ↗Referência✓ VexDay Proof
Nitrotech 0.0.3a - Remote Code Execution
Directory traversal vulnerability in includes/common.php in NitroTech 0.0.3a, as distributed before 2006, allows remote
23RISK
open ↗Referência✓ VexDay Proof
FreeWebShop.org script 2.2.2 - Multiple Vulnerabilities
index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to obtain sensitive information via an invalid action
23RISK
open ↗Referência✓ VexDay Proof
SCart 2.0 - 'page' Remote Code Execution
scart.cgi in SCart 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the page parame
23RISK
open ↗Referência✓ VexDay Proof
FlashBB 1.1.8 - 'phpbb_root_path' Remote File Inclusion
PHP remote file inclusion vulnerability in phpbb/getmsg.php in FlashBB 1.1.5 and earlier allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
TinyPHP Forum 3.6 - 'profile.php' Remote Code Execution
Directory traversal vulnerability in profile.php in TinyPHPforum 3.6 and earlier allows remote attackers to include and
23RISK
open ↗Referência✓ VexDay Proof
exV2 < 2.0.4.3 - 'extract()' Remote Command Execution
Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to de
23RISK
open ↗Referência✓ VexDay Proof
PhpNews 1.0 - 'Include' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in PhpNews 1.0 allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.