Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,107cataloged exploits
36,322CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,464Referência 22,936GitHub PoC 15,010VulnCheck XDB 8,846Nuclei 4,361Metasploit 3,490✓ verified onlyrecentpopularrisk
5,629 exploits
Referência✓ VexDay Proof
Java SE Runtime Environment JRE 6 Update 13 - Multiple Vulnerabilities
Multiple buffer overflows in the Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Env
28RISK
open ↗Referência✓ VexDay Proof
32bit FTP - 'PASV' Reply Client Remote Overflow (Metasploit)
Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a
43RISK
open ↗Referência✓ VexDay Proof
Joomla! Component com_gsticketsystem - 'catid' Blind SQL Injection
SQL injection vulnerability in the GridSupport (GS) Ticket System (com_gsticketsystem) component for Joomla! allows remo
23RISK
open ↗Referência✓ VexDay Proof
DM FileManager 3.9.2 - Authentication Bypass
Multiple SQL injection vulnerabilities in login.php in DM FileManager 3.9.2, when magic_quotes_gpc is disabled, allow re
23RISK
open ↗Referência✓ VexDay Proof
DGNews 3.0 Beta - 'id' SQL Injection
SQL injection vulnerability in berita.php in Dian Gemilang DGNews 3.0 Beta allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
bSpeak 1.10 - 'forumid' Blind SQL Injection
SQL injection vulnerability in index.php in 26th Avenue bSpeak 1.10 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
Catviz 0.4.0 beta1 - Local File Inclusion / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Catviz 0.4.0 beta 1 allow remote attackers to inject
23RISK
open ↗Referência✓ VexDay Proof
Realty Web-Base 1.0 - 'list_list.php?id' SQL Injection
SQL injection vulnerability in list_list.php in Realty Webware Technologies Web-Base 1.0 allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
Active NewsLetter 4.3 - Authentication Bypass
Multiple SQL injection vulnerabilities in SubscriberStart.asp in Active Newsletter 4.3 allow remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
cTorrent/DTorrent - '.torrent' Local Buffer Overflow
Stack-based buffer overflow in the btFiles::BuildFromMI function (trunk/btfiles.cpp) in Enhanced CTorrent (aka dTorrent)
28RISK
open ↗Referência✓ VexDay Proof
Pluck CMS 4.6.2 - 'langpref' Local File Inclusion
Multiple directory traversal vulnerabilities in pluck 4.6.2, when register_globals is enabled, allow remote attackers to
28RISK
open ↗Referência✓ VexDay Proof
StrawBerry 1.1.1 - Local File Inclusion / Remote Command Execution
Directory traversal vulnerability in plugins/ddb/foot.php in Strawberry 1.1.1 allows remote attackers to include and exe
28RISK
open ↗Referência✓ VexDay Proof
Eggdrop/Windrop 1.6.19 - ctcpbuf Remote Crash
mod/server.mod/servmsg.c in Eggheads Eggdrop and Windrop 1.6.19 and earlier allows remote attackers to cause a denial of
23RISK
open ↗Referência✓ VexDay Proof
ST-Gallery 0.1a - Multiple SQL Injections
Multiple SQL injection vulnerabilities in the getGalleryImage function in st_admin/gallery_output.php in ST-Gallery 0.1
23RISK
open ↗Referência✓ VexDay Proof
my-gesuad 0.9.14 - Authentication Bypass / SQL Injection / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in myGesuad 0.9.14 (aka 0.9) allow remote attackers to inject arbitr
23RISK
open ↗Referência✓ VexDay Proof
my-gesuad 0.9.14 - Authentication Bypass / SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in myGesuad 0.9.14 (aka 0.9) allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
Audioactive Player 1.93b - '.m3u' Local Buffer Overflow
Stack-based buffer overflow in Sonic Spot Audioactive Player 1.93b allows remote attackers to execute arbitrary code via
23RISK
open ↗Referência✓ VexDay Proof
Audioactive Player 1.93b - '.m3u' Local Buffer Overflow (SEH)
Stack-based buffer overflow in Sonic Spot Audioactive Player 1.93b allows remote attackers to execute arbitrary code via
23RISK
open ↗Referência✓ VexDay Proof
DigiMode Maya 1.0.2 - '.m3u' / '.m3l' Buffer Overflow (PoC)
Multiple buffer overflows in DigiMode Maya 1.0.2 allow remote attackers to execute arbitrary code via a long string in a
23RISK
open ↗Referência✓ VexDay Proof
2DayBiz Custom T-shirt Design - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in product.php in 2daybiz Custom T-shirt Design Script allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component ArtForms 2.1 b7 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the InterJoomla ArtForms (com_artforms) component 2.1b7 for Joomla
23RISK
open ↗Referência✓ VexDay Proof
ArcaVir 2009 < 9.4.320X.9 - 'ps_drv.sys' Local Privilege Escalation
The ps_drv.sys kernel driver in ArcaBit ArcaVir 2009 Antivirus Protection 9.4.3201.9 and earlier, ArcaVir 2009 Internet
23RISK
open ↗Referência✓ VexDay Proof
my-colex 1.4.2 - Authentication Bypass / SQL Injection / Cross-Site Scripting
modules/admuser.php in myColex 1.4.2 does not require administrative authentication, which allows remote authenticated u
23RISK
open ↗Referência✓ VexDay Proof
my-gesuad 0.9.14 - Authentication Bypass / SQL Injection / Cross-Site Scripting
modules/admuser.php in myGesuad 0.9.14 (aka 0.9) does not require administrative authentication, which allows remote aut
23RISK
open ↗Referência✓ VexDay Proof
Winamp 5.55 - MAKI script Universal Integer Overflow
The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute
50RISK
open ↗Referência✓ VexDay Proof
Easy Px 41 CMS 09.00.00B1 - 'fiche' Local File Inclusion
Directory traversal vulnerability in index.php in Easy PX 41 CMS 9.0 B1 allows remote attackers to include and execute a
23RISK
open ↗Referência✓ VexDay Proof
MyForum 1.3 - Authentication Bypass
Multiple SQL injection vulnerabilities in Graphiks MyForum 1.3 allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
Kensei Board 2.0.0b - Multiple SQL Injections
Multiple SQL injection vulnerabilities in index.php in Kensei Board 2.0 BETA (aka 2.0.0b) and earlier allow remote attac
23RISK
open ↗Referência✓ VexDay Proof
Million Dollar Text Links 1.x - Insecure Cookie Handling
Million Dollar Text Links 1.0 allows remote attackers to bypass authentication and gain administrative access by setting
23RISK
open ↗Referência✓ VexDay Proof
Adobe JRun 4 - 'logfile' (Authenticated) Directory Traversal
Directory traversal vulnerability in logging/logviewer.jsp in the Management Console in Adobe JRun Application Server 4
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.