Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,902cataloged exploits
34,597CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,624GitHub PoC 13,727VulnCheck XDB 8,410Nuclei 4,231Metasploit 3,467✓ verified onlyrecentpopularrisk
21,581 exploits
Referência✓ VexDay Proof
TutorialCMS 1.01 - Authentication Bypass
TutorialCMS 1.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication via the
23RISK
open ↗Referência✓ VexDay Proof
Zenturi NixonMyPrograms Class 'sasatl.dll 1.5.0.531' - Remote Buffer Overflow
Buffer overflow in a certain ActiveX control in the NixonMyPrograms class in sasatl.dll 1.5.0.531 in Zenturi ProgramChec
23RISK
open ↗Referência✓ VexDay Proof
Drupal 5.2 - PHP Zend Hash ation Vector
Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value m
23RISK
open ↗Referência✓ VexDay Proof
jspwiki 2.4.104/2.5.139 - Multiple Vulnerabilities
Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbi
23RISK
open ↗Referência
CVE-2023-23162
Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter
23RISK
open ↗Referência
CVE-2010-1708
Multiple SQL injection vulnerabilities in agentadmin.php in Free Realty allow remote attackers to execute arbitrary SQL
23RISK
open ↗Referência
CVE-2018-6024
SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.
23RISK
open ↗Referência
CVE-2018-6024
SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.
23RISK
open ↗Referência
CVE-2013-6343
Multiple buffer overflows in web.c in httpd on the ASUS RT-N56U and RT-AC66U routers with firmware 3.0.0.4.374_979 allow
23RISK
open ↗Referência
CVE-2010-1714
Directory traversal vulnerability in the Arcade Games (com_arcadegames) component 1.0 for Joomla! allows remote attacker
43RISK
open ↗Referência
CVE-2017-11662
The _WM_ParseNewMidi function in f_midi.c in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and appli
23RISK
open ↗Referência
CVE-2020-15930
An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.
23RISK
open ↗Referência
CVE-2010-1715
Directory traversal vulnerability in the Online Examination (aka Online Exam or com_onlineexam) component 1.5.0 for Joom
38RISK
open ↗Referência
CVE-2010-1725
SQL injection vulnerability in offers_buy.php in Alibaba Clone Platinum allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência
CVE-2010-1725
SQL injection vulnerability in offers_buy.php in Alibaba Clone Platinum allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência
CVE-2024-53584
OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter.
48RISK
open ↗Referência✓ VexDay Proof
OpenBASE 0.6a - 'root_prefix' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in OpenBASE Alpha 0.6 allow remote attackers to execute arbitrary PHP
23RISK
open ↗Referência
CVE-2017-17591
Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter.
23RISK
open ↗Referência
CVE-2017-17591
Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter.
23RISK
open ↗Referência
CVE-2014-100003
SQL injection vulnerability in includes/ym-download_functions.include.php in the Code Futures YourMembers plugin for Wor
23RISK
open ↗Referência
CVE-2014-100003
SQL injection vulnerability in includes/ym-download_functions.include.php in the Code Futures YourMembers plugin for Wor
23RISK
open ↗Referência✓ VexDay Proof
Musoo 0.21 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Musoo 0.21 allow remote attackers to execute arbitrary PHP code vi
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component wmtportfolio 1.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.wmtportfolio.php in the webmaster-tips.net wmtportfolio 1.0 (com_wmtpor
23RISK
open ↗Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
inc_newuser.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to change the permis
23RISK
open ↗Referência✓ VexDay Proof
PicoFlat CMS 0.4.14 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in PicoFlat CMS 0.4.14 and earlier allows remote attackers to execu
23RISK
open ↗Referência
CVE-2018-11564
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature.
23RISK
open ↗Referência
CVE-2018-11564
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature.
23RISK
open ↗Referência
CVE-2021-29447
WordPress Authenticated XXE attack when installation is running PHP 8
63RISK
open ↗Referência
CVE-2014-9258
SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to exec
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.