Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
26,190 exploits
Referência✓ VexDay Proof
Joomla! Component iDoBlog b24 - SQL Injection
SQL injection vulnerability in the IDoBlog (com_idoblog) component b24 and earlier and 1.0, a component for Joomla!, all
23RISK
open ↗Referência
CVE-2010-5040
PHP remote file inclusion vulnerability in nucleus/plugins/NP_gallery.php in the NP_Gallery plugin 0.94 for Nucleus allo
23RISK
open ↗Referência✓ VexDay Proof
Post Affiliate Pro 2.0 - 'md' Local File Inclusion
Directory traversal vulnerability in index.php in Post Affiliate Pro 2.0 allows remote authenticated users to read and p
23RISK
open ↗Referência✓ VexDay Proof
PHPcounter 1.3.2 - 'defs.php' Local File Inclusion
Directory traversal vulnerability in defs.php in PHPcounter 1.3.2 and earlier, when magic_quotes_gpc is disabled, allows
23RISK
open ↗Referência✓ VexDay Proof
PHPmyGallery 1.0beta2 - Local/Remote File Inclusion
PHP remote file inclusion vulnerability in _conf/core/common-tpl-vars.php in PHPmyGallery 1.0 beta2 allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
CMSbright - 'id_rub_page' SQL Injection
SQL injection vulnerability in public/page.php in Websens CMSbright allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
PHPRunner 4.2 - 'SearchOption' Blind SQL Injection
Multiple SQL injection vulnerabilities in PHPRunner 4.2, and possibly earlier, allow remote attackers to execute arbitra
23RISK
open ↗Referência
CVE-2010-1346
SQL injection vulnerability in admin/login.php in Mini CMS RibaFS 1.0, when magic_quotes_gpc is disabled, allows remote
23RISK
open ↗Referência✓ VexDay Proof
Teraway LiveHelp 2.0 - Insecure Cookie Handling
Teraway LiveHelp 2.0 allows remote attackers to bypass authentication and gain administrative access via a pwd=&lvl=1&us
23RISK
open ↗Referência
CVE-2009-2393
admin/index.php in Virtuenetz Virtue Online Test Generator does not require administrative privileges, which allows remo
23RISK
open ↗Referência
CVE-2010-1363
SQL injection vulnerability in the JProjects (com_j-projects) component for Joomla! allows remote attackers to execute a
23RISK
open ↗Referência
CVE-2011-5109
Multiple SQL injection vulnerabilities in Freelancer calendar 1.01 and earlier allow remote attackers to inject arbitrar
23RISK
open ↗Referência
CVE-2015-5889
rsh in the remote_cmds component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors inv
38RISK
open ↗Referência✓ VexDay Proof
XOOPS 2.0.18 - Local File Inclusion / URL Redirecting
Open redirect vulnerability in htdocs/user.php in XOOPS 2.0.18 allows remote attackers to redirect users to arbitrary we
23RISK
open ↗Referência✓ VexDay Proof
IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow (PoC)
Stack-based buffer overflow in the HTML parser in IntelliTamper 2.0.7 allows remote attackers to execute arbitrary code
23RISK
open ↗Referência✓ VexDay Proof
Zeeways Shaadi Clone 2.0 - Authentication Bypass (1)
Zeeways SHAADICLONE 2.0 allows remote attackers to bypass authentication and gain administrative privileges via a direct
23RISK
open ↗Referência✓ VexDay Proof
beLive 0.2.3 - 'arch.php?arch' Local File Inclusion
Directory traversal vulnerability in arch.php in beLive 0.2.3 allows remote attackers to read arbitrary files via a .. (
23RISK
open ↗Referência
CVE-2010-3479
SQL injection vulnerability in list.php in BoutikOne 1.0 allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Referência
CVE-2010-3479
SQL injection vulnerability in list.php in BoutikOne 1.0 allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Referência
CVE-2010-4780
SQL injection vulnerability in the check_banlist function in includes/sessions.php in Enano CMS 1.1.7pl1; 1.0.6pl2; and
23RISK
open ↗Referência
CVE-2010-4780
SQL injection vulnerability in the check_banlist function in includes/sessions.php in Enano CMS 1.1.7pl1; 1.0.6pl2; and
23RISK
open ↗Referência
CVE-2011-0510
SQL injection vulnerability in cart.php in Advanced Webhost Billing System (AWBS) 2.9.2 and possibly earlier allows remo
23RISK
open ↗Referência
CVE-2009-4986
Directory traversal vulnerability in index.php in In-Portal 4.3.1, when magic_quotes_gpc is disabled, allows remote atta
23RISK
open ↗Referência
CVE-2010-1338
SQL injection vulnerability in ts_other.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows
23RISK
open ↗Referência
CVE-2010-1338
SQL injection vulnerability in ts_other.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows
23RISK
open ↗Referência
CVE-2018-13108
All ADB broadband gateways / routers based on the Epicentro platform are affected by a local root jailbreak vulnerabilit
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.