Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,445cataloged exploits
34,432CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB
Ektron CMS 9.10 SP1 (Build 9.1.0.184.1.114) - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content
23RISK
open ↗Exploit-DB
TYPO3 Extension Akronymmanager 0.5.0 - SQL Injection
SQL injection vulnerability in mod1/index.php in the Akronymmanager (sb_akronymmanager) extension before 7.0.0 for TYPO3
23RISK
open ↗Exploit-DB✓ VexDay Proof
Milw0rm Clone Script 1.0 - '/admin/login.php' Authentication Bypass
Multiple SQL injection vulnerabilities in admin/login.php in Milw0rm Clone Script 1.0 allow remote attackers to execute
23RISK
open ↗Exploit-DB
WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload
Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin
50RISK
open ↗Exploit-DB✓ VexDay Proof
ZCMS 1.1 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1.
23RISK
open ↗Exploit-DB✓ VexDay Proof
ZCMS 1.1 - Multiple Vulnerabilities
SQL injection vulnerability in ZCMS 1.1.
23RISK
open ↗Exploit-DB
Opsview 4.6.2 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Opsview 4.6.2 and earlier allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB
ClickHeat 1.14 - Cross-Site Request Forgery (Change Admin Password)
Cross-site request forgery (CSRF) vulnerability in ClickHeat 1.14 and earlier allows remote attackers to hijack the auth
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin SE HTML5 Album Audio Player 1.1.0 - Directory Traversal
Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player)
43RISK
open ↗Exploit-DB
OSSEC 2.7 < 2.8.1 - 'diff' Local Privilege Escalation
syscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute arbitrary code as root.
23RISK
open ↗Exploit-DB✓ VexDay Proof
ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasploit)
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and
60RISK
open ↗Exploit-DB
ISPConfig 3.0.5.4p6 - Multiple Vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijac
23RISK
open ↗Exploit-DB
WordPress Plugin Encrypted Contact Form 1.0.4 - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows rem
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Paypal Currency Converter Basic For WooCommerce - File Read
Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic
28RISK
open ↗Exploit-DB
ISPConfig 3.0.5.4p6 - Multiple Vulnerabilities
SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated user
23RISK
open ↗Exploit-DB
FiverrScript - Cross-Site Request Forgery (Add Admin)
Cross-site request forgery (CSRF) vulnerability in FiverrScript (aka Fiverr Script) 7.2 allows remote attackers to hijac
23RISK
open ↗Exploit-DB
Alcatel-Lucent OmniSwitch - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web int
23RISK
open ↗Exploit-DB
SysAid Help Desk 14.4 - Multiple Vulnerabilities
Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators t
50RISK
open ↗Exploit-DB✓ VexDay Proof
Bonita BPM 6.5.1 - Multiple Vulnerabilities
Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arb
23RISK
open ↗Exploit-DB
ICU library 52 < 54 - Multiple Vulnerabilities
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in I
28RISK
open ↗Exploit-DB✓ VexDay Proof
Bonita BPM 6.5.1 - Multiple Vulnerabilities
Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via
43RISK
open ↗Exploit-DB
SysAid Help Desk 14.4 - Multiple Vulnerabilities
SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which al
23RISK
open ↗Exploit-DB
SysAid Help Desk 14.4 - Multiple Vulnerabilities
The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote at
50RISK
open ↗Exploit-DB
SysAid Help Desk 14.4 - Multiple Vulnerabilities
SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers t
50RISK
open ↗Exploit-DB
SysAid Help Desk 14.4 - Multiple Vulnerabilities
SysAid Help Desk before 15.2 allows remote attackers to cause a denial of service (CPU and memory consumption) via a lar
23RISK
open ↗Exploit-DB
SysAid Help Desk 14.4 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary
23RISK
open ↗Exploit-DB
SysAid Help Desk 14.4 - Multiple Vulnerabilities
Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrar
60RISK
open ↗Exploit-DB
HP WebInspect 10.4 - XML External Entity Injection
Unspecified vulnerability in HP WebInspect 7.x through 10.4 before 10.4 update 1 allows remote authenticated users to by
23RISK
open ↗Exploit-DB
Libmimedir - '.VCF' Memory Corruption (PoC)
libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file,
28RISK
open ↗Exploit-DB
ICU library 52 < 54 - Multiple Vulnerabilities
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in I
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.