Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
19,067 exploits
Exploit-DB✓ VexDay Proof
PG Matchmaking - 'browse_men.php?show' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in PG MatchMaking allow remote attackers to inject arbitrary web scr
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPEcho CMS 2.0-rc3 - 'forum' Cross-Site Scripting Cookie Stealing / Blind SQL Injection
SQL injection vulnerability in index.php in the forum module in PHPEcho CMS 2.0-rc3 allows remote attackers to execute a
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPEcho CMS 2.0-rc3 - 'forum' Cross-Site Scripting Cookie Stealing / Blind SQL Injection
Cross-site scripting (XSS) vulnerability in PHPEcho CMS 2.0-rc3 allows remote attackers to inject arbitrary web script o
23RISK
open ↗Exploit-DB✓ VexDay Proof
XZeroScripts XZero Community Classifieds 4.97.8 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in index.php in XZero Community Classifieds 4.97.8 allow remote atta
23RISK
open ↗Exploit-DB✓ VexDay Proof
Pilot Group eTraining - 'courses_login.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Pilot Group (PG) eTraining allow remote attackers to inject arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
PG Matchmaking - 'browse_ladies.php?show' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in PG MatchMaking allow remote attackers to inject arbitrary web scr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Tribiq CMS 5.0.12c - Cross-Site Scripting / Local File Inclusion
Multiple directory traversal vulnerabilities in Tribiq CMS 5.0.12c, when register_globals is enabled and magic_quotes_gp
23RISK
open ↗Exploit-DB✓ VexDay Proof
Pilot Group eTraining - 'news_read.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Pilot Group (PG) eTraining allow remote attackers to inject arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
phpCollegeExchange 0.1.5c - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
Multiple PHP remote file inclusion vulnerabilities in phpCollegeExchange 0.1.5c, when register_globals is enabled, allow
23RISK
open ↗Exploit-DB✓ VexDay Proof
Zen Cart 1.3.8 - Remote Code Execution
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which a
35RISK
open ↗Exploit-DB✓ VexDay Proof
Zen Cart 1.3.8 - SQL Execution
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows
28RISK
open ↗Exploit-DB✓ VexDay Proof
phpCollegeExchange 0.1.5c - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in phpCollegeExchange 0.1.5c allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyBB 1.4.6 - Remote Code Execution
SQL injection vulnerability in inc/datahandlers/user.php in MyBB (aka MyBulletinBoard) before 1.4.7 allows remote authen
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kasseler CMS - File Disclosure / Cross-Site Scripting
Directory traversal vulnerability in engine.php in Kasseler CMS 1.3.5 lite allows remote attackers to read arbitrary fil
23RISK
open ↗Exploit-DB✓ VexDay Proof
phpMyAdmin - 'pmaPWN!' Code Injection / Remote Code Execution
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remo
100RISK
open ↗Exploit-DB✓ VexDay Proof
AWScripts Gallery Search Engine 1.x - Insecure Cookie
The admin interface in AWScripts.com Gallery Search Engine 1.5 allows remote attackers to bypass authentication and gain
23RISK
open ↗Exploit-DB✓ VexDay Proof
Bopup Communications Server 3.2.26.5460 - Remote SYSTEM
Stack-based buffer overflow in B Labs Bopup Communication Server 3.2.26.5460 allows remote attackers to execute arbitrar
50RISK
open ↗Exploit-DB✓ VexDay Proof
Kasseler CMS - File Disclosure / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in engine.php in Kasseler CMS allows remote attackers to inject arbitrary web s
23RISK
open ↗Exploit-DB✓ VexDay Proof
MIDAS 1.43 - (Authentication Bypass) Insecure Cookie Handling
MIDAS 1.43 allows remote attackers to bypass authentication and obtain administrative access via an admin account record
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 3.0.11 and Thunderbird 2.0.9 - RDF File Handling Remote Memory Corruption
The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before 3.0.12, SeaMonkey 2.0a1pre, and
28RISK
open ↗Exploit-DB✓ VexDay Proof
Programs Rating - 'postcomments.php?id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in YourFreeWorld Programs Rating Script allow remote attackers to in
23RISK
open ↗Exploit-DB✓ VexDay Proof
Programs Rating - 'rate.php?id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in YourFreeWorld Programs Rating Script allow remote attackers to in
23RISK
open ↗Exploit-DB✓ VexDay Proof
Edraw PDF Viewer Component < 3.2.0.126 - ActiveX Insecure Method
Insecure method vulnerability in the PDFVIEWER.PDFViewerCtrl.1 ActiveX control (pdfviewer.ocx) in Edraw PDF Viewer Compo
23RISK
open ↗Exploit-DB✓ VexDay Proof
DESlock+ 4.0.2 - 'dlpcrypt.sys' Local Kernel Ring0 Code Execution
The dlpcrypt.sys kernel driver 0.1.1.27 in DESlock+ 4.0.2 allows local users to gain privileges via a crafted IOCTL 0x80
23RISK
open ↗Exploit-DB✓ VexDay Proof
Compface 1.5.2 - '.xbm' Local Buffer Overflow (PoC)
Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a
23RISK
open ↗Exploit-DB✓ VexDay Proof
iDefense COMRaider - ActiveX Control Multiple Insecure Method Vulnerabilities
Multiple insecure method vulnerabilities in Idefense Labs COMRaider allow remote attackers to create or overwrite arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.30 - 'tun_chr_pool()' Null Pointer Dereference
The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -f
23RISK
open ↗Exploit-DB✓ VexDay Proof
Netgear DG632 Router - Remote Denial of Service
The administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to cause a denial o
23RISK
open ↗Exploit-DB✓ VexDay Proof
Netgear DG632 Router - Authentication Bypass
The administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to bypass authentic
23RISK
open ↗Exploit-DB✓ VexDay Proof
SugarCRM 5.2.0e - Remote Code Execution
Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.