Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,107cataloged exploits
36,322CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,464Referência 22,936GitHub PoC 15,010VulnCheck XDB 8,846Nuclei 4,361Metasploit 3,490✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
68 Classifieds 4.0 - 'category.php' SQL Injection
SQL injection vulnerability in category.php in 68 Classifieds 4.0.1 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
plusphp url shortening software 1.6 - Remote File Inclusion
PHP remote file inclusion vulnerability in plus.php in plusPHP Short URL Multi-User Script 1.6 allows remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
Webfwlog 0.92 - 'debug.php' Remote File Disclosure
include/debug.php in Webfwlog 0.92 and earlier, when register_globals is enabled, allows remote attackers to obtain sour
23RISK
open ↗Referência✓ VexDay Proof
PHP recommend 1.3 - Authentication Bypass / Remote File Inclusion / Code Injection
PHP remote file inclusion vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
newsmanager 2.0 - Remote File Inclusion / File Disclosure / SQL Injection
PHP remote file inclusion vulnerability in ch_readalso.php in News Manager 2.0 allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
MeltingIce File System 1.0 - Arbitrary Add User
MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and e
23RISK
open ↗Referência✓ VexDay Proof
CMS WebManager-Pro - Multiple SQL Injections
Multiple SQL injection vulnerabilities in index.php in CMS WebManager-Pro allow remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
How2ASP.net WebBoard 4.1 - SQL Injection
SQL injection vulnerability in showQAnswer.asp in How2ASP.net Webboard 4.1 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Konqueror 3.5.9 - 'color'/'bgcolor' Multiple Remote Crash Vulnerabilities
The HTML parser in KDE Konqueror 3.5.9 allows remote attackers to cause a denial of service (application crash) via (1)
23RISK
open ↗Referência✓ VexDay Proof
Web Group Communication Center (WGCC) 1.0.3 - SQL Injection
Multiple SQL injection vulnerabilities in Web Group Communication Center (WGCC) 1.0.3 PreRelease 1 and earlier allow rem
23RISK
open ↗Referência✓ VexDay Proof
Mambo Module galleria 1.0b - Remote File Inclusion
PHP remote file inclusion vulnerability in galleria.html.php in Galleria Mambo Module 1.0 and earlier for Mambo allows r
23RISK
open ↗Referência✓ VexDay Proof
PHP recommend 1.3 - Authentication Bypass / Remote File Inclusion / Code Injection
admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, wh
23RISK
open ↗Referência✓ VexDay Proof
PHPRecipeBook 2.35 - 'g_rb_basedir' Remote File Inclusion
PHP remote file inclusion vulnerability in classes/Import_MM.class.php in PHPRecipeBook 2.36, when register_globals is e
23RISK
open ↗Referência✓ VexDay Proof
MyAlbum 3.02 - 'language.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in language.inc.php in MyAlbum 3.02 and earlier allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
acFTP FTP Server 1.4 - 'USER' Remote Buffer Overflow (PoC)
acFTP 1.4 allows remote attackers to cause a denial of service (application crash) via a long string with "{" (brace) ch
23RISK
open ↗Referência✓ VexDay Proof
ItCMS 1.9 - 'boxpop.php' Remote Code Execution
Static code injection vulnerability in box/minichat/boxpop.php in IT!CMS (aka itcms) 1.9 allows remote attackers to inje
23RISK
open ↗Referência✓ VexDay Proof
SimpCMS 04.10.2007 - 'site' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in SimpCMS Light 04.10.2007 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Samsung DVR SHR2040 - HTTPd Remote Denial of Service Denial of Service (PoC)
The web interface in Samsung DVR SHR2040 allows remote attackers to cause a denial of service (crash) via a malformed HT
23RISK
open ↗Referência✓ VexDay Proof
maGAZIn 2.0 - 'PHPThumb.php?src' Remote File Disclosure
Directory traversal vulnerability in phpThumb.php in PinkCrow Designs Gallery or maGAZIn 2.0 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
PHP Jokesite 2.0 - 'cat_id' SQL Injection
SQL injection vulnerability in jokes_category.php in PHP-Jokesite 2.0 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência✓ VexDay Proof
Google Chrome - 'ChromeHTML://' Remote Parameter Injection
Argument injection vulnerability in Google Chrome 1.0.154.36 on Windows XP SP3 allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
Trionic Cite CMS 1.2rev9 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Trionic Cite CMS 1.2 rev9 and earlier allow remote attackers to ex
28RISK
open ↗Referência✓ VexDay Proof
Siemens C450IP/C475IP - Remote Denial of Service
Siemens C450 IP and C475 IP VoIP devices allow remote attackers to cause a denial of service (disconnected calls and dev
23RISK
open ↗Referência✓ VexDay Proof
FlashChat 4.5.7 - 'aedating4CMS.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in FlashChat before 4.6.2 allow remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Orbit Downloader 2.8.7 - Arbitrary File Deletion
Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allow
23RISK
open ↗Referência✓ VexDay Proof
R2K Gallery 1.7 - 'galeria.php?lang2' Local File Inclusion
Directory traversal vulnerability in galeria.php in R2K Gallery 1.7 allows remote attackers to read arbitrary files via
23RISK
open ↗Referência✓ VexDay Proof
snap - seccomp BBlacklist for TIOCSTI can be Circumvented
Snapd seccomp filter TIOCSTI ioctl bypass
33RISK
open ↗Referência✓ VexDay Proof
2WIRE Modems/Routers - 'CRLF' Denial of Service
The web-based management interface in 2Wire, Inc. HomePortal and OfficePortal Series modems and routers allows remote at
23RISK
open ↗Referência✓ VexDay Proof
MX-System 2.7.3 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in MxBB (aka MX-System) Portal 2.7.3 allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
TCExam 4.0.011 - 'SessionUserLang' Shell Injection
shared/code/tce_tmx.php in TCExam 4.0.011 and earlier allows remote attackers to create arbitrary PHP files in cache/ by
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.