Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,230cataloged exploits
36,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
S9Y Serendipity 1.0.3 - 'comment.php' Local File Inclusion
Multiple directory traversal vulnerabilities in Serendipity 1.0.3 and earlier allow remote attackers to read or include
23RISK
open ↗Referência✓ VexDay Proof
Songbird Media Player 0.2 - Format String Denial of Service (PoC)
Format string vulnerability in Songbird Media Player 0.2 and earlier allows remote attackers to cause a denial of servic
23RISK
open ↗Referência✓ VexDay Proof
VUPlayer 2.44 - '.m3u' UNC Name Buffer Overflow (Metasploit)
Stack-based buffer overflow in VUPlayer 2.44 and earlier allows remote attackers to execute arbitrary code via a long st
50RISK
open ↗Referência✓ VexDay Proof
AtomixMP3 < 2.3 - '.m3u' Local Buffer Overflow
Stack-based buffer overflow in AtomixMP3 2.3 and earlier allows remote attackers to execute arbitrary code via a long pa
28RISK
open ↗Referência✓ VexDay Proof
CoolPlayer 2.17 - '.m3u' Local Stack Overflow
Multiple buffer overflows in Niek Albers CoolPlayer 216 and earlier allow remote attackers to execute arbitrary code via
23RISK
open ↗Referência✓ VexDay Proof
F-Prot AntiVirus 4.6.6 - CHM Heap Overflow (PoC)
Heap-based buffer overflow in FRISK Software F-Prot Antivirus before 4.6.7 allows user-assisted remote attackers to exec
28RISK
open ↗Referência✓ VexDay Proof
torrentflux 2.2 - Arbitrary File Create/ Execute/Delete
index.php for TorrentFlux 2.2 allows remote registered users to execute arbitrary commands via shell metacharacters in t
23RISK
open ↗Referência✓ VexDay Proof
F-Prot AntiVirus 4.6.6 - 'ACE' Denial of Service
FRISK Software F-Prot Antivirus before 4.6.7 allows user-assisted remote attackers to cause a denial of service (infinit
23RISK
open ↗Referência✓ VexDay Proof
awrate.com Message Board 1.0 - 'search.php' Remote File Inclusion
PHP remote file inclusion vulnerability in login.php.inc in awrate 1.0 allows remote attackers to execute arbitrary PHP
23RISK
open ↗Referência✓ VexDay Proof
Ultimate HelpDesk - Cross-Site Scripting / Local File Disclosure
Cross-site scripting (XSS) vulnerability in index.asp in Ultimate HelpDesk allows remote attackers to inject arbitrary w
23RISK
open ↗Referência✓ VexDay Proof
BlazeVideo HDTV Player 2.1 - '.PLF' Local Buffer Overflow
Stack-based buffer overflow in BlazeVideo HDTV Player 2.1, and possibly earlier, allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
VMware 5.5.1 - 'ActiveX' Local Buffer Overflow
Buffer overflow in an ActiveX control in VMWare 5.5.1 allows local users to execute arbitrary code via a long VmdbDb par
23RISK
open ↗Referência✓ VexDay Proof
J-OWAMP Web Interface 2.1b - 'link' Remote File Inclusion
PHP remote file inclusion vulnerability in JOWAMP_ShowPage.php in J-OWAMP Web Interface 2.1 allows remote authenticated
23RISK
open ↗Referência✓ VexDay Proof
CM68 News 12.02.06 - 'addpth' Remote File Inclusion
PHP remote file inclusion vulnerability in engine/oldnews.inc.php in CM68 News 12.02.06 allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
HR Assist 1.05 - 'vdateUsr.asp' Remote Authentication Bypass
SQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Gizzar 03162002 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Gizzar 03162002 and earlier allows remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
D-Link DWL-2000AP 2.11 - ARP Flood Remote Denial of Service
D-LINK DWL-2000AP+ firmware 2.11 allows remote attackers to cause (1) a denial of service (device reset) via a flood of
23RISK
open ↗Referência✓ VexDay Proof
Fantastic News 2.1.4 - 'news.php' SQL Injection
SQL injection vulnerability in news.php in Fantastic News 2.1.4 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
SpotLight CRM 1.0 - 'login.asp' SQL Injection
Multiple SQL injection vulnerabilities in login.asp in AppIntellect SpotLight CRM 1.0 allow remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
mxBB Module ErrorDocs 1.0 - 'common.php' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/common.php in the ErrorDocs 1.0.0 and earlier module for mxBB (mx_er
23RISK
open ↗Referência✓ VexDay Proof
CuteNews aj-fork 167f - 'cutepath' Remote File Inclusion
PHP remote file inclusion vulnerability in inc/shows.inc.php in cutenews aj-fork (CN:AJ) 167f and earlier allows remote
23RISK
open ↗Referência✓ VexDay Proof
Phorum 3.2.11 - 'common.php' Remote File Inclusion
PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
Tucows Client Code Suite (CSS) 1.2.1015 - Remote File Inclusion
PHP remote file inclusion vulnerability in libs/tucows/api/cartridges/crt_TUCOWS_domains/lib/domainutils.inc.php in Tuco
23RISK
open ↗Referência✓ VexDay Proof
mxBB Module newssuite 1.03 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/newssuite_constants.php in the NewsSuite 1.03 module for mxBB allows
23RISK
open ↗Referência✓ VexDay Proof
Request For Travel 1.0 - 'product' SQL Injection
SQL injection vulnerability in ProductDetails.asp in Lotfian Request For Travel 1.0 allows remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
ProFTPd 1.3.0/1.3.0a - 'mod_ctrls' 'support' Local Buffer Overflow (1)
Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1
23RISK
open ↗Referência✓ VexDay Proof
Crob FTP Server 3.6.1 build 263 - 'LIST/NLST' Denial of Service
Crob FTP Server 3.6.1 b.263 allows remote attackers to cause a denial of service via a long series of "?A" sequences in
23RISK
open ↗Referência✓ VexDay Proof
FileZilla FTP Server 0.9.21 - 'LIST/NLST' Denial of Service
FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a wildcard argument to t
60RISK
open ↗Referência✓ VexDay Proof
mxBB Module Profile CP 0.91c - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/profilcp_constants.php in the Profile Control Panel (CPanel) module
23RISK
open ↗Referência✓ VexDay Proof
mxBB Module kb_mods 2.0.2 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/kb_constants.php in the Knowledge Base (mx_kb) 2.0.2 module for mxBB
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.