Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,107cataloged exploits
36,322CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,464Referência 22,936GitHub PoC 15,010VulnCheck XDB 8,846Nuclei 4,361Metasploit 3,490✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
VideoScript 4.0.1.50 - Change Admin Password
The password change feature (admin/cp.php) in VideoScript 4.0.1.50 and earlier does not check for administrative authent
23RISK
open ↗Referência✓ VexDay Proof
falcon CMS 1.4.3 - Remote File Inclusion / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to inject arbi
23RISK
open ↗Referência✓ VexDay Proof
The Rat CMS Alpha 2 - Authentication Bypass
Multiple SQL injection vulnerabilities in login.php in The Rat CMS Alpha 2 allow remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
PassWiki 0.9.16 RC3 - 'site_id' Local File Inclusion
Directory traversal vulnerability in passwiki.php in PassWiki 0.9.16 RC3 and earlier allows remote attackers to read arb
23RISK
open ↗Referência✓ VexDay Proof
SkaLinks 1.5 - 'register.php' Arbitrary Add Editor
Skalfa Software SkaLinks Exchange Script 1.5 allows remote attackers to add new administrators and gain privileges via a
23RISK
open ↗Referência✓ VexDay Proof
PHP Photo Gallery 1.0 - 'photo_id' SQL Injection
SQL injection vulnerability in index.php in Terong PHP Photo Gallery (aka Advanced Web Photo Gallery) 1.0 allows remote
23RISK
open ↗Referência✓ VexDay Proof
WebED 0.0.9 - 'index.php' Remote File Disclosure
Multiple directory traversal vulnerabilities in mod/chat/index.php in WebED 0.0.9 allow remote attackers to read arbitra
23RISK
open ↗Referência✓ VexDay Proof
Esqlanelapse Software Project 2.6.2 - Insecure Cookie Handling
Esqlanelapse 2.6.1 and 2.6.2 allows remote attackers to bypass authentication and gain privileges via modified (1) enomb
23RISK
open ↗Referência✓ VexDay Proof
Chilkat IMAP ActiveX 7.9 - File Execution / Denial of Service
Insecure method vulnerability in ChilkatMail_v7_9.dll in the Chilkat Software IMAP ActiveX control (ChilkatMail2.Chilkat
23RISK
open ↗Referência✓ VexDay Proof
visualpic 0.3.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in VisualPic 0.3.1 allows remote attackers to execute arbitrary PHP
28RISK
open ↗Referência✓ VexDay Proof
FreshView 7.15 - '.psp' Local Buffer Overflow
Buffer overflow in Fresh View 7.15 allows user-assisted remote attackers to execute arbitrary code via a crafted .PSP fi
23RISK
open ↗Referência✓ VexDay Proof
Autodesk DWF Viewer Control / LiveUpdate Module - Remote Code Execution
Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer ActiveX control (AdView.dll 9.0.0
23RISK
open ↗Referência✓ VexDay Proof
TalkBack 2.2.7 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in TalkBack 2.2.7 allow remote attackers to execute arbitrary PHP cod
23RISK
open ↗Referência✓ VexDay Proof
Joovili 3.0.6 - 'joovili.images.php' Remote File Disclosure
Directory traversal vulnerability in include/images.inc.php in Joovili 2.x allows remote attackers to read arbitrary fil
23RISK
open ↗Referência✓ VexDay Proof
mini-pub 0.3 - File Disclosure / Code Execution
mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to execute arbitrary commands via shell metachara
23RISK
open ↗Referência✓ VexDay Proof
The Gemini Portal 4.7 - Insecure Cookie Handling
admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain
23RISK
open ↗Referência✓ VexDay Proof
eFront 3.5.1 / build 2710 - Arbitrary File Upload
Unrestricted file upload vulnerability in filesystem3.class.php in eFront 3.5.1 build 2710 and earlier allows remote att
23RISK
open ↗Referência✓ VexDay Proof
RPG.Board 0.0.8Beta2 - Insecure Cookie Handling
RPG.Board 0.8 Beta2 and earlier allows remote attackers to bypass authentication and gain privileges by setting the keep
23RISK
open ↗Referência✓ VexDay Proof
Joomla! / Mambo Component Taskhopper 1.1 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the Taskhopper 1.1 component for Mambo and Joomla! allow remote at
23RISK
open ↗Referência✓ VexDay Proof
phpAtm 1.30 - 'downloadfile' Remote File Disclosure
Directory traversal vulnerability in index.php in PHP Advanced Transfer Manager (phpATM) 1.30 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
EVA-Web 1.1 < 2.2 - 'index.php3' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in index.php3 in EVA-Web 1.1 through 2.2 allow remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
phpBB Shadow Premod 2.7.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/functions_portal.php in Premod Shadow 2.7.1 and earlier allows remot
23RISK
open ↗Referência✓ VexDay Proof
VicFTPS < 5.0 - 'CWD' Remote Buffer Overflow (PoC)
Stack-based buffer overflow in VicFTPS before 5.0 allows remote attackers to cause a denial of service (application cras
23RISK
open ↗Referência✓ VexDay Proof
Sony Network Camera SNC-P5 1.0 - ActiveX viewer Heap Overflow (PoC)
Heap-based buffer overflow in the viewer ActiveX control in Sony Network Camera SNC-RZ25N before 1.30; SNC-P1 and SNC-P5
28RISK
open ↗Referência✓ VexDay Proof
XplodPHP AutoTutorials 2.1 - 'id' SQL Injection
SQL injection vulnerability in viewcat.php in XplodPHP AutoTutorials 2.1 and earlier, when magic_quotes_gpc is disabled,
23RISK
open ↗Referência✓ VexDay Proof
ImageShack Toolbar 4.5.7 - 'FileUploader' Class InsecureMethod
The ImageShack Toolbar ActiveX control (ImageShackToolbar.dll) in ImageShack Toolbar 4.5.7, possibly including 4.5.7.69,
23RISK
open ↗Referência✓ VexDay Proof
PStruh-CZ 1.3/1.5 - 'download.asp' File Disclosure
Directory traversal vulnerability in download.asp in Motobit 1.3 and 1.5 (aka PStruh-CZ) allows remote attackers to read
23RISK
open ↗Referência✓ VexDay Proof
PHP Links 1.3 - 'smarty.php' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/smarty.php in DeltaScripts PHP Links 1.3 and earlier allows remote a
28RISK
open ↗Referência✓ VexDay Proof
Free PHP VX Guestbook 1.06 - Arbitrary Database Backup
Free PHP VX Guestbook 1.06 allows remote attackers to bypass authentication and download a backup of the database via a
23RISK
open ↗Referência✓ VexDay Proof
NewsOffice 1.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in news_show.php in Newanz NewsOffice 1.0 and 1.1, when register_globals is enab
35RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.