Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,230cataloged exploits
36,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
CSPartner 1.0 - Delete All Users / SQL Injection
SQL injection vulnerability in gestion.php in CSPartner 0.1, when magic_quotes_gpc is disabled, allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
JASmine 0.0.2 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Nayco JASmine (aka Jasmine-Web) allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
Foafgen 0.3 - 'redir.php' Local Source Disclosure
Directory traversal vulnerability in redir.php in Foafgen 0.3 allows remote attackers to read arbitrary files via a .. (
23RISK
open ↗Referência✓ VexDay Proof
Cdsagenda 4.2.9 - 'SendAlertEmail.php' File Inclusion
PHP remote file inclusion vulnerability in modification/SendAlertEmail.php in CDS Software Consortium CDS Agenda 4.2.9 a
23RISK
open ↗Referência✓ VexDay Proof
phpBB SpamOborona Mod 1.0b - Remote File Inclusion
PHP remote file inclusion vulnerability in admin/admin_spam.php in the SpamOborona 1.0b and earlier phpBB module allows
23RISK
open ↗Referência✓ VexDay Proof
AROUNDMe 0.5.2 - 'templatePath' Remote File Inclusion
PHP remote file inclusion vulnerability in template/barnraiser_01/p_new_password.tpl.php in AROUNDMe 0.5.2 and earlier a
23RISK
open ↗Referência✓ VexDay Proof
Easynews 4.4.1 - 'admin.php' Authentication Bypass
admin.php in PHP Outburst Easynews 4.4.1 and earlier, when register_globals is enabled, allows remote attackers to bypas
23RISK
open ↗Referência✓ VexDay Proof
Ultrastats 0.2.144/0.3.11 - 'serverid' SQL Injection
SQL injection vulnerability in index.php in Ultrastats 0.2.144 and 0.3.11 allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
Apoll 0.7b - Authentication Bypass
SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
YaBBSM 3.0.0 - 'Offline.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in SuperMod 3.0.0 for YABB (YaBBSM) allow remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Apoll 0.7b - Authentication Bypass
SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
Multiple Membership Script 2.5 - 'id' SQL Injection
SQL injection vulnerability in sitepage.php in Multiple Membership Script 2.5 allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
PHP AMX 0.90 - '/plugins/main.php' Remote File Inclusion
PHP remote file inclusion vulnerability in plugins/main.php in Php AMX 0.9.0, when register_globals is enabled or magic_
23RISK
open ↗Referência✓ VexDay Proof
e107 - 'include()' Remote File Upload
ImageManager in e107 before 0.617 does not properly check the types of uploaded files, which allows remote attackers to
28RISK
open ↗Referência✓ VexDay Proof
Brim 1.2.1 - 'renderer' Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Barry Nauta BRIM 1.2.1 and earlier allow remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
PHPPowerCards 2.10 - 'txt.inc.php' Remote Code Execution
Multiple direct static code injection vulnerabilities in db/txt.inc.php in phpPowerCards 2.10, when register_globals is
23RISK
open ↗Referência✓ VexDay Proof
Pro Chat Rooms 3.0.2 - Cross-Site Scripting / Cross-Site Request Forgery
Cross-site scripting (XSS) vulnerability in profiles/index.php in Pro Chat Rooms 3.0.2 allows remote attackers to inject
23RISK
open ↗Referência✓ VexDay Proof
Softerra PHP Developer Library 1.5.3 - Remote File Inclusion
PHP remote file inclusion vulnerability in Softerra PHP Developer Library 1.5.3 and earlier allows remote attackers to e
23RISK
open ↗Referência✓ VexDay Proof
CASTOR 1.1.1 - '/lib/rs.php' Remote File Inclusion
PHP remote file inclusion vulnerability in lib/rs.php in 2le.net Castor PHP Web Builder 1.1.1 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
DigitalHive 2.0 RC2 - 'base_include.php' Remote File Inclusion
PHP remote file inclusion vulnerability in template/purpletech/base_include.php in DigitalHive 2.0 RC2 allows remote att
23RISK
open ↗Referência✓ VexDay Proof
pandaBB - 'displayCategory' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in modules/My_eGallery/public/displayCategory.php in the pandaBB modu
23RISK
open ↗Referência✓ VexDay Proof
ActualAnalyzer - 'ant' Cookie Command Execution (Metasploit)
Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for pa
68RISK
open ↗Referência✓ VexDay Proof
PHPMyRing 4.2.1 - 'cherche.php' SQL Injection
Multiple SQL injection vulnerabilities in cherche.php in PHPMyRing 4.2.1 and earlier allow remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
Techno Dreams Guestbook 1.0 - 'key' SQL Injection
SQL injection vulnerability in guestbookview.asp in Techno Dreams Guest Book 1.0 earlier allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
Techno Dreams Announcement - 'key' SQL Injection
SQL injection vulnerability in MainAnnounce2.asp in Techno Dreams Announcement allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
phpBB Spider Friendly Module 1.3.10 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin/modules_data.php in the phpBB module Spider Friendly 1.3.10 and earlier
23RISK
open ↗Referência✓ VexDay Proof
E Annu 1.0 - Authentication Bypass / SQL Injection
SQL injection vulnerability in includes/menu.inc.php in E-Annu 1.0 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
GEPI 1.4.0 - '/gestion/savebackup.php' Remote File Inclusion
PHP remote file inclusion vulnerability in gestion/savebackup.php in Gepi 1.4.0 and earlier, and possibly other versions
23RISK
open ↗Referência✓ VexDay Proof
DataTrac Activity Console - Denial of Service
DataTrac Activity Console 1.1 allows remote attackers to cause a denial of service via a long HTTP GET request.
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Visual Basic Enterprise 6 SP6 - '.dsr' File Handling Buffer Overflow
Multiple buffer overflows in Microsoft Visual Basic Enterprise Edition 6.0 SP6 allow user-assisted remote attackers to e
35RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.