Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
80,043cataloged exploits
36,945CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,476Referência 23,442GitHub PoC 15,260VulnCheck XDB 8,970Nuclei 4,393Metasploit 3,502✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
PHP Email Manager - 'remove.php?ID' SQL Injection
SQL injection vulnerability in remove.php in PHP eMail Manager 3.3.0 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Exploit-DB✓ VexDay Proof
vTiger CRM 5.0.4 - Remote Code Execution / Cross-Site Request Forgery / Local File Inclusion / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the Activities module in vtiger CRM 5.0.4 allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
phpfreeBB 1.0 - Blind SQL Injection
Multiple SQL injection vulnerabilities in phpfreeBB 1.0 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freelancers - 'post_resume.php?jobid' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Freelancers 1.0 allow remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe ColdFusion Server 8.0.1 - '/wizards/common/_authenticatewizarduser.cfm' Query String Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attack
43RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe ColdFusion Server 8.0.1 - '/administrator/enter.cfm' Query String Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attack
43RISK
open ↗Exploit-DB✓ VexDay Proof
Freelancers - 'placebid.php?id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Freelancers 1.0 allow remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe ColdFusion Server 8.0.1 - '/wizards/common/_logintowizard.cfm' Query String Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attack
43RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe ColdFusion Server 8.0.1 - 'administrator/logviewer/searchlog.cfm?startRow' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attack
43RISK
open ↗Exploit-DB✓ VexDay Proof
Discuz! 6.0 - '2fly_gift.php' SQL Injection
SQL injection vulnerability in 2fly_gift.php in 2FLY Gift Delivery System 6.0 allows remote attackers to execute arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.x (RedHat) - 'sock_sendpage()' Ring0 Privilege Escalation (1)
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socke
43RISK
open ↗Exploit-DB✓ VexDay Proof
DS CMS 1.0 - 'nFileId' SQL Injection
SQL injection vulnerability in DetailFile.php in DigitalSpinners DS CMS 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.x - 'sock_sendpage()' Local Privilege Escalation (4)
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socke
43RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Competition System 0.84 - 'competition' SQL Injection
Multiple SQL injection vulnerabilities in PHP Competition System BETA 0.84 and earlier allow remote attackers to execute
23RISK
open ↗Exploit-DB✓ VexDay Proof
tgs CMS 0.x - Cross-Site Scripting / SQL Injection / File Disclosure
Multiple SQL injection vulnerabilities in TGS Content Management 0.x allow remote attackers to execute arbitrary SQL com
23RISK
open ↗Exploit-DB✓ VexDay Proof
tgs CMS 0.x - Cross-Site Scripting / SQL Injection / File Disclosure
Cross-site scripting (XSS) vulnerability in login.php in TGS Content Management 0.x allows remote attackers to inject ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Elkagroup Elkapax - 'q' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the Search feature in elka CMS (aka Elkapax) allows remote attackers to inje
23RISK
open ↗Exploit-DB✓ VexDay Proof
pIPL 2.5.0 - '.PLS' / '.PL' Universal Local Buffer (SEH)
Multiple stack-based buffer overflows in xaudio.dll in Programmed Integration PIPL 2.5.0 and 2.5.0D allow remote attacke
28RISK
open ↗Exploit-DB✓ VexDay Proof
Gazelle CMS 1.0 - Arbitrary File Upload
Unrestricted file upload vulnerability in admin/editor/filemanager/browser.html in Anantasoft Gazelle CMS 1.0 allows rem
23RISK
open ↗Exploit-DB✓ VexDay Proof
Plume CMS 1.2.3 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Plume CMS 1.2.3 allow (1) remote authenticated users to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
Gazelle CMS 1.0 - Multiple Vulnerabilities / Remote Code Execution
Unrestricted file upload vulnerability in admin/editor/filemanager/browser.html in Anantasoft Gazelle CMS 1.0 allows rem
23RISK
open ↗Exploit-DB✓ VexDay Proof
Easy Music Player 1.0.0.2 - 'wav' Universal Local Buffer (SEH) (3)
Stack-based buffer overflow in Easy Music Player 1.0.0.2 allows remote attackers to execute arbitrary code via a crafted
23RISK
open ↗Exploit-DB✓ VexDay Proof
Gazelle CMS 1.0 - Multiple Vulnerabilities / Remote Code Execution
Multiple cross-site scripting (XSS) vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Gazelle CMS 1.0 - Multiple Vulnerabilities / Remote Code Execution
Directory traversal vulnerability in Anantasoft Gazelle CMS 1.0 allows remote attackers to overwrite arbitrary files via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Gazelle CMS 1.0 - Multiple Vulnerabilities / Remote Code Execution
Directory traversal vulnerability in index.php in Anantasoft Gazelle CMS 1.0, when magic_quotes_gpc is disabled, allows
23RISK
open ↗Exploit-DB✓ VexDay Proof
Gazelle CMS 1.0 - Multiple Vulnerabilities / Remote Code Execution
Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users via a modified user param
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebKit - Floating Point Number Remote Buffer Overflow
Buffer overflow in WebKit in Apple Safari before 4.0.3 allows remote attackers to execute arbitrary code or cause a deni
28RISK
open ↗Exploit-DB✓ VexDay Proof
Easy Music Player 1.0.0.2 - 'wav' Universal Local Buffer (SEH) (2)
Stack-based buffer overflow in Easy Music Player 1.0.0.2 allows remote attackers to execute arbitrary code via a crafted
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component idoblog 1.1b30 (com_idoblog) - SQL Injection
SQL injection vulnerability in the IDoBlog (com_idoblog) component 1.1 build 30 for Joomla! allows remote attackers to e
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Core 2.8.3 - Remote Admin Reset Password
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.