Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,693cataloged exploits
40,332CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
Easy File Sharing Web Server 6.8 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Easy File Sharing Web Server 6.8 allows remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB
PMB 4.1.3 - (Authenticated) SQL Injection
SQL injection vulnerability in classes/mono_display.class.php in PMB 4.1.3 and earlier allows remote authenticated users
23RISK
open ↗Exploit-DB
WHM.AutoPilot < 2.4.6.5 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in header.php in WHM AutoPilot 2.4.6.5 and earlier allow remote atta
23RISK
open ↗Exploit-DB
WHM.AutoPilot < 2.4.6.5 - Multiple Vulnerabilities
Multiple PHP remote file inclusion vulnerabilities (1) step_one.php, (2) step_one_tables.php, (3) step_two_tables.php in
23RISK
open ↗Exploit-DB
WHM.AutoPilot < 2.4.6.5 - Multiple Vulnerabilities
WHM AutoPilot 2.4.6.5 and earlier allows remote attackers to gain sensitive information via phpinfo, which reveals php s
23RISK
open ↗Exploit-DB
NetIQ Access Manager 4.0 SP1 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote atta
23RISK
open ↗Exploit-DB
PHPMyRecipes 1.2.2 - 'browse.php?category' SQL Injection
SQL injection vulnerability in browse.php in phpMyRecipes 1.2.2 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Exploit-DB
GParted 0.14.1 - OS Command Execution
GParted before 0.15.0 allows local users to execute arbitrary commands with root privileges via shell metacharacters in
23RISK
open ↗Exploit-DB
SysAid Server - Arbitrary File Disclosure
Absolute path traversal vulnerability in SysAid On-Premise before 14.4.2 allows remote attackers to read arbitrary files
23RISK
open ↗Exploit-DB
NetIQ Access Manager 4.0 SP1 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers
23RISK
open ↗Exploit-DB
PsychoStats < 2.2.4 Beta - Cross Site Scripting
Cross-site scripting (XSS) vulnerability in login.php in PsychoStats 2.2.4 Beta and earlier allows remote attackers to i
23RISK
open ↗Exploit-DB✓ VexDay Proof
Notepad++ 6.6.9 - Buffer Overflow
Buffer overflow in NotePad++ 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Ev
28RISK
open ↗Exploit-DB
GQ File Manager 0.2.5 - Multiple Vulnerabilities
SQL injection vulnerability in incl/create.inc.php in Installatron GQ File Manager 0.2.5 allows remote attackers to exec
23RISK
open ↗Exploit-DB
Codiad 2.4.3 - Multiple Vulnerabilities
Directory traversal vulnerability in components/filemanager/download.php in Codiad 2.4.3 allows remote attackers to read
23RISK
open ↗Exploit-DB
ProjectSend r561 - Multiple Vulnerabilities
cFTP r80 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the
23RISK
open ↗Exploit-DB
Ettercap 0.8.0 < 0.8.1 - Multiple Denial of Service Vulnerabilities
Heap-based buffer overflow in the dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 a
28RISK
open ↗Exploit-DB
Codiad 2.4.3 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in components/filemanager/dialog.php in Codiad 2.4.3 allows remote attackers to
23RISK
open ↗Exploit-DB
Varnish Cache CLI Interface - Remote Code Execution (Metasploit)
The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy serve
50RISK
open ↗Exploit-DB
Cacti Superlinks Plugin 1.4-2 - SQL Injection / Local File Inclusion
SQL injection vulnerability in superlinks.php in the superlinks plugin 1.4-2 for Cacti allows remote attackers to execut
23RISK
open ↗Exploit-DB
ProjectSend r561 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB
MiniBB 3.1 - Blind SQL Injection
bb_func_unsub.php in MiniBB 3.1 before 20141127 uses an incorrect regular expression, which allows remote attackers to c
23RISK
open ↗Exploit-DB✓ VexDay Proof
GIT 1.8.5.6/1.9.5/2.0.5/2.1.4/2.2.1 & Mercurial < 3.2.3 - Multiple Vulnerabilities (Metasploit)
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
50RISK
open ↗Exploit-DB✓ VexDay Proof
GIT 1.8.5.6/1.9.5/2.0.5/2.1.4/2.2.1 & Mercurial < 3.2.3 - Multiple Vulnerabilities (Metasploit)
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
60RISK
open ↗Exploit-DB✓ VexDay Proof
Malwarebytes Anti-Malware < 2.0.3 / Anti-Exploit < 1.03.1.1220 - Update Code Execution (Metasploit)
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE)
43RISK
open ↗Exploit-DB
CMS Papoo 6.0.0 Rev. 4701 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in CMS Papoo Light 6.0.0 (Rev 4701) allow remote attackers to inject
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.