Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
78,958cataloged exploits
36,206CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,460Referência 22,832GitHub PoC 14,991VulnCheck XDB 8,829Nuclei 4,357Metasploit 3,489✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Flexcustomer 0.0.6 - Admin Authentication Bypass / Possible PHP Code Writing
Static code injection vulnerability in admin/install.php in Flexcustomer 0.0.6 might allow remote attackers to inject ar
23RISK
open ↗Referência✓ VexDay Proof
samPHPweb 4.2.2 - 'db.php' Remote File Inclusion
PHP remote file inclusion vulnerability in common/db.php in samPHPweb, possibly 4.2.2 and others, as provided with SAM B
23RISK
open ↗Referência✓ VexDay Proof
WeBid 0.5.4 - 'item.php' SQL Injection
SQL injection vulnerability in item.php in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
W1L3D4 philboard 1.0 - 'philboard_reply.asp' SQL Injection
Multiple SQL injection vulnerabilities in W1L3D4 Philboard 1.0 allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
ZZ FlashChat 3.1 - 'help.php' Local File Inclusion
Directory traversal vulnerability in admin/inc/help.php in ZZ:FlashChat 3.1 and earlier allows remote attackers to inclu
23RISK
open ↗Referência✓ VexDay Proof
QNX Neutrino 0.8.4 Atomic Edition - Remote Code Execution
Directory traversal vulnerability in index.php in Neutrino Atomic Edition 0.8.4 allows remote attackers to read and modi
23RISK
open ↗Referência✓ VexDay Proof
LightNEasy 1.2 - no database Remote Hash Retrieve
LightNEasy/lightneasy.php in LightNEasy No database version 1.2 allows remote attackers to obtain the hash of the admini
23RISK
open ↗Referência✓ VexDay Proof
phosheezy 2.0 - Remote Command Execution
Ryneezy phoSheezy 0.2 stores sensitive information under the web root with insufficient access control, which allows rem
23RISK
open ↗Referência✓ VexDay Proof
Grape Statistics 0.2a - 'location' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/functions.php in Quate Grape Web Statistics 0.2a allows remote attac
35RISK
open ↗Referência✓ VexDay Proof
Docebo 3.5.0.3 - 'lib.regset.php' Command Execution
SQL injection vulnerability in the autoDetectRegion function in doceboCore/lib/lib.regset.php in Docebo 3.5.0.3 and earl
23RISK
open ↗Referência✓ VexDay Proof
Rayzz Script 2.0 - Local/Remote File Inclusion
Directory traversal vulnerability in common/classes/class_HeaderHandler.lib.php in Rayzz Script 2.0 allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
E RESERV 2.1 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in E-RESERV 2.1 allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Referência✓ VexDay Proof
CodeAvalanche FreeForum - Database Disclosure
CodeAvalanche FreeForum stores sensitive information under the web root with insufficient access control, which allows r
23RISK
open ↗Referência✓ VexDay Proof
OraMon 2.0.1 - Remote Configuration File Disclosure
Oramon Oracle Database Monitoring Tool 2.0.1 stores sensitive information under the web root with insufficient access co
23RISK
open ↗Referência✓ VexDay Proof
EkinBoard 1.1.0 - Arbitrary File Upload / Authentication Bypass
Unrestricted file upload vulnerability in EkinBoard 1.1.0 and earlier allows remote attackers to execute arbitrary code
23RISK
open ↗Referência✓ VexDay Proof
Pinnacle Studio 12 - '.hfz' Directory Traversal
Directory traversal vulnerability in InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Syst
23RISK
open ↗Referência✓ VexDay Proof
Acidcat CMS 3.4.1 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in admin_colors_swatch.asp in Acidcat CMS 3.4.1 allows remote attackers to inje
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component jabode - 'id' SQL Injection
SQL injection vulnerability in Jabode horoscope extension (com_jabode) for Joomla! allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
Facil-CMS 0.1RC - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in Facil CMS 0.1RC allow remote attackers to read arbitrary files via a ..
23RISK
open ↗Referência✓ VexDay Proof
DBImageGallery 1.2.2 - 'donsimg_base_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in DBImageGallery 1.2.2 allow remote attackers to execute arbitrary P
23RISK
open ↗Referência✓ VexDay Proof
MagicISO 5.4 (build239) - '.cue' Heap Overflow (PoC)
Stack-based buffer overflow in MagicISO 5.4 build 239 and earlier allows remote attackers to execute arbitrary code via
23RISK
open ↗Referência✓ VexDay Proof
ModuleBuilder 1.0 - 'file' Remote File Disclosure
Directory traversal vulnerability in modules/Builder/DownloadModule.php in ModuleBuilder 1.0 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Agares phpAutoVideo 2.21 - Local/Remote File Inclusion
PHP remote file inclusion vulnerability in admin/frontpage_right.php in Agares Media phpAutoVideo 2.21 allows remote att
23RISK
open ↗Referência✓ VexDay Proof
Half-Life CSTRIKE Server 1.6 - 'no-steam' Denial of Service
Valve Software Half-Life Counter-Strike 1.6 allows remote attackers to cause a denial of service (crash) via multiple cr
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component zOOm Media Gallery 2.5 Beta 2 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the com_zoom 2.5 beta 2 and earlier module for Mambo allow remote
23RISK
open ↗Referência✓ VexDay Proof
Mcms Easy Web Make - 'index.php?template' Local File Inclusion
Directory traversal vulnerability in modules/cms/index.php in Mcms Easy Web Make 1.3, allows remote attackers to include
23RISK
open ↗Referência✓ VexDay Proof
Joovili 3.1 - 'browse.videos.php' SQL Injection
SQL injection vulnerability in browse.videos.php in Joovili 3.1 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
Dokeos E-Learning System 1.8.5 - Local File Inclusion
Directory traversal vulnerability in user_portal.php in the Dokeos E-Learning System 1.8.5 on Windows allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
PHPUserBase 1.3b - 'unverified.inc.php' Local File Inclusion
Directory traversal vulnerability in include/unverified.inc.php in Linux Web Shop (LWS) php User Base 1.3beta allows rem
23RISK
open ↗Referência✓ VexDay Proof
QuickTime 7.4.1 - 'QTPlugin.ocx' Multiple Stack Overflow Vulnerabilities
Multiple stack-based buffer overflows in an ActiveX control in QTPlugin.ocx for Apple QuickTime 7.4.1 and earlier allow
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.