Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB✓ VexDay Proof
GNU Bash - Environment Variable Command Injection (Metasploit)
Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service o
23RISK
open ↗Exploit-DB
Cart Engine 3.0 - Multiple Vulnerabilities
SQL injection vulnerability in the sql_query function in cart.php in C97net Cart Engine before 4.0 allows remote attacke
23RISK
open ↗Exploit-DB
WordPress Plugin Login Widget With ShortCode 3.1.1 - Multiple Vulnerabilities
Cross-site request forgery (CSRF) vulnerability in the Login Widget With Shortcode (login-sidebar-widget) plugin before
23RISK
open ↗Exploit-DB✓ VexDay Proof
OSClass 3.4.1 - 'index.php' Local File Inclusion
Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot
43RISK
open ↗Exploit-DB✓ VexDay Proof
GNU Bash - 'Shellshock' Environment Variable Command Injection
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗Exploit-DB✓ VexDay Proof
Bash - 'Shellshock' Environment Variables Command Injection
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
100RISK
open ↗Exploit-DB
Cart Engine 3.0 - Multiple Vulnerabilities
Open redirect vulnerability in the redir function in includes/function.php in C97net Cart Engine before 4.0 allows remot
23RISK
open ↗Exploit-DB✓ VexDay Proof
GNU Bash - 'Shellshock' Environment Variable Command Injection
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
100RISK
open ↗Exploit-DB
webEdition 6.3.8.0 (SVN-Revision: 6985) - Directory Traversal
Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0 Beta allows remote authenticated
43RISK
open ↗Exploit-DB✓ VexDay Proof
Advantech Webaccess - dvs.ocx GetColor Buffer Overflow (Metasploit)
Advantech WebAccess Stack-Based Buffer Overflow
68RISK
open ↗Exploit-DB✓ VexDay Proof
EMC AlphaStor Device Manager Opcode 0x75 - Command Injection (Metasploit)
The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote
50RISK
open ↗Exploit-DB
Restaurant Script (PizzaInn Project) - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in register-exec.php in Restaurant Script (PizzaInn_Project) 1.0.0 a
23RISK
open ↗Exploit-DB✓ VexDay Proof
LittleSite 0.1 - 'index.php' Local File Inclusion
Directory traversal vulnerability in ls.php in LittleSite (aka LS or LittleSite.php) 0.1 allows remote attackers to incl
23RISK
open ↗Exploit-DB
M/Monit 3.3.2 - Cross-Site Request Forgery
M/Monit 3.3.2 and earlier does not verify the original password before changing passwords, which allows remote attackers
23RISK
open ↗Exploit-DB
ClassApps SelectSurvey.net - Multiple SQL Injections
Multiple SQL injection vulnerabilities in ClassApps SelectSurvey.NET before 4.125.002 allow (1) remote attackers to exec
23RISK
open ↗Exploit-DB
M/Monit 3.3.2 - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authe
23RISK
open ↗Exploit-DB
Livefyre LiveComments Plugin - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Livefyre LiveComments 3.0 allows remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Slideshow Gallery 1.4.6 - Arbitrary File Upload
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remot
60RISK
open ↗Exploit-DB✓ VexDay Proof
Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (1)
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗Exploit-DB✓ VexDay Proof
Aztech Routers - '/cgi-bin/AZ_Retrain.cgi' Denial of Service
cgi-bin/AZ_Retrain.cgi in Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices does not check for authentication,
28RISK
open ↗Exploit-DB✓ VexDay Proof
ManageEngine Eventlog Analyzer - Arbitrary File Upload (Metasploit)
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
60RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.