Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
78,958cataloged exploits
36,206CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,460Referência 22,832GitHub PoC 14,991VulnCheck XDB 8,829Nuclei 4,357Metasploit 3,489✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Apple Safari - RSS 'feed://' Buffer Overflow via libxml2 (PoC)
Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-de
28RISK
open ↗Referência✓ VexDay Proof
Mynews 0.10 - Authentication Bypass
SQL injection vulnerability in login.php in MyNews 0.10 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Referência✓ VexDay Proof
Discuz! 6.0.1 - 'searchid' SQL Injection
SQL injection vulnerability in index.php in Discuz! 6.0.1 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
Wsn (Multiple Products) - Local File Inclusion / Code Execution
Directory traversal vulnerability in index.php in (1) WSN Forum 4.1.43 and earlier, (2) Gallery 4.1.30 and earlier, (3)
23RISK
open ↗Referência✓ VexDay Proof
Cisco WebEx Meeting Manager UCF - 'atucfobj.dll' ActiveX Remote Buffer Overflow
Stack-based buffer overflow in the WebexUCFObject ActiveX control in atucfobj.dll in Cisco WebEx Meeting Manager before
50RISK
open ↗Referência✓ VexDay Proof
Kipper 2.01 - Cross-Site Scripting / Local File Inclusion / File Disclosure
Cross-site scripting (XSS) vulnerability in default.php in Kipper 2.01 allows remote attackers to inject arbitrary web s
23RISK
open ↗Referência✓ VexDay Proof
ABG Blocking Script 1.0a - 'abg_path' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Africa Be Gone (ABG) 1.0a allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
Forest Blog 1.3.2 - Remote Database Disclosure
Forest Blog 1.3.2 stores sensitive information under the web root with insufficient access control, which allows remote
23RISK
open ↗Referência✓ VexDay Proof
Kipper 2.01 - Cross-Site Scripting / Local File Inclusion / File Disclosure
Kipper 2.01 stores sensitive information under the web root with insufficient access control, which allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
PNPHPBB2 < 1.2 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in the PNphpBB2 1.2i and earlier module for PostNuke allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module icontent 1.0/4.5 - Remote File Inclusion
PHP remote file inclusion vulnerability in include/wysiwyg/spaw_control.class.php in the icontent 4.5 module for XOOPS a
35RISK
open ↗Referência✓ VexDay Proof
k-links directory - SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in Qsoft K-Links allow remote attackers to execute arbitrary SQL commands via (1)
23RISK
open ↗Referência✓ VexDay Proof
XGuestBook 2.0 - Authentication Bypass
SQL injection vulnerability in login.php in xGuestbook 2.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
k-links directory - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Qsoft K-Links allows remote attackers to inject arbitrary web s
23RISK
open ↗Referência✓ VexDay Proof
GreenCart PHP Shopping Cart - 'id' SQL Injection
Multiple SQL injection vulnerabilities in PozScripts GreenCart PHP Shopping Cart allow remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component EZ Store Remote - Blind SQL Injection
SQL injection vulnerability in the EZ Store (com_ezstore) component for Joomla! allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
phsBlog 0.1.1 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in phsBlog 0.1.1 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Referência✓ VexDay Proof
Symphony 1.7.01 (non-patched) - Remote Code Execution
Unrestricted file upload vulnerability in the File Manager in the admin panel in Twentyone Degrees Symphony 1.7.01 and e
23RISK
open ↗Referência✓ VexDay Proof
OpenImpro 1.1 - 'image.php' SQL Injection
SQL injection vulnerability in image.php in OpenImpro 1.1 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
Yahoo! Messenger Webcam 8.1 - ActiveX Remote Buffer Overflow
Buffer overflow in the Yahoo! Webcam Upload ActiveX control in ywcupl.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows
50RISK
open ↗Referência✓ VexDay Proof
Userlocator 3.0 - Blind SQL Injection
SQL injection vulnerability in locator.php in the Userlocator module 3.0 for Woltlab Burning Board (wBB) allows remote a
23RISK
open ↗Referência✓ VexDay Proof
BlogHelper - Remote Configuration File Disclosure
BlogHelper stores common_db.inc under the web root with insufficient access control, which allows remote attackers to do
23RISK
open ↗Referência✓ VexDay Proof
Quicksilver Forums 1.4.1 - SQL Injection
SQL injection vulnerability in index.php in Quicksilver Forums 1.4.1 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
Vacation Rental Script 3.0 - 'id' SQL Injection
SQL injection vulnerability in index.php in Vacation Rental Script 3.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
GDL 4.x - 'node' SQL Injection
SQL injection vulnerability in functions/browse.php in Ganesha Digital Library (GDL) 4.0 and 4.2 allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
Philex 0.2.3 - Remote File Inclusion / File Disclosure
PHP remote file inclusion vulnerability in header.inc.php in Philex 0.2.3 and earlier allows remote attackers to execute
45RISK
open ↗Referência✓ VexDay Proof
Vivotek Motion Jpeg Control - 'MjpegDecoder.dll 2.0.0.13' Remote Overflow
Stack-based buffer overflow in the Vivotek Motion Jpeg ActiveX control (aka MjpegControl) in MjpegDecoder.dll 2.0.0.13 a
23RISK
open ↗Referência✓ VexDay Proof
Amaya 11.1 - W3C Editor/Browser (defer) Stack Overflow (PoC)
Stack-based buffer overflow in W3C Amaya Web Browser 11.1 allows remote attackers to execute arbitrary code via a script
28RISK
open ↗Referência✓ VexDay Proof
vsp stats processor 0.45 - 'gamestat.php?gameID' SQL Injection
SQL injection vulnerability in vsp-core/pub/themes/bismarck/gamestat.php in vsp stats processor 0.45 allows remote attac
23RISK
open ↗Referência✓ VexDay Proof
TubeGuru Video Sharing Script - 'UID' SQL Injection
SQL injection vulnerability in ugroups.php in PozScripts TubeGuru Video Sharing Script allows remote attackers to execut
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.