Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,974cataloged exploits
40,449CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,040VulnCheck XDB 10,108Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB✓ VexDay Proof
Command School Student Management System - '/sw/admin_media_codes_1.php?id' SQL Injection
Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to exe
23RISK
open ↗Exploit-DB✓ VexDay Proof
Command School Student Management System - '/sw/admin_infraction_codes.php?id' SQL Injection
Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to exe
23RISK
open ↗Exploit-DB✓ VexDay Proof
Command School Student Management System - '/sw/Admin_change_Password.php' Cross-Site Request Forgery (Admin Password Manipulation)
Multiple cross-site request forgery (CSRF) vulnerabilities in Command School Student Management System 1.06.01 allow rem
23RISK
open ↗Exploit-DB✓ VexDay Proof
Command School Student Management System - '/sw/admin_titles.php?id' SQL Injection
Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to exe
23RISK
open ↗Exploit-DB✓ VexDay Proof
Command School Student Management System - '/sw/admin_terms.php?id' SQL Injection
Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to exe
23RISK
open ↗Exploit-DB✓ VexDay Proof
Command School Student Management System - '/sw/add_topic.php' Cross-Site Request Forgery (Topic Creation)
Multiple cross-site request forgery (CSRF) vulnerabilities in Command School Student Management System 1.06.01 allow rem
23RISK
open ↗Exploit-DB✓ VexDay Proof
Command School Student Management System - '/sw/health_allergies.php?id' SQL Injection
Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to exe
23RISK
open ↗Exploit-DB✓ VexDay Proof
Command School Student Management System - '/sw/backup/backup_ray2.php' Database Backup Direct Request Information Disclosure
Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backup_ray2.php, which a
23RISK
open ↗Exploit-DB✓ VexDay Proof
IcoFX - Local Stack Buffer Overflow (Metasploit)
Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCoun
50RISK
open ↗Exploit-DB
Cubic CMS - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in Cubic CMS 5.1.1, 5.1.2, and 5.2 allow remote attackers to execute arbitrary SQ
23RISK
open ↗Exploit-DB✓ VexDay Proof
Command School Student Management System - '/sw/admin_generations.php?id' SQL Injection
Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to exe
23RISK
open ↗Exploit-DB✓ VexDay Proof
Command School Student Management System - '/sw/admin_grades.php?id' SQL Injection
Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to exe
23RISK
open ↗Exploit-DB
Seagate BlackArmor NAS - Privilege Escalation
Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via s
28RISK
open ↗Exploit-DB
Seagate BlackArmor NAS sg2000-2000.1331 - Remote Command Execution
Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via s
28RISK
open ↗Exploit-DB
Seagate BlackArmor NAS sg2000-2000.1331 - Multiple Persistent Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331
23RISK
open ↗Exploit-DB
Seagate BlackArmor NAS sg2000-2000.1331 - Cross-Site Request Forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in the Seagate BlackArmor NAS 220 devices with firmware sg200
23RISK
open ↗Exploit-DB
Taboada Macronews 1.0 - SQL Injection
SQL injection vulnerability in news_popup.php in Taboada MacroNews 1.0 allows remote authenticated users to execute arbi
23RISK
open ↗Exploit-DB
Nisuta NS-WIR150NE / NS-WIR300N Wireless Routers - Remote Management Web Interface Authentication Bypass
The management web interface on the Nisuta NS-WIR150NE router with firmware 5.07.41 and Nisuta NS-WIR300N router with fi
23RISK
open ↗Exploit-DB
Technicolor TC7200 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote att
23RISK
open ↗Exploit-DB
Technicolor TC7200 - Multiple Cross-Site Request Forgery Vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow rem
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache Libcloud Digital Ocean API - Local Information Disclosure
Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows loca
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Advanced Dewplayer - 'download-file.php' Script Directory Traversal
Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote
43RISK
open ↗Exploit-DB✓ VexDay Proof
CMS Afroditi - 'id' SQL Injection
SQL injection vulnerability in Naxtech CMS Afroditi 1.0 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Exploit-DB✓ VexDay Proof
JForum 'adminUsers' Module - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in admBase/login.page in the Admin module in JForum allows remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Synology DiskStation Manager - SLICEUPLOAD Remote Command Execution (Metasploit)
webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before
60RISK
open ↗Exploit-DB✓ VexDay Proof
RedHat CloudForms Management Engine 5.1 - agent/linuxpkgs Directory Traversal (Metasploit)
Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow re
50RISK
open ↗Exploit-DB✓ VexDay Proof
Zimbra Collaboration Server 7.2.2/8.0.2 - Local File Inclusion (Metasploit)
Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zim
60RISK
open ↗Exploit-DB
Synology DSM 4.3-3810 - Directory Traversal
Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before
28RISK
open ↗Exploit-DB✓ VexDay Proof
HP SiteScope issueSiebelCmd - Remote Code Execution (Metasploit)
The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authenti
60RISK
open ↗Exploit-DB✓ VexDay Proof
RealNetworks RealPlayer 16.0.3.51/16.0.2.32 - '.rmp' Version Attribute Buffer Overflow
Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before
50RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.