Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
Chartered Accountant Booking Script 1.0 - 'city' SQL Injection
Chartered Accountant Booking Script 1.0 has SQL Injection via the /service-list city parameter.
23RISK
open ↗Exploit-DB
Entrepreneur Job Portal Script 2.0.6 - 'jobsearch_all.php?rid1' SQL Injection
Entrepreneur Job Portal Script 2.0.6 has SQL Injection via the jobsearch_all.php rid1 parameter.
23RISK
open ↗Exploit-DB
CMS Auditor Website 1.0 - SQL Injection
CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.
23RISK
open ↗Exploit-DB
Child Care Script 1.0 - 'city' SQL Injection
Child Care Script 1.0 has SQL Injection via the /list city parameter.
23RISK
open ↗Exploit-DB✓ VexDay Proof
DomainSale PHP Script 1.0 - 'id' SQL Injection
DomainSale PHP Script 1.0 has SQL Injection via the domain.php id parameter.
23RISK
open ↗Exploit-DB
E-commerce MLM Software 1.0 - SQL Injection
E-commerce MLM Software 1.0 has SQL Injection via the service_detail.php pid parameter, event_detail.php eventid paramet
23RISK
open ↗Exploit-DB✓ VexDay Proof
FS Stackoverflow Clone 1.0 - 'keywords' SQL Injection
FS Stackoverflow Clone 1.0 has SQL Injection via the /question keywords parameter.
23RISK
open ↗Exploit-DB✓ VexDay Proof
FS Olx Clone 1.0 - 'scat' / 'pid' SQL Injection
FS Olx Clone 1.0 has SQL Injection via the subpage.php scat parameter or the message.php pid parameter.
23RISK
open ↗Exploit-DB✓ VexDay Proof
FS Shutterstock Clone 1.0 - 'keywords' SQL Injection
FS Shutterstock Clone 1.0 has SQL Injection via the /Category keywords parameter.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Website Auction Marketplace 2.0.5 - 'cat_id' SQL Injection
Website Auction Marketplace 2.0.5 has SQL Injection via the search.php cat_id parameter.
23RISK
open ↗Exploit-DB
Event Calendar Category Script 1.0 - 'city' SQL Injection
Event Search Script 1.0 has SQL Injection via the /event-list city parameter.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Realestate Crowdfunding Script 2.7.2 - 'pid' SQL Injection
Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter.
23RISK
open ↗Exploit-DB
Co-work Space Search Script 1.0 - 'city' SQL Injection
Co-work Space Search Script 1.0 has SQL Injection via the /list city parameter.
23RISK
open ↗Exploit-DB✓ VexDay Proof
FS Thumbtack Clone 1.0 - 'cat' / 'sc' SQL Injection
FS Thumbtack Clone 1.0 has SQL Injection via the browse-category.php cat parameter or the browse-scategory.php sc parame
23RISK
open ↗Exploit-DB✓ VexDay Proof
Simple Chatting System 1.0.0 - Arbitrary File Upload
Simple Chatting System 1.0 allows Arbitrary File Upload via view/my_profile.php, which places files under uploads/.
23RISK
open ↗Exploit-DB✓ VexDay Proof
FS Monster Clone 1.0 - 'Employer_Details.php?id' SQL Injection
FS Monster Clone 1.0 has SQL Injection via the Employer_Details.php id parameter.
23RISK
open ↗Exploit-DB✓ VexDay Proof
FS Makemytrip Clone 1.0 - 'fl_orig' / 'fl_dest' SQL Injection
FS Makemytrip Clone 1.0 has SQL Injection via the show-flight-result.php fl_orig or fl_dest parameter.
23RISK
open ↗Exploit-DB
Cab Booking Script 1.0 - 'city' SQL Injection
Cab Booking Script 1.0 has SQL Injection via the /service-list city parameter.
23RISK
open ↗Exploit-DB
Nearbuy Clone Script 3.2 - 'search' SQL Injection
Nearbuy Clone Script 3.2 has SQL Injection via the category_list.php search parameter.
23RISK
open ↗Exploit-DB
Consumer Complaints Clone Script 1.0 - 'id' SQL Injection
Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter.
23RISK
open ↗Exploit-DB✓ VexDay Proof
FS Quibids Clone 1.0 - SQL Injection
FS Quibids Clone 1.0 has SQL Injection via the itechd.php productid parameter.
23RISK
open ↗Exploit-DB
Doctor Search Script 1.0 - 'city' SQL Injection
Doctor Search Script 1.0 has SQL Injection via the /list city parameter.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Wireshark 2.4.0 < 2.4.2 / 2.2.0 < 2.2.10 - CIP Safety Dissector Crash
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. This was addressed in epan/dissec
28RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 4.10.5 / < 4.14.3 (Ubuntu) - DCCP Socket Use-After-Free
The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privilege
23RISK
open ↗Exploit-DB
Claymore Dual ETH + DCR/SC/LBC/PASC GPU Miner - Stack Buffer Overflow / Path Traversal
The remote management interface on the Claymore Dual GPU miner 10.1 is vulnerable to an authenticated directory traversa
28RISK
open ↗Exploit-DB
Apple macOS High Sierra 10.13 - 'ctl_ctloutput-leak' Information Leak
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS b
23RISK
open ↗Exploit-DB
Claymore Dual ETH + DCR/SC/LBC/PASC GPU Miner - Stack Buffer Overflow / Path Traversal
The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute
35RISK
open ↗Exploit-DB✓ VexDay Proof
Hashicorp vagrant-vmware-fusion 5.0.1 - Local Privilege Escalation
In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently su
23RISK
open ↗Exploit-DB✓ VexDay Proof
Hashicorp vagrant-vmware-fusion 4.0.23 - Local Privilege Escalation
HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo help
23RISK
open ↗Exploit-DB
Proxifier for Mac 2.19 - Local Privilege Escalation
Proxifier for Mac before 2.19.2, when first run, allows local users to gain privileges by replacing the KLoader binary w
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.