Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,571cataloged exploits
34,982CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,899GitHub PoC 13,967VulnCheck XDB 8,542Nuclei 4,248Metasploit 3,472✓ verified onlyrecentpopularrisk
21,899 exploits
Referência✓ VexDay Proof
Valdersoft Shopping Cart 3.0 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Valdersoft Shopping Cart 3.0 and earlier allow remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
E-Uploader Pro 1.0 - Image Upload / Code Execution
Directory traversal vulnerability in include/config.php in E-Uploader Pro 1.0 and earlier allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
Ciberia Content Federator 1.0.1 - 'path' Remote File Inclusion
PHP remote file inclusion vulnerability in socios/maquetacion_socio.php (members/maquetacion_member.php) in Ciberia Cont
23RISK
open ↗Referência
CVE-2024-45519
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9,
100RISK
open ↗Referência✓ VexDay Proof
open NewsLetter 2.5 - Multiple Vulnerabilities (2)
The (1) settings.php and (2) subscribers.php scripts in Open Newsletter 2.5 and earlier do not exit when authentication
23RISK
open ↗Referência✓ VexDay Proof
MTCMS 2.0 - '/admin/admin_settings.php' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/admin_settings.php in MTCMS 2.0 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
SH-News 0.93 - 'misc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in misc.php in SH-News 0.93, when register_globals is enabled, allows remote att
23RISK
open ↗Referência✓ VexDay Proof
Enthrallweb ePages - 'actualpic.asp' SQL Injection
SQL injection vulnerability in actualpic.asp in Enthrallweb ePages allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência
CVE-2014-8361
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClien
100RISK
open ↗Referência
CVE-2026-49127
Music Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24be
41RISK
open ↗Referência
CVE-2017-2445
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS bef
23RISK
open ↗Referência
CVE-2009-4730
SQL injection vulnerability in report.php in x10 Adult Media Script 1.7 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Enthrallweb eCars 1.0 - 'types.asp' SQL Injection
SQL injection vulnerability in Types.asp in Enthrallweb eCars 1.0 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
Dragon Business Directory 3.01.12 - 'ID' SQL Injection
SQL injection vulnerability in bus_details.asp in Dragon Business Directory - Pro (aka Dragon Internet Business Search D
23RISK
open ↗Referência✓ VexDay Proof
Enthrallweb eJobs - 'newsdetail.asp' SQL Injection
SQL injection vulnerability in newsdetail.asp in Enthrallweb eJobs allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
Enthrallweb emates 1.0 - 'newsdetail.asp' SQL Injection
SQL injection vulnerability in newsdetail.asp in Enthrallweb eMates 1.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Ananda Real Estate 3.4 - 'agent' SQL Injection
SQL injection vulnerability in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 and earlier all
23RISK
open ↗Referência✓ VexDay Proof
Bubla 1.0.0rc2 - '/bu/process.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in process.php in Vladimir Menshakov buratinable templator (aka bubla
23RISK
open ↗Referência✓ VexDay Proof
KsIRC 1.3.12 - 'PRIVMSG' Remote Buffer Overflow (PoC)
KsIRC 1.3.12 allows remote attackers to cause a denial of service (crash) via a long PRIVMSG string when connecting to a
28RISK
open ↗Referência
CVE-2026-9523
Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform getCalcmeterDetailDayListTree sql injection
33RISK
open ↗Referência✓ VexDay Proof
FlashBB 1.1.8 - 'phpbb_root_path' Remote File Inclusion
PHP remote file inclusion vulnerability in phpbb/getmsg.php in FlashBB 1.1.5 and earlier allows remote attackers to exec
23RISK
open ↗Referência
CVE-2009-4756
Stack-based buffer overflow in TraktorBeatport.exe 1.0.0.283 in Beatport Player 1.0.0.0 allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
Linux Kernel 2.6.x - 'sys_timer_create()' Local Denial of Service
The sys_timer_create function in posix-timers.c for Linux kernel 2.6.x allows local users to cause a denial of service (
23RISK
open ↗Referência
CVE-2009-4756
Stack-based buffer overflow in TraktorBeatport.exe 1.0.0.283 in Beatport Player 1.0.0.0 allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
TinyPHP Forum 3.6 - 'profile.php' Remote Code Execution
Directory traversal vulnerability in profile.php in TinyPHPforum 3.6 and earlier allows remote attackers to include and
23RISK
open ↗Referência✓ VexDay Proof
PhpNews 1.0 - 'Include' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in PhpNews 1.0 allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.