Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,526cataloged exploits
34,478CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,534GitHub PoC 13,654VulnCheck XDB 8,213Nuclei 4,218Metasploit 3,464✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB✓ VexDay Proof
VTLS Virtua InfoStation.cgi - SQL Injection
Multiple SQL injection vulnerabilities in the login in web_reports/cgi-bin/InfoStation.cgi in Innovative vtls-Virtua bef
23RISK
open ↗Exploit-DB✓ VexDay Proof
ManageEngine Password Manager - MetadataServlet.dat SQL Injection (Metasploit)
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central
50RISK
open ↗Exploit-DB
Innovaphone PBX Admin-GUI - Cross-Site Request Forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in innovaphone PBX 10.00 sr11 and earlier allow remote attack
23RISK
open ↗Exploit-DB
LiveWorld Multiple Products - Cross Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in LiveWorld products, possibly including (1) LiveForum, (2) LiveQ&A
23RISK
open ↗Exploit-DB✓ VexDay Proof
ArticleFR - 'id' SQL Injection
Multiple SQL injection vulnerabilities in Free Reprintables ArticleFR 3.0.4 and earlier allow remote attackers to execut
23RISK
open ↗Exploit-DB✓ VexDay Proof
ManageEngine Password Manager Pro / ManageEngine IT360 - SQL Injection
SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manag
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin WP Content Source Control - 'download.php' Directory Traversal
Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Sour
43RISK
open ↗Exploit-DB✓ VexDay Proof
Gitlab-shell - Code Execution (Metasploit)
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
50RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox - toString console.time Privileged JavaScript Injection (Metasploit)
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbi
28RISK
open ↗Exploit-DB
Tenda A5s Router 3.02.05_CN - Authentication Bypass
The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05_CN allows remote attackers to bypass authentication
28RISK
open ↗Exploit-DB
VMTurbo Operations Manager 4.6 - 'vmtadmin.cgi' Remote Command Execution (Metasploit)
vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands
60RISK
open ↗Exploit-DB
Alienvault Open Source SIEM (OSSIM) < 4.7.0 - 'get_license' Remote Command Execution (Metasploit)
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a
28RISK
open ↗Exploit-DB
WordPress Plugin Disqus 2.7.5 - Cross-Site Request Forgery (Admin Persistent) / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress al
23RISK
open ↗Exploit-DB
WordPress Plugin Disqus 2.7.5 - Cross-Site Request Forgery (Admin Persistent) / Cross-Site Scripting
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress
23RISK
open ↗Exploit-DB
WordPress Plugin Disqus 2.7.5 - Cross-Site Request Forgery (Admin Persistent) / Cross-Site Scripting
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle VM VirtualBox 4.3.6 - 3D Acceleration Virtual Machine Escape (Metasploit)
Blue Coat Malware Analysis Appliance (MAA) before 4.2.5 and Malware Analyzer G2 allow remote attackers to bypass a virtu
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle VM VirtualBox 4.3.6 - 3D Acceleration Virtual Machine Escape (Metasploit)
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/s
38RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle VM VirtualBox Guest Additions 4.3.10r93012 - 'VBoxGuest.sys' Local Privilege Escalation (Metasploit)
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.2
38RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin GB Gallery Slideshow - '/wp-admin/admin-ajax.php' SQL Injection
SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administ
23RISK
open ↗Exploit-DB
TomatoCart 1.x - SQL Injection
SQL injection vulnerability in TomatoCart 1.1.8.6.1 allows remote authenticated users to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB
Pro Chat Rooms 8.2.0 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote au
23RISK
open ↗Exploit-DB
Pro Chat Rooms 8.2.0 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated u
23RISK
open ↗Exploit-DB✓ VexDay Proof
Symantec Endpoint Protection 11.x/12.x - Kernel Pool Overflow / Local Privilege Escalation
Buffer overflow in the sysplant driver in Symantec Endpoint Protection (SEP) Client 11.x and 12.x before 12.1 RU4 MP1b,
23RISK
open ↗Exploit-DB
Status2k Server Monitoring Software - Multiple Vulnerabilities
Status2k does not remove the install directory allowing credential reset.
23RISK
open ↗Exploit-DB
Status2k Server Monitoring Software - Multiple Vulnerabilities
Status2k allows Remote Command Execution in admin/options/editpl.php.
23RISK
open ↗Exploit-DB
Sphider Search Engine - Multiple Vulnerabilities
A Command Execution vulnerability exists in Sphider Pro, and Sphider Plus 3.2 due to insufficient sanitization of fwrite
23RISK
open ↗Exploit-DB
ArticleFR 11.06.2014 - 'data.php' Privilege Escalation
A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restric
28RISK
open ↗Exploit-DB
Status2k Server Monitoring Software - Multiple Vulnerabilities
A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, wh
28RISK
open ↗Exploit-DB
Sphider Search Engine - Multiple Vulnerabilities
A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite, which could let
23RISK
open ↗Exploit-DB
Status2k Server Monitoring Software - Multiple Vulnerabilities
SQL injection vulnerability in admin/options/logs.php in Status2k allows remote authenticated administrators to execute
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.