Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,652cataloged exploits
34,545CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,581GitHub PoC 13,708VulnCheck XDB 8,225Nuclei 4,228Metasploit 3,467✓ verified onlyrecentpopularrisk
21,581 exploits
Referência✓ VexDay Proof
FireConfig 0.5 - 'dl.php' Remote File Disclosure
Directory traversal vulnerability in dl.php in FireConfig 0.5 allows remote attackers to read arbitrary files via a .. (
23RISK
open ↗Referência✓ VexDay Proof
EZContents 1.4.5 - 'index.php?link' Remote File Disclosure
Directory traversal vulnerability in index.php in ezContents 1.4.5 allows remote attackers to read arbitrary files via a
23RISK
open ↗Referência✓ VexDay Proof
Web-MeetMe 3.0.3 - 'play.php' Remote File Disclosure
Multiple directory traversal vulnerabilities in play.php in Web-MeetMe 3.0.3 allow remote attackers to read arbitrary fi
23RISK
open ↗Referência✓ VexDay Proof
UploadImage/UploadScript 1.0 - Remote Change Admin Password
admin.php in UploadScript 1.0 does not check for the original password before making a change to a new password, which a
23RISK
open ↗Referência✓ VexDay Proof
ErfurtWiki R1.02b - Local File Inclusion
Multiple directory traversal vulnerabilities in ErfurtWiki R1.02b and earlier, when register_globals is enabled, allow r
23RISK
open ↗Referência✓ VexDay Proof
ZeeBuddy 2.1 - 'adid' SQL Injection
SQL injection vulnerability in bannerclick.php in ZeeBuddy 2.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência
CVE-2013-3527
Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL
23RISK
open ↗Referência
CVE-2013-3527
Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL
23RISK
open ↗Referência
CVE-2010-2892
gsb/drivers.php in LANDesk Management Gateway 4.0 through 4.0-1.48 and 4.2 through 4.2-1.8 allows remote authenticated a
23RISK
open ↗Referência
CVE-2009-2238
Unrestricted file upload vulnerability in includes/shared_scripts/wysiwyg_editor/assetmanager/assetmanager.asp in DMXRea
23RISK
open ↗Referência
CVE-2017-11356
The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users
23RISK
open ↗Referência✓ VexDay Proof
InteliEditor 1.2.x - 'lib.editor.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in lib.editor.inc.php in Intelimen InteliEditor 1.2.x allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Aigaion 1.2.1 - 'DIR' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Aigaion Web based bibliography management system 1.2.1 and earlier
23RISK
open ↗Referência✓ VexDay Proof
Xt-Stats 2.4.0.b3 (server_base_dir) - Remote File Inclusion
PHP remote file inclusion vulnerability in xt_counter.php in Xt-Stats 2.3.x up to 2.4.0.b3 allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
Zomplog 3.8 - 'force_download.php' Remote File Disclosure
Directory traversal vulnerability in upload/force_download.php in Zomplog 3.8 allows remote attackers to read arbitrary
23RISK
open ↗Referência✓ VexDay Proof
openEngine 2.0 beta4 - Remote File Inclusion
PHP remote file inclusion vulnerability in cms/system/openengine.php in openEngine 2.0 beta4 and earlier allows remote a
23RISK
open ↗Referência✓ VexDay Proof
FlexPHPDirectory 0.0.1 - Authentication Bypass
Unrestricted file upload vulnerability in add.php in FlexPHPDirectory 0.0.1 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
e-cart.biz Shopping Cart - Arbitrary File Upload
Unrestricted file upload vulnerability in admin/editor/image.php in e-cart.biz Free Shopping Cart allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
Censtore 7.3.x - 'censtore.cgi' Remote Command Execution
censtore.cgi in Censtore 7.3.002 and earlier allows remote attackers to execute arbitrary commands via shell metacharact
23RISK
open ↗Referência
CVE-2012-4773
Multiple cross-site request forgery (CSRF) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack
23RISK
open ↗Referência
CVE-2012-4773
Multiple cross-site request forgery (CSRF) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack
23RISK
open ↗Referência
CVE-2006-2465
Buffer overflow in MP3Info 0.8.4 allows attackers to execute arbitrary code via a long command line argument. NOTE: if
23RISK
open ↗Referência
CVE-2006-2465
Buffer overflow in MP3Info 0.8.4 allows attackers to execute arbitrary code via a long command line argument. NOTE: if
23RISK
open ↗Referência
CVE-2014-8677
The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and
23RISK
open ↗Referência
CVE-2014-8677
The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and
23RISK
open ↗Referência
CVE-2015-6945
Cross-site scripting (XSS) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to inject arbitrary we
23RISK
open ↗Referência
CVE-2017-7447
HelpDEZk 1.1.1 has CSRF in admin/home#/logos/ with an impact of remote execution of arbitrary PHP code.
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.