Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,980cataloged exploits
36,899CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,476Referência 23,400GitHub PoC 15,250VulnCheck XDB 8,959Nuclei 4,393Metasploit 3,502✓ verified onlyrecentpopularrisk
24,476 exploits
Exploit-DB✓ VexDay Proof
Joomla! Component JTicketing 2.0.16 - SQL Injection
SQL Injection exists in the JTicketing 2.0.16 component for Joomla! via a view=events action with a filter_creator or fi
23RISK
open ↗Exploit-DB✓ VexDay Proof
EPIC MyChart - X-Path Injection
XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing s
28RISK
open ↗Exploit-DB
Joomla! Component Kubik-Rubik Simple Image Gallery Extended (SIGE) 3.2.3 - Cross-Site Scripting
Reflected XSS in Kubik-Rubik SIGE (aka Simple Image Gallery Extended) before 3.3.0 allows attackers to execute JavaScrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component NeoRecruit 4.1 - SQL Injection
SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the (1) PATH_INFO or (2) name of a .html file under
23RISK
open ↗Exploit-DB✓ VexDay Proof
ABRT - 'raceabrt' Privilege Escalation (Metasploit)
Automatic Bug Reporting Tool (ABRT) allows local users to read, change the ownership of, or have other unspecified impac
38RISK
open ↗Exploit-DB
JBoss Remoting 6.14.18 - Denial of Service
A vulnerability was found in the way RemoteMessageChannel, introduced in jboss-remoting versions 3.3.10, reads from an e
28RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component DT Register 3.2.7 - 'id' SQL Injection
SQL Injection exists in the DT Register 3.2.7 component for Joomla! via a task=edit&id= request.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle Primavera P6 Enterprise Project Portfolio Management - HTTP Response Splitting
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (
23RISK
open ↗Exploit-DB
Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module < 4.25 - Denial of Service
A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01;
60RISK
open ↗Exploit-DB
Joomla! Component Solidres 2.5.1 - SQL Injection
SQL Injection exists in the Solidres 2.5.1 component for Joomla! via the direction parameter in a hub.search action.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Gallery WD 1.3.6 - SQL Injection
SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter.
23RISK
open ↗Exploit-DB
Front Accounting ERP 2.4.3 - Cross-Site Request Forgery
FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add u
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Timetable Responsive Schedule For Joomla! 1.5 - 'alias' SQL Injection
SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request.
28RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Staff Master 1.0 RC 1 - SQL Injection
SQL Injection exists in the Staff Master through 1.0 RC 1 component for Joomla! via the name parameter in a view=staff r
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component JquickContact 1.3.2.2.1 - SQL Injection
SQL Injection exists in the JquickContact 1.3.2.2.1 component for Joomla! via a task=refresh&sid= request.
23RISK
open ↗Exploit-DB
Joomla! Component SimpleCalendar 3.1.9 - SQL Injection
SQL Injection exists in the SimpleCalendar 3.1.9 component for Joomla! via the catid array parameter.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Smart Shoutbox 3.0.0 - SQL Injection
SQL Injection exists in the Smart Shoutbox 3.0.0 component for Joomla! via the shoutauthor parameter to the archive URI.
23RISK
open ↗Exploit-DB
Joomla! Component JS Jobs 1.1.9 - SQL Injection
SQL Injection exists in the JS Jobs 1.1.9 component for Joomla! via the zipcode parameter in a newest-jobs request, or t
23RISK
open ↗Exploit-DB
Joomla! Component File Download Tracker 3.0 - SQL Injection
SQL Injection exists in the File Download Tracker 3.0 component for Joomla! via the dynfield[phone] or sess parameter.
23RISK
open ↗Exploit-DB
Joomla! Component Realpin 1.5.04 - SQL Injection
SQL Injection exists in the Realpin through 1.5.04 component for Joomla! via the pinboard parameter.
23RISK
open ↗Exploit-DB
Joomla! Component JS Autoz 1.0.9 - SQL Injection
SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter.
28RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Project Log 1.5.3 - 'search' SQL Injection
SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component jGive 2.0.9 - SQL Injection
SQL Injection exists in the JGive 2.0.9 component for Joomla! via the filter_org_ind_type or campaign_countries paramete
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Aist 2.0 - 'id' SQL Injection
SQL Injection exists in the Aist through 2.0 component for Joomla! via the id parameter in a view=showvacancy request.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Fastball 2.5 - 'season' SQL Injection
SQL Injection exists in the Fastball 2.5 component for Joomla! via the season parameter in a view=player action.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component JB Bus 2.3 - 'order_number' SQL Injection
SQL Injection exists in the JB Bus 2.3 component for Joomla! via the order_number parameter.
23RISK
open ↗Exploit-DB
Joomla! Component MediaLibrary Free 4.0.12 - SQL Injection
SQL Injection exists in the MediaLibrary Free 4.0.12 component for Joomla! via the id parameter or the mid array paramet
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra JIT - 'GlobOpt::OptTagChecks' Must Consider IsLoopPrePass Properly (2)
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitra
45RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra JIT - 'Array.prototype.reverse' Array Type Confusion
Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remot
35RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra JIT - 'LdThis' Type Confusion
Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remot
35RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.