Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,230cataloged exploits
36,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
QK SMTP 3.01 - 'RCPT TO' Remote Denial of Service
Stack-based buffer overflow in QK SMTP 3.01 and earlier might allow remote attackers to execute arbitrary code via a lon
23RISK
open ↗Referência✓ VexDay Proof
phpBLASTER CMS 1.0 RC1 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in admin/minibb/index.php in phpBLASTER CMS 1.0 RC1, when register_globals
23RISK
open ↗Referência✓ VexDay Proof
Ultimate PHP Board 2.0 - 'header_simple.php' File Inclusion
PHP remote file inclusion vulnerability in includes/header_simple.php in Ultimate PHP Board (UPB) 2.0 and earlier allows
23RISK
open ↗Referência✓ VexDay Proof
KVIrc 3.4.2 Shiny - URI handler Remote Command Execution
Argument injection vulnerability in the URI handler in KVIrc 3.4.2 Shiny allows remote attackers to execute arbitrary co
23RISK
open ↗Referência✓ VexDay Proof
groone's Guestbook 2.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/header.php in Groone GBook 2.0 allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
NUNE News Script 2.0pre2 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in NUNE News Script 2.0pre2 allow remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
minb 0.1.0 - Remote Code Execution
include/modules/top/1-random_quote.php in Minb Is Not a Blog (minb) 0.1.0 allows remote attackers to execute arbitrary P
23RISK
open ↗Referência✓ VexDay Proof
eFiction 3.1.1 - 'path_to_smf' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in eFiction 3.1.1 and earlier allow remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Expert Advisior - 'index.php?id' SQL Injection
SQL injection vulnerability in index.php in Expert Advisor allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
Pluck CMS 4.5.3 - 'g_pcltar_lib_dir' Local File Inclusion
Directory traversal vulnerability in data/inc/lib/pcltar.lib.php in Pluck 4.5.3, when register_globals is enabled, allow
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Portfol 1.2 - 'vcatid' SQL Injection
SQL injection vulnerability in the Portfol (com_portfol) 1.2 component for Joomla! allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
Gravity Board X 2.0 Beta - SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in index.php in Gravity Board X (GBX) 2.0 Beta, when magic_quotes_gpc is disabled
23RISK
open ↗Referência✓ VexDay Proof
Gravity Board X 2.0 Beta - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Gravity Board X (GBX) 2.0 Beta allows remote attackers to injec
23RISK
open ↗Referência✓ VexDay Proof
AllMyGuests 0.3.0 - 'AMG_serverpath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in AllMyGuests 0.3.0 and earlier allow remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
i.Scribe SMTP Client 2.00b - 'wscanf' Remote Format String (PoC)
Format string vulnerability in MemeCode Software i.Scribe 1.88 through 2.00 before Beta9 allows remote SMTP servers to c
23RISK
open ↗Referência✓ VexDay Proof
webframe 0.76 - Multiple File Inclusions
Multiple PHP remote file inclusion vulnerabilities in WebFrame 0.76 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗Referência✓ VexDay Proof
IF-CMS 2.0 - 'id' Blind SQL Injection
SQL injection vulnerability in frame.php in Rhadrix If-CMS 2.07 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
MPLAB IDE 8.30 - '.mcp' Universal Overwrite (SEH)
Stack-based buffer overflow in Microchip MPLAB IDE 8.30 allows user-assisted remote attackers to execute arbitrary code
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component beamospetition - SQL Injection
SQL injection vulnerability in the beamospetition (com_beamospetition) component for Joomla! allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Foxmail 5.0 - 'PunyLib.dll' Remote Stack Overflow
Buffer overflow in the UrlToLocal function in PunyLib.dll of Foxmail 5.0.300 allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
East Wind Software - 'advdaudio.ocx 1.5.1.1' Local Buffer Overflow
Buffer overflow in the East Wind Software advdaudio.ocx 1.5.1.1 ActiveX control allows user-assisted remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
FlexCMS 2.5 - 'catId' SQL Injection
SQL injection vulnerability in FlexCMS allows remote attackers to execute arbitrary SQL commands via the catId parameter
23RISK
open ↗Referência✓ VexDay Proof
March Networks DVR 3204 - Logfile Information Disclosure
March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows r
28RISK
open ↗Referência✓ VexDay Proof
MiniBB keyword_replacer 1.0 - 'pathToFiles' File Inclusion
PHP remote file inclusion vulnerability in addon_keywords.php in Keyword Replacer (keyword_replacer) 1.0 and earlier, a
23RISK
open ↗Referência✓ VexDay Proof
BoonEx Ray 3.5 - 'sIncPath' Remote File Inclusion
PHP remote file inclusion vulnerability in modules/global/inc/content.inc.php in BoonEx Ray 3.5, when register_globals i
23RISK
open ↗Referência✓ VexDay Proof
Mailist 3.0 - Insecure Backup / Local File Inclusion
Directory traversal vulnerability in send.php in Ninja Designs Mailist 3.0, when register_globals is enabled and magic_q
23RISK
open ↗Referência✓ VexDay Proof
RunCMS 1.5.2 - 'debug_show.php' SQL Injection
SQL injection vulnerability in class/debug/debug_show.php in RunCms 1.5.2 and earlier allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Flatnux 2009-01-27 - Remote File Inclusion
PHP remote file inclusion vulnerability in include/flatnux.php in FlatnuX CMS (aka Flatnuke3) 2009-01-27 and 2009-02-04,
23RISK
open ↗Referência✓ VexDay Proof
Barracuda Web Application Firewall - Authentication Bypass
Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a perm
28RISK
open ↗Referência✓ VexDay Proof
QuickTicket 1.5 - 'qti_usr.php' SQL Injection
Multiple SQL injection vulnerabilities in QuickTicket 1.2 build:20070621 and QuickTalk Forum 1.3 allow remote attackers
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.