Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,107cataloged exploits
36,322CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,464Referência 22,936GitHub PoC 15,010VulnCheck XDB 8,846Nuclei 4,361Metasploit 3,490✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
FretsWeb 1.2 - 'name' Blind SQL Injection
Multiple SQL injection vulnerabilities in FretsWeb 1.2 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component EXP Shop - 'catid' SQL Injection
SQL injection vulnerability in the EXP Shop (com_expshop) component 1.0 for Joomla! allows remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
Docebo 3.5.0.3 - 'lib.regset.php' Command Execution
Docebo 3.5.0.3 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) class/cla
23RISK
open ↗Referência✓ VexDay Proof
Power Editor 2.0 - Remote File Disclosure / Edit
Multiple directory traversal vulnerabilities in editor.php in ScriptsEZ.net Power Editor 2.0 allow remote attackers to r
23RISK
open ↗Referência✓ VexDay Proof
TorrentFlux 2.2 - 'maketorrent.php' Remote Command Execution
maketorrent.php in TorrentFlux 2.2 allows remote authenticated users to execute arbitrary commands via shell metacharact
23RISK
open ↗Referência✓ VexDay Proof
AJ HYIP ACME - 'news.php' SQL Injection
SQL injection vulnerability in news.php in AJ Square aj-hyip (aka AJ HYIP Acme) allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
project alumni 1.0.9 - 'index.php?act' Local File Inclusion
Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute ar
23RISK
open ↗Referência✓ VexDay Proof
Mega File Hosting Script 1.2 - 'url' Remote File Inclusion
PHP remote file inclusion vulnerability in cross.php in YABSoft Mega File Hosting 1.2 allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Prozilla Topsites 1.0 - Arbitrary Edit/Add Users
Prozilla Topsites 1.0 allows remote attackers to perform administrative actions via a direct request to (1) addu.php, (2
23RISK
open ↗Referência✓ VexDay Proof
Ixprim CMS 1.2 - Blind SQL Injection
Ixprim 1.2 allows remote attackers to obtain sensitive information via a direct request for kernel/plugins/fckeditor2/ix
23RISK
open ↗Referência✓ VexDay Proof
realm CMS 2.3 - Multiple Vulnerabilities
_RealmAdmin/login.asp in Realm CMS 2.3 and earlier allows remote attackers to bypass authentication and access admin pag
23RISK
open ↗Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to uninsta
23RISK
open ↗Referência✓ VexDay Proof
eLineStudio Site Composer (ESC) 2.6 - Multiple Vulnerabilities
eLineStudio Site Composer (ESC) 2.6 and earlier allows remote attackers to obtain sensitive information via a direct req
23RISK
open ↗Referência✓ VexDay Proof
All Club CMS 0.0.2 - Remote Database Configuration Retrieve
All Club CMS (ACCMS) 0.0.2 and earlier stores sensitive information under the web root with insufficient access control,
23RISK
open ↗Referência✓ VexDay Proof
TinyWebGallery 1.7.6 - Local File Inclusion / Remote Code Execution
Directory traversal vulnerability in .include/init.php (aka admin/_include/init.php) in QuiXplorer 2.3.2 and earlier, as
23RISK
open ↗Referência✓ VexDay Proof
Gobbl CMS 1.0 - Insecure Cookie Handling
admin/auth.php in Gobbl CMS 1.0 allows remote attackers to bypass authentication and gain administrative access by setti
23RISK
open ↗Referência✓ VexDay Proof
ASPPortal 3.2.5 - Database Disclosure
ASP Portal 3.2.5 stores sensitive information under the web root with insufficient access control, which allows remote a
23RISK
open ↗Referência✓ VexDay Proof
FreeWPS 2.11 - 'images.php' Remote Code Execution
images.php in Justin White (aka YTZ) Free Web Publishing System (FreeWPS) 2.11 allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
MiniHTTPServer Web Forum & File Sharing Server 4.0 - Add User
join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accou
23RISK
open ↗Referência✓ VexDay Proof
SH-News 3.0 - Insecure Cookie Handling
action.php in SH-News 3.0 allows remote attackers to bypass authentication and gain administrator privileges by setting
23RISK
open ↗Referência✓ VexDay Proof
ScarNews 1.2.1 - 'sn_admin_dir' Local File Inclusion
Directory traversal vulnerability in scarnews.inc.php in ScarNews 1.2.1 allows remote attackers to include and execute a
23RISK
open ↗Referência✓ VexDay Proof
My Little Forum 1.7 - 'user.php?id' SQL Injection
SQL injection vulnerability in user.php in My Little Forum 1.7 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Absolute Form Processor 4.0 - Insecure Cookie Handling
Xigla Software Absolute Form Processor .NET 4.0 allows remote attackers to bypass authentication and gain administrative
23RISK
open ↗Referência✓ VexDay Proof
DreamLog 0.5 - 'upload.php' Arbitrary File Upload
Unrestricted file upload vulnerability in upload.php in dreamLog (aka dreamblog) 0.5 allows remote attackers to upload a
23RISK
open ↗Referência✓ VexDay Proof
LinPHA 1.3.1 - 'new_images.php' Blind SQL Injection
SQL injection vulnerability in include/img_view.class.php in LinPHA 1.3.1 and earlier allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
AssoCIateD CMS 1.1.3 - 'ROOT_PATH' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in AssoCIateD (aka ACID) CMS 1.1.3 allow remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Alstrasoft AskMe Pro 2.1 - Multiple SQL Injections
SQL injection vulnerability in profile.php in AlstraSoft AskMe Pro 2.1 and earlier allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
Phaos 0.9.2 - 'basename()' Remote Command Execution
Directory traversal vulnerability in include_lang.php in Phaos 0.9.2 allows remote attackers to include arbitrary local
23RISK
open ↗Referência✓ VexDay Proof
PHP Crawler 0.8 - Remote File Inclusion
PHP remote file inclusion vulnerability in footer.php in PHP-Crawler 0.8 allows remote attackers to execute arbitrary PH
23RISK
open ↗Referência✓ VexDay Proof
NuralStorm Webmail 0.98b - 'process.php' Remote File Inclusion
PHP remote file inclusion vulnerability in process.php in NuralStorm Webmail 0.98b and earlier, when register_globals is
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.