Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
PHPMoAdmin - Unauthorized Remote Code Execution
The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via she
50RISK
open ↗Exploit-DB
WordPress Theme Photocrati 4.x - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
vBulletin vBSEO 4.x - 'visitormessage.php' Remote Code Injection
functions_vbseo_hook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code v
28RISK
open ↗Exploit-DB✓ VexDay Proof
Seagate Business NAS 2014.00319 - Remote Code Execution
Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root
50RISK
open ↗Exploit-DB
Persistent Systems Client Automation - Command Injection Remote Code Execution (Metasploit)
radexecd.exe in Persistent Systems Radia Client Automation (RCA) 7.9, 8.1, 9.0, and 9.1 allows remote attackers to execu
60RISK
open ↗Exploit-DB
SQLite3 3.8.6 - Controlled Memory Corruption (PoC)
Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and a
23RISK
open ↗Exploit-DB✓ VexDay Proof
D-Link/TRENDnet - NCC Service Command Injection (Metasploit)
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr
100RISK
open ↗Exploit-DB✓ VexDay Proof
HP Client - Automation Command Injection (Metasploit)
radexecd.exe in Persistent Systems Radia Client Automation (RCA) 7.9, 8.1, 9.0, and 9.1 allows remote attackers to execu
60RISK
open ↗Exploit-DB
Clipbucket 2.7 RC3 0.9 - Blind SQL Injection
SQL injection vulnerability in view_item.php in ClipBucket 2.7 RC3 (2.7.0.4.v2929-rc3) allows remote attackers to execut
23RISK
open ↗Exploit-DB
Zeuscart 4.0 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in the administrative backend in ZeusCart 4 allow remote administrators to execut
23RISK
open ↗Exploit-DB
Beehive Forum 1.4.4 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in edit_prefs.php in Beehive Forum 1.4.4 allow remote attackers to i
23RISK
open ↗Exploit-DB
Zeuscart 4.0 - Multiple Vulnerabilities
ZeusCart 4 allows remote attackers to obtain configuration information via a getphpinfo action to admin/, which calls th
23RISK
open ↗Exploit-DB
phpBugTracker 1.6.0 - Multiple Vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authe
23RISK
open ↗Exploit-DB
Zeuscart 4.0 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in ZeusCart 4.0 and earlier allows remote attackers to inject arbitrary web scr
23RISK
open ↗Exploit-DB
Zeuscart 4.0 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in ZeusCart 4 allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB
phpBugTracker 1.6.0 - Multiple Vulnerabilities
SQL injection vulnerability in bug.php in phpBugTracker 0.9.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB
phpBugTracker 1.6.0 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to
23RISK
open ↗Exploit-DB
WordPress Plugin Easy Social Icons 1.2.2 - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote
23RISK
open ↗Exploit-DB
phpBugTracker 1.6.0 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbi
23RISK
open ↗Exploit-DB
phpBugTracker 1.6.0 - Multiple Vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attac
23RISK
open ↗Exploit-DB
PHP DateTime - Use-After-Free
Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x befo
35RISK
open ↗Exploit-DB
Zabbix 2.0.5 - Cleartext ldap_bind_Password Password Disclosure (Metasploit)
Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console acces
23RISK
open ↗Exploit-DB
Samsung iPOLiS 1.12.2 - iPOLiS XnsSdkDeviceIpInstaller ActiveX WriteConfigValue (PoC)
Buffer overflow in the XnsSdkDeviceIpInstaller.ocx ActiveX control in Samsung iPOLiS Device Manager 1.12.2 allows remote
23RISK
open ↗Exploit-DB
Piwigo 2.7.3 - SQL Injection
SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to
23RISK
open ↗Exploit-DB
WordPress Plugin Duplicator 0.5.8 - Privilege Escalation
The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Publish-It 3.6d - Local Buffer Overflow (SEH)
Buffer overflow in Poster Software PUBLISH-iT 3.6d allows remote attackers to execute arbitrary code via a crafted PUI f
50RISK
open ↗Exploit-DB✓ VexDay Proof
Java JMX - Server Insecure Configuration Java Code Execution (Metasploit)
The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not r
60RISK
open ↗Exploit-DB
eTouch SamePage 4.4.0.0.239 - Multiple Vulnerabilities
SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitra
23RISK
open ↗Exploit-DB
eTouch SamePage 4.4.0.0.239 - Multiple Vulnerabilities
Directory traversal vulnerability in cm/newui/blog/export.jsp in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows r
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Fancybox 3.0.2 - Persistent Cross-Site Scripting
The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote atta
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.