Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,107cataloged exploits
36,322CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,464Referência 22,936GitHub PoC 15,010VulnCheck XDB 8,846Nuclei 4,361Metasploit 3,490✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Social Site Generator 2.0 - 'path' Remote File Inclusion
PHP remote file inclusion vulnerability in social_game_play.php in Social Site Generator (SSG) 2.0 allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
2532/Gigs 1.2.1 - 'activateuser.php' Local File Inclusion
Directory traversal vulnerability in activateuser.php in 2532|Gigs 1.2.1 allows remote attackers to include and execute
23RISK
open ↗Referência✓ VexDay Proof
Pollbooth 2.0 - 'pollID' SQL Injection
SQL injection vulnerability in pollBooth.php in osCommerce Poll Booth Add-On 2.0 allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
CyberBrau 0.9.4 - '/forum/track.php' Remote File Inclusion
PHP remote file inclusion vulnerability in forum/track.php in CyberBrau 0.9.4, when register_globals is enabled, allows
23RISK
open ↗Referência✓ VexDay Proof
MyCMS 0.9.8 - Remote Command Execution (1)
MyCMS 0.9.8 and earlier allows remote attackers to gain privileges via the admin cookie parameter, as demonstrated by a
23RISK
open ↗Referência✓ VexDay Proof
PHP-Stats 0.1.9.2 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in php-stats.recjs.php in Php-Stats 0.1.9.2 allow remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
xeCMS 1.x - 'view.php' Remote File Disclosure
Directory traversal vulnerability in view.php in xeCMS 1.0 allows remote attackers to read arbitrary files via a ..%2F (
23RISK
open ↗Referência✓ VexDay Proof
TlAds 1.0 - Remote Insecure Cookie Handling
tlAds 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the tlAds_login coo
23RISK
open ↗Referência✓ VexDay Proof
QuoteBook - Remote Configuration File Disclosure
QuoteBook stores quotes.inc under the web root with insufficient access control, which allows remote attackers to obtain
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke Module htmltonuke 2.0alpha - 'htmltonuke.php' Remote File Inclusion
PHP remote file inclusion vulnerability in htmltonuke.php in the htmltonuke 2.0 alpha, and possibly other versions, modu
23RISK
open ↗Referência✓ VexDay Proof
PortailPHP mod_phpalbum 2.1.5 - 'chemin' Remote File Inclusion
PHP remote file inclusion vulnerability in sommaire_admin.php in PhpAlbum (mod_phpalbum) 2.15 for PortailPHP allows remo
23RISK
open ↗Referência✓ VexDay Proof
Bloginator 1a - Cookie Bypass / SQL Injection
Bloginator 1A allows remote attackers to bypass authentication and gain administrative access by setting the identifyYou
23RISK
open ↗Referência✓ VexDay Proof
sBLOG 0.7.3 Beta - '/inc/lang.php' Local File Inclusion
Directory traversal vulnerability in inc/lang.php in sBLOG 0.7.3 Beta allows remote attackers to include and execute arb
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module Jobs 2.4 - 'cid' SQL Injection
SQL injection vulnerability in index.php in the John Mordo Jobs 2.4 and earlier module for XOOPS allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
Chilkat Zip ActiveX Component 12.4 - Multiple Insecure Methods
Absolute path traversal vulnerability in the Chilkat Software Chilkat Zip ActiveX control in ChilkatZip2.dll 12.4.2.0 al
23RISK
open ↗Referência✓ VexDay Proof
DevMass Shopping Cart 1.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin/kfm/initialise.php in DevMass Shopping Cart 1.0 and earlier allows remo
23RISK
open ↗Referência✓ VexDay Proof
CPCommerce 1.1.0 - Cross-Site Scripting / Local File Inclusion
Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Falt4 CMS rc4 10.9.2007 - Multiple Vulnerabilities
SQL injection vulnerability in (1) index.php, and possibly (2) admin/index.php, in Falt4Extreme RC4 10.9.2007 allows rem
23RISK
open ↗Referência✓ VexDay Proof
aflog 1.01 - Multiple Insecure Cookie Handling Vulnerabilities
aflog 1.01 allows remote attackers to bypass authentication and gain administrative access by setting the aflog_auth_a c
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Windows Media Player - '.mid' Integer Overflow (PoC)
Integer overflow in Microsoft Windows Media Player (WMP) 11.0.5721.5260 allows remote attackers to cause a denial of ser
28RISK
open ↗Referência✓ VexDay Proof
Microsoft Internet Explorer - XML Parsing Remote Buffer Overflow
Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet
50RISK
open ↗Referência✓ VexDay Proof
LeadTools Raster Thumbnail Object Library - 'LTRTM14e.dll' Remote Buffer Overflow
Stack-based buffer overflow in the BrowseDir function in the (1) lttmb14E.ocx or (2) LTRTM14e.DLL ActiveX control in Lea
23RISK
open ↗Referência✓ VexDay Proof
Pligg CMS 9.9.0 - Cross-Site Scripting / Local File Inclusion / SQL Injection
Cross-site scripting (XSS) vulnerability in Pligg 9.9 and earlier allows remote attackers to inject arbitrary web script
23RISK
open ↗Referência✓ VexDay Proof
SiteDepth CMS 3.44 - 'ShowImage.php?name' File Disclosure
Directory traversal vulnerability in ShowImage.php in SiteDepth CMS 3.44 allows remote attackers to read arbitrary files
23RISK
open ↗Referência✓ VexDay Proof
WordPress Plugin WassUp 1.4.3 - 'to_date' SQL Injection
Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote att
23RISK
open ↗Referência✓ VexDay Proof
Easy Scripts Answer and Question Script - Multiple Vulnerabilities
Unrestricted file upload vulnerability in myaccount.php in Easy Scripts Answer and Question Script allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
Philips VOIP841 Firmware 1.0.4.800 - Multiple Vulnerabilities
Directory traversal vulnerability in the web server in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and
23RISK
open ↗Referência✓ VexDay Proof
chCounter 3.1.3 - Authentication Bypass
Multiple SQL injection vulnerabilities in stats/index.php in chCounter 3.1.3 allow remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Apollo 37zz - '.m3u' Local Heap Overflow (PoC)
Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service (application crash) and p
23RISK
open ↗Referência✓ VexDay Proof
moziloCMS 1.11 - Local File Inclusion / Full Path Disclosure / Cross-Site Scripting
Directory traversal vulnerability in index.php in moziloCMS 1.11 allows remote attackers to read arbitrary files via a .
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.