Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,057cataloged exploits
36,288CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,460Referência 22,910GitHub PoC 14,997VulnCheck XDB 8,843Nuclei 4,358Metasploit 3,489✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
NetRisk 1.9.7 - Local/Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in NetRisk 1.9.7 and earlier allows remote attackers to execute arb
35RISK
open ↗Referência✓ VexDay Proof
BosClassifieds - 'cat_id' SQL Injection
SQL injection vulnerability in index.php in BosDev BosClassifieds allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência✓ VexDay Proof
TmaxSoft JEUS - Alternate Data Streams File Disclosure
NTFS TmaxSoft JEUS 5 before Fix 26 allows remote attackers to read the source code for scripts by appending ::$DATA to t
23RISK
open ↗Referência✓ VexDay Proof
The Merchant 2.2.0 - 'index.php?show' Remote File Inclusion
PHP remote file inclusion vulnerability in help/index.php in The Merchant (themerchant) 2.2 allows remote attackers to e
23RISK
open ↗Referência✓ VexDay Proof
living Local 1.1 - Cross-Site Scripting / Arbitrary File Upload
Cross-site scripting (XSS) vulnerability in listtest.php in eZoneScripts Living Local 1.1 allows remote attackers to inj
23RISK
open ↗Referência✓ VexDay Proof
living Local 1.1 - Cross-Site Scripting / Arbitrary File Upload
Unrestricted file upload vulnerability in editimage.php in eZoneScripts Living Local 1.1 allows remote authenticated adm
23RISK
open ↗Referência✓ VexDay Proof
GoodTech SSH - 'SSH_FXP_OPEN' Remote Buffer Overflow
Stack-based buffer overflow in the SFTP subsystem in GoodTech SSH 6.4 allows remote authenticated users to execute arbit
35RISK
open ↗Referência✓ VexDay Proof
WiClear 0.10 - 'path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in WiClear 0.10 allow remote attackers to execute arbitrary PHP code
28RISK
open ↗Referência✓ VexDay Proof
PHPProfiles 4.5.2 Beta - 'body_comm.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in include/body_comm.inc.php in phpProfiles 4.5.2 BETA allows remote attackers t
28RISK
open ↗Referência✓ VexDay Proof
PayPal eStore - Admin Password Change
admin/settings.php in PayPal eStores allows remote attackers to bypass intended access restrictions and change the admin
23RISK
open ↗Referência✓ VexDay Proof
Destar 0.2.2-5 - Arbitrary Add New User
DeStar 0.2.2-5 allows remote attackers to add arbitrary users via a direct request to config/add/CfgOptUser.
23RISK
open ↗Referência✓ VexDay Proof
Simplog 0.9.2 - 's' Remote Command Execution
Directory traversal vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
WordPress Plugin Sniplets 1.1.2 - Remote File Inclusion / Cross-Site Scripting / Remote Code Execution
Eval injection vulnerability in modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote a
35RISK
open ↗Referência✓ VexDay Proof
WordPress Plugin Sniplets 1.1.2 - Remote File Inclusion / Cross-Site Scripting / Remote Code Execution
Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote at
38RISK
open ↗Referência✓ VexDay Proof
Download Accelerator Plus DAP 8.6 - 'AniGIF.ocx' Buffer Overflow (PoC)
Multiple stack-based buffer overflows in the Animation GIF ActiveX control in JComSoft AniGIF.ocx 1.12 and 2.47, as used
23RISK
open ↗Referência✓ VexDay Proof
Apple iTunes 8.0.2.20/QuickTime 7.5.5 - '.mov' Multiple Off By Overflows (PoC)
Stack-based buffer overflow in Apple QuickTime Player 7.5.5 and iTunes 8.0.2.20 allows remote attackers to cause a denia
23RISK
open ↗Referência✓ VexDay Proof
Destar 0.2.2-5 - Arbitrary Add Admin
Static code injection vulnerability in user/settings/ in DeStar 0.2.2-5 allows remote authenticated users to add arbitra
23RISK
open ↗Referência✓ VexDay Proof
Neostrada Livebox Router - Remote Network Down (PoC)
The Neostrada Livebox ADSL Router allows remote attackers to cause a denial of service (network outage) via multiple HTT
23RISK
open ↗Referência✓ VexDay Proof
OpenDock FullCore 4.4 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in OpenDock FullCore 4.4 and earlier allow remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
XAMPP for Windows 1.6.0a - 'mssql_connect()' Remote Buffer Overflow
The ADONewConnection Connect function in adodb.php in XAMPP 1.6.0a and earlier for Windows uses untrusted input for the
23RISK
open ↗Referência✓ VexDay Proof
Google Chrome 0.2.149.27 - A HREF Denial of Service
Stack-based buffer overflow in chrome/common/gfx/url_elider.cc in Google Chrome 0.2.149.27 and other versions before 0.2
23RISK
open ↗Referência✓ VexDay Proof
GNUEDU 1.3b2 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in gnuedu 1.3b2 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗Referência✓ VexDay Proof
Java SE Runtime Environment JRE 6 Update 13 - Multiple Vulnerabilities
The Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 1
23RISK
open ↗Referência✓ VexDay Proof
Portail Web PHP 2.5.1.1 - Multiple Inclusion Vulnerabilities
Multiple PHP remote file inclusion vulnerabilities in Portail Web Php 2.5.1.1 and earlier allow remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
osTicket 1.12 - Formula Injection
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the ex
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component SimpleBoard 1.0.3 - 'catid' SQL Injection
SQL injection vulnerability in index.php in the Simpleboard (com_simpleboard) 1.0.3 Stable component for Mambo and Jooml
23RISK
open ↗Referência✓ VexDay Proof
Joomla! 1.5.12 TinyMCE - Remote Code Execution (via Arbitrary File Upload)
Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.
23RISK
open ↗Referência✓ VexDay Proof
Simple PHP Blog 0.4.7.1 - Remote Command Execution
Directory traversal vulnerability in install05.php in Simple PHP Blog (SPB) 0.4.7.1 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
Fundanemt 2.2.0 - 'spellcheck.php' Remote Code Execution
core/spellcheck/spellcheck.php in Fundanemt before 2.2.0.1 allows remote attackers to execute arbitrary commands via she
23RISK
open ↗Referência✓ VexDay Proof
FretsWeb 1.2 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in FretsWeb 1.2 allow remote attackers to read arbitrary files via director
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.