Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,057cataloged exploits
36,288CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,460Referência 22,910GitHub PoC 14,997VulnCheck XDB 8,843Nuclei 4,358Metasploit 3,489✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Mozilla Firefox XSL - Parsing Remote Memory Corruption (PoC) (1)
The txMozillaXSLTProcessor::TransformToDoc function in Mozilla Firefox before 3.0.8 and SeaMonkey before 1.1.16 allows r
28RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke - 'iframe.php' Remote File Inclusion
PHP remote file inclusion vulnerability in iframe.php in the iFrame Module for PHP-NUKE allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
Moodle < 1.6.9/1.7.7/1.8.9/1.9.5 - File Disclosure
The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allows user-assist
23RISK
open ↗Referência✓ VexDay Proof
ftp Admin 0.1.0 - Local File Inclusion / Cross-Site Scripting / Authentication Bypass
index.php in FTP Admin 0.1.0 allows remote attackers to bypass authentication and obtain administrative access via a log
23RISK
open ↗Referência✓ VexDay Proof
pPIM 1.0 - Upload/Change Password
Unrestricted file upload vulnerability in upload.php in Phlatline's Personal Information Manager (pPIM) 1.0 and earlier
23RISK
open ↗Referência✓ VexDay Proof
Linux Kernel 2.6 (Gentoo / Ubuntu 8.10/9.04) UDEV < 1.4.1 - Local Privilege Escalation (2)
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to ga
60RISK
open ↗Referência✓ VexDay Proof
SineCMS 2.3.4 - Calendar SQL Injection
Multiple cross-site scripting (XSS) vulnerabilities in the guestbook in SineCMS 2.3.4 and earlier allow remote attackers
23RISK
open ↗Referência✓ VexDay Proof
WordPress Plugin Photo album - SQL Injection
Multiple SQL injection vulnerabilities in wppa.php in the WP Photo Album (WPPA) before 1.1 plugin for WordPress allow re
23RISK
open ↗Referência✓ VexDay Proof
PrecisionID Datamatrix - ActiveX Arbitrary File Overwrite
Multiple insecure method vulnerabilities in PRECIS~2.DLL in the PrecisionID Datamatrix ActiveX control (DMATRIXLib.Datam
23RISK
open ↗Referência✓ VexDay Proof
FOSS Gallery Admin 1.0 - Arbitrary File Upload
Unrestricted file upload vulnerability in processFiles.php in FOSS Gallery Admin and FOSS Gallery Public 1.0 beta allows
23RISK
open ↗Referência✓ VexDay Proof
FOSS Gallery Public 1.0 - Arbitrary File Upload
Unrestricted file upload vulnerability in processFiles.php in FOSS Gallery Admin and FOSS Gallery Public 1.0 beta allows
23RISK
open ↗Referência✓ VexDay Proof
Apple Mac OSX xnu 1228.3.13 - 'zip-notify' Remote Kernel Overflow (PoC)
Heap-based buffer overflow in the AppleTalk networking stack in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and e
23RISK
open ↗Referência✓ VexDay Proof
Chilkat Mail ActiveX 7.8 - 'ChilkatCert.dll' Insecure Method
Insecure method vulnerability in Chilkat Mail 7.8 ActiveX control (ChilkatCert.dll) allows remote attackers to overwrite
23RISK
open ↗Referência✓ VexDay Proof
Macrovision FlexNet - 'isusweb.dll' DownloadAndExecute Method
Insecure method vulnerability in the MVSNCLientWebAgent61.WebAgent.1 ActiveX control (isusweb.dll 6.1.100.61372) in Macr
23RISK
open ↗Referência✓ VexDay Proof
Apple Mac OSX xnu 1228.x - 'vfssysctl' Local Kernel Denial of Service (PoC)
Race condition in the HFS vfs sysctl interface in XNU 1228.8.20 and earlier on Apple Mac OS X 10.5.6 and earlier allows
23RISK
open ↗Referência✓ VexDay Proof
Hitweb 4.2.1 - 'REP_INC' Remote File Inclusion
PHP remote file inclusion vulnerability in genpage-cgi.php in Brian Fraval hitweb 4.2 and possibly earlier versions allo
23RISK
open ↗Referência✓ VexDay Proof
phpBB Journals System Mod 1.0.2 RC2 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the Journals System module 1.0.2 (RC2) and earlier for phpBB allow
23RISK
open ↗Referência✓ VexDay Proof
acute control panel 1.0.0 - SQL Injection / Remote File Inclusion
SQL injection vulnerability in login.php in Acute Control Panel 1.0.0 allows remote attackers to execute arbitrary SQL c
28RISK
open ↗Referência✓ VexDay Proof
Joomla! Component com_Projectfork 2.0.10 - Local File Inclusion
Directory traversal vulnerability in the JoomlaPraise Projectfork (com_projectfork) component 2.0.10 for Joomla! allows
38RISK
open ↗Referência✓ VexDay Proof
PHP 5.2.3 - 'bz2 com_print_typeinfo()' Denial of Service
The com_print_typeinfo function in the bz2 extension in PHP 5.2.3 allows context-dependent attackers to cause a denial o
23RISK
open ↗Referência✓ VexDay Proof
Eserv 3.x - FTP Server (ABOR) Remote Stack Overflow (PoC)
Stack-based buffer overflow in the FTP server in Etype Eserv 3.x, possibly 3.26, allows remote attackers to cause a deni
23RISK
open ↗Referência✓ VexDay Proof
Stash 1.0.3 - SQL Injection User Credentials Disclosure
Multiple SQL injection vulnerabilities in Stash 1.0.3 allow remote attackers to execute arbitrary SQL commands via (1) t
23RISK
open ↗Referência✓ VexDay Proof
Cartweaver 2.16.11 - 'ProdID' SQL Injection
Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote at
23RISK
open ↗Referência✓ VexDay Proof
FlexCMS Calendar - 'itemID' Blind SQL Injection
SQL injection vulnerability in FlexCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the ItemId para
23RISK
open ↗Referência✓ VexDay Proof
OPENi-CMS 1.0.1beta - 'config' Remote File Inclusion
PHP remote file inclusion vulnerability in openi-admin/base/fileloader.php in OPENi-CMS 1.0.1, and possibly earlier, all
23RISK
open ↗Referência✓ VexDay Proof
KGB 1.9 - 'sesskglogadmin.php' Local File Inclusion
Directory traversal vulnerability in sesskglogadmin.php in KGB 1.9 and earlier allows remote attackers to include and ex
23RISK
open ↗Referência✓ VexDay Proof
Campsite 3.3.0 RC1 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Campsite 3.3.0 RC1 allow remote attackers to execute arbitrary PHP
23RISK
open ↗Referência✓ VexDay Proof
Aktueldownload Haber scripti - 'id' SQL Injection
SQL injection vulnerability in HaberDetay.asp in Aktueldownload Haber script allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke Module AddressBook 1.2 - Local File Inclusion
Directory traversal vulnerability in addressbook.php in the Addressbook 1.2 module for PHP-Nuke allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
public media manager 1.3 - Remote File Inclusion
PHP remote file inclusion vulnerability in NewsCMS/news/newstopic_inc.php in North Country Public Radio Public Media Man
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.