Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,900cataloged exploits
36,847CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,475Referência 23,360GitHub PoC 15,228VulnCheck XDB 8,946Nuclei 4,390Metasploit 3,501✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
Adobe (Multiple Products) - XML External Entity / XML Injection
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Service
100RISK
open ↗Exploit-DB✓ VexDay Proof
TimeClock 0.99 - Cross-Site Request Forgery (Add Admin)
Cross-site request forgery (CSRF) vulnerability in add_user.php in Employee Timeclock Software 0.99 allows remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component com_communitypolls 1.5.2 - Local File Inclusion
Directory traversal vulnerability in the Community Polls (com_communitypolls) component 1.5.2, and possibly earlier, for
43RISK
open ↗Exploit-DB✓ VexDay Proof
WSC CMS - Authentication Bypass
SQL injection vulnerability in backoffice/login.asp in Dynamicsoft WSC CMS 2.2 allows remote attackers to execute arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Plugin Core Design Scriptegrator - Local File Inclusion
Directory traversal vulnerability in plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php in the Core Desi
43RISK
open ↗Exploit-DB✓ VexDay Proof
Subex Nikira Fraud Management System GUI - 'message' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the login/prompt component in Subex Nikira Fraud Management System allows re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Plugin Core Design Scriptegrator - Local File Inclusion
Multiple directory traversal vulnerabilities in the Core Design Scriptegrator plugin 1.4.1 for Joomla! allow remote atta
23RISK
open ↗Exploit-DB✓ VexDay Proof
XlentProjects SphereCMS 1.1 - 'archive.php' SQL Injection
SQL injection vulnerability in archive.php in XlentProjects SphereCMS 1.1 alpha allows remote attackers to execute arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
PortWise SSL VPN 4.6 - 'reloadFrame' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in wa/auth in PortWise SSL VPN 4.6 allows remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple iTunes 9.0.1 - '.pls' Handling Buffer Overflow
Buffer overflow in Apple iTunes before 9.0.1 allows remote attackers to execute arbitrary code or cause a denial of serv
23RISK
open ↗Exploit-DB✓ VexDay Proof
Erotik Auktionshaus - 'news.php' SQL Injection
SQL injection vulnerability in news.php in Erotik Auktionshaus allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
Auktionshaus Gelb 3 - 'news.php' SQL Injection
SQL injection vulnerability in news.php in Auktionshaus Gelb 3.0 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗Exploit-DB✓ VexDay Proof
Symantec (Multiple Products) - Client Proxy ActiveX 'CLIproxy.dll' Remote Overflow
Buffer overflow in the cliproxy.objects.1 ActiveX control in the Symantec Client Proxy (CLIproxy.dll) in Symantec AntiVi
28RISK
open ↗Exploit-DB✓ VexDay Proof
BGSvetionik BGS CMS - 'search' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in BGSvetionik BGS CMS 2.2.1 allows remote attackers to inject arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
Pogodny CMS - SQL Injection
SQL injection vulnerability in index.php in KR MEDIA Pogodny CMS allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alt-N WebAdmin - USER Buffer Overflow (Metasploit)
Buffer overflow in WebAdmin.exe for WebAdmin allows remote attackers to execute arbitrary code via an HTTP request to We
50RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Copperleaf Photolog 0.16 - SQL Injection
SQL injection vulnerability in cplphoto.php in the Copperleaf Photolog plugin 0.16, and possibly earlier, for WordPress
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache mod_rewrite - LDAP protocol Buffer Overflow (Metasploit)
Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and o
60RISK
open ↗Exploit-DB✓ VexDay Proof
JTL-Shop 2 - 'druckansicht.php' SQL Injection
SQL injection vulnerability in druckansicht.php in JTL-Shop 2 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
Katalog Stron Hurricane 1.3.5 - Remote File Inclusion / SQL Injection
SQL injection vulnerability in index.php in Katalog Stron Hurricane 1.3.5, and possibly earlier, allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
Katalog Stron Hurricane 1.3.5 - Remote File Inclusion / SQL Injection
PHP remote file inclusion vulnerability in includes/moderation.php in Katalog Stron Hurricane 1.3.5, and possibly earlie
23RISK
open ↗Exploit-DB✓ VexDay Proof
statcountex 3.1 - Multiple Vulnerabilities
StatCounteX 3.0 and 3.1 allows remote attackers to obtain sensitive information and edit configuration scripts via a dir
23RISK
open ↗Exploit-DB✓ VexDay Proof
statcountex 3.1 - Multiple Vulnerabilities
StatCounteX 3.1 stores sensitive information under the web root with insufficient access control, which allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
WSN Guest 1.02 - 'orderlinks' SQL Injection
SQL injection vulnerability in index.php in WSN Guest 1.02 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sambar Server 6 - Search Results Buffer Overflow (Metasploit)
Stack-based buffer overflow in results.stm for Sambar Server before the 6.0 production release allows remote attackers t
60RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Core 2.9 - Failure to Restrict URL Access
WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request
23RISK
open ↗Exploit-DB✓ VexDay Proof
ZeusCMS 0.2 - Database Backup Dump / Local File Inclusion
ZeusCMS 0.2 stores sensitive information under the web root with insufficient access control, which allows remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
ZeusCMS 0.2 - Database Backup Dump / Local File Inclusion
Directory traversal vulnerability in index.php in ZeusCMS 0.2 allows remote attackers to include and execute arbitrary l
23RISK
open ↗Exploit-DB✓ VexDay Proof
Basic-CMS - 'nav_id' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in pages/index.php in BASIC-CMS allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Video Games Rentals Script - SQL Injection
SQL injection vulnerability in index.php in CommodityRentals Video Games Rentals allows remote attackers to execute arbi
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.