Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,902cataloged exploits
34,597CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,624GitHub PoC 13,727VulnCheck XDB 8,410Nuclei 4,231Metasploit 3,467✓ verified onlyrecentpopularrisk
21,624 exploits
Referência
CVE-2023-37759
Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticat
23RISK
open ↗Referência
CVE-2021-33570
Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can
23RISK
open ↗Referência
CVE-2021-33570
Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can
23RISK
open ↗Referência✓ VexDay Proof
PhpHostBot 1.06 - 'svr_rootscript' Remote File Inclusion
PHP remote file inclusion vulnerability in order/login.php in IDevSpot PhpHostBot 1.06 and earlier allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
e107 module 123 flash chat 6.8.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in 123flashchat.php in the 123 Flash Chat 6.8.0 module for e107, when register_g
23RISK
open ↗Referência✓ VexDay Proof
A-Link WL54AP3 / WL54AP2 - Cross-Site Request Forgery / Cross-Site Scripting
The management interface on the A-LINK WL54AP3 and WL54AP2 access points has a blank default password for the admin acco
23RISK
open ↗Referência
CVE-2018-18548
ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in Fi
23RISK
open ↗Referência
CVE-2018-18548
ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in Fi
23RISK
open ↗Referência
CVE-2010-2254
SQL injection vulnerability in the Shape5 Bridge of Hope template for Joomla! allows remote attackers to execute arbitra
23RISK
open ↗Referência
CVE-2010-2254
SQL injection vulnerability in the Shape5 Bridge of Hope template for Joomla! allows remote attackers to execute arbitra
23RISK
open ↗Referência
CVE-2012-4267
Cross-site scripting (XSS) vulnerability in user/register in Sockso 1.5 and earlier allows remote attackers to inject ar
23RISK
open ↗Referência
CVE-2006-0944
Archangel Weblog 0.90.02 allows remote attackers to bypass authentication by setting the ba_admin cookie to 1.
23RISK
open ↗Referência
CVE-2013-2760
Buffer overflow in Groovy Media Player 3.2.0 allows remote attackers to execute arbitrary code via a long string in a .m
23RISK
open ↗Referência
CVE-2014-4944
Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress al
23RISK
open ↗Referência
CVE-2015-2554
The kernel in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10
23RISK
open ↗Referência
CVE-2015-8261
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized
23RISK
open ↗Referência✓ VexDay Proof
FrontAccounting 1.13 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.13, when register_globals is enabled, allow
23RISK
open ↗Referência✓ VexDay Proof
MailBee Objects 5.5 - 'MailBee.dll' Remote Insecure Method
Multiple ActiveX controls in MailBee.dll in MailBee Objects 5.5 allow remote attackers to (1) overwrite arbitrary files
23RISK
open ↗Referência✓ VexDay Proof
Fast Click SQL 1.1.7 Lite - 'init.php' Remote File Inclusion
PHP remote file inclusion vulnerability in init.php in Fast Click SQL Lite 1.1.7, when register_globals is enabled, allo
23RISK
open ↗Referência✓ VexDay Proof
Creator CMS 5.0 - 'sideid' SQL Injection
Unrestricted file upload vulnerability in the file manager in Creative Mind Creator CMS 5.0 allows remote attackers to e
23RISK
open ↗Referência
CVE-2010-2257
SQL injection vulnerability in index_ie.php in Pay Per Minute Video Chat Script 2.0 and 2.1 allows remote attackers to e
23RISK
open ↗Referência
CVE-2010-2257
SQL injection vulnerability in index_ie.php in Pay Per Minute Video Chat Script 2.0 and 2.1 allows remote attackers to e
23RISK
open ↗Referência
b2evolution 6.11.6 - 'plugin name' Stored XSS
Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code execution
23RISK
open ↗Referência
CVE-2022-30076
ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames
33RISK
open ↗Referência✓ VexDay Proof
TFT Gallery 0.10 - Password Disclosure
TFT Gallery 0.10 stores sensitive information under the web root with insufficient access control, which allows remote a
23RISK
open ↗Referência✓ VexDay Proof
PHPMyDesk 1.0 Beta - 'viewticket.php' Local File Inclusion
Directory traversal vulnerability in pmd-config.php in PHPMyDesk 1.0beta allows remote attackers to include arbitrary lo
23RISK
open ↗Referência
CVE-2013-4948
SQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Referência
CVE-2013-4948
SQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Referência✓ VexDay Proof
Social Engine 2.0 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in Social Engine 2.0 allow remote attackers to include and execute arbitrar
23RISK
open ↗Referência
CVE-2018-25114
osCommerce 2.3.4.1 Installer Unauthenticated Configuration File Injection PHP Code Execution
63RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.