Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
24,696 exploits
Exploit-DB✓ VexDay Proof
Easy Music Player 1.0.0.2 - 'wav' Universal Local Buffer (SEH) (2)
Stack-based buffer overflow in Easy Music Player 1.0.0.2 allows remote attackers to execute arbitrary code via a crafted
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Server 2003 - '.EOT' Blue Screen of Death Crash
win32k.sys in Microsoft Windows Server 2003 SP2 allows remote attackers to cause a denial of service (system crash) by r
28RISK
open ↗Exploit-DB✓ VexDay Proof
WebKit - Floating Point Number Remote Buffer Overflow
Buffer overflow in WebKit in Apple Safari before 4.0.3 allows remote attackers to execute arbitrary code or cause a deni
28RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Core 2.8.3 - Remote Admin Reset Password
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the
28RISK
open ↗Exploit-DB✓ VexDay Proof
ViArt CMS - 'forums.php?category_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ViArt CMS 3.x allow remote attackers to inject arbitrary web scri
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.2.10/5.3 - 'ini_restore()' Memory Information Disclosure (1)
The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific
23RISK
open ↗Exploit-DB✓ VexDay Proof
ViArt CMS - 'forum.php?forum_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ViArt CMS 3.x allow remote attackers to inject arbitrary web scri
23RISK
open ↗Exploit-DB✓ VexDay Proof
SQLiteManager 1.2 - 'main.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in SQLiteManager 1.2.0 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
ViArt Helpdesk - 'products.php?category_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ViArt Helpdesk 3.x allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
ViArt Helpdesk - 'reviews.php?category_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ViArt Helpdesk 3.x allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
ViArt Helpdesk - 'product_details.php?category_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ViArt Helpdesk 3.x allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
ViArt Helpdesk - 'products_search.php?search_category_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ViArt Helpdesk 3.x allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Hitron Soft Answer Me - 'answers.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Hitron Soft Answer Me 1.0 allows remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
ViArt CMS - 'forum_topic_new.php?forum_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ViArt CMS 3.x allow remote attackers to inject arbitrary web scri
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Kunena Forums (com_kunena) - Blind SQL Injection
SQL injection vulnerability in the Kunena Forum (com_kunena) component 1.5.3 and 1.5.4 for Joomla! allows remote attacke
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mini-CMS 1.0.1 - 'page.php' SQL Injection
SQL injection vulnerability in page.php in Mini CMS 1.0.1 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.2.10/5.3 - 'ini_restore()' Memory Information Disclosure (2)
The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific
23RISK
open ↗Exploit-DB✓ VexDay Proof
ViArt Helpdesk - 'forum.php?forum_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ViArt Helpdesk 3.x allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
ViArt Helpdesk - 'article.php?category_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ViArt Helpdesk 3.x allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
TurnkeyForms Yahoo Answers Clone - 'questiondetail.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in questiondetail.php in Yahoo Answers Clone allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
Logoshows BBS 2.0 - 'forumid' SQL Injection
SQL injection vulnerability in globepersonnel_forum.asp in Logoshows BBS 2.0 allows remote attackers to execute arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Easy Shopping Cart 3.1R - 'subitems.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in subitems.php in PHP Easy Shopping Cart 3.1R allows remote attackers to injec
23RISK
open ↗Exploit-DB✓ VexDay Proof
logoshows bbs 2.0 - File Disclosure / Insecure Cookie Handling
Logoshows BBS 2.0 stores sensitive information under the web root with insufficient access control, which allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alwasel 1.5 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Alwasel 1.5 allow remote attackers to execute arbitrary SQL commands via the i
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Photo Vote 1.3F - 'page' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in login.php in PHP Photo Vote 1.3F allows remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Facil Helpdesk - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in kbase/kbase.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows rem
23RISK
open ↗Exploit-DB✓ VexDay Proof
Logoshows BBS 2.0 - Authentication Bypass
Multiple SQL injection vulnerabilities in globepersonnel_login.asp in Logoshows BBS 2.0 allow remote attackers to execut
23RISK
open ↗Exploit-DB✓ VexDay Proof
Steam 54/894 - Local Privilege Escalation
Valve Steam 2.10.91.91 uses weak permissions (Users: read and write) for the Install folder, which allows local users to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Banner Exchange Script 1.0 - 'targetid' Blind SQL Injection
SQL injection vulnerability in click.php in e-soft24 Banner Exchange Script 1.0 allows remote attackers to execute arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Facil Helpdesk - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
PHP remote file inclusion vulnerability in index.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote att
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.