Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,008cataloged exploits
34,638CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,662GitHub PoC 13,743VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB✓ VexDay Proof
phpList 2.10.18 - 'index.php' SQL Injection
SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
mailenable enterprise 6.5 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
OTRS Open Technology Real Services 3.1.4 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13,
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin postie 1.4.3 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the Postie plugin 1.4.3, and possibly before 1.5.15, for WordPress allows re
23RISK
open ↗Exploit-DB✓ VexDay Proof
smartermail free 9.2 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in SmarterMail 9.2 allow remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
T-dah Webmail Client 3.2.0-2.3 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in T-dah WebMail 3.2.0-2.3 allow remote attackers to inject arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin ThreeWP Email Reflector 1.13 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the ThreeWP Email Reflector plugin before 1.16 for WordPress allows remote a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alt-N MDaemon free 12.5.4 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
mailtraq 2.17.3.3150 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Mailtraq 2.17.3.3150 allow remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin mini mail Dashboard widget 1.42 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
afterlogic mailsuite pro (VMware Appliance) 6.3 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow remote attackers to inject arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
PBBoard - 'index.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
Surgemail 6.0a4 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in NetWin SurgeMail 6.0a4 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Proventia Network Mail Security System 2.5 - POST File Read
Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in IBM Lotus Protector for Mail
23RISK
open ↗Exploit-DB✓ VexDay Proof
winwebmail server 3.8.1.6 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in WinWebMail Server 3.8.1.6 allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin simplemail 1.0.6 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the WP SimpleMail plugin 1.0.6 for WordPress allow remote attacke
23RISK
open ↗Exploit-DB✓ VexDay Proof
xeams email server 4.4 build 5720 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Synametrics Technologies Xeams 4.4 Build 5720 allows remote attackers to inj
23RISK
open ↗Exploit-DB✓ VexDay Proof
PBBoard - 'admin.php?xml_name' Arbitrary PHP Code Execution
Unrestricted file upload vulnerability in admin.php in PBBoard 2.1.4 allows remote administrators to execute arbitrary P
23RISK
open ↗Exploit-DB✓ VexDay Proof
escon supportportal pro 3.0 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ESCON SupportPortal Professional Edition 3.0 allow remote attacke
23RISK
open ↗Exploit-DB✓ VexDay Proof
emailarchitect enterprise email server 10.0 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in EmailArchitect Email Server 10.0 and 10.0.0.3 allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
ManageEngine ServiceDesk Plus 8.1 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to injec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Axigen Mail Server 8.0.1 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Axigen Mail Server 8.0.1 allows remote attackers to inject arbitrary web scr
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Proventia Network Mail Security System 2.5 - POST File Read
Directory traversal vulnerability in javatester_init.php in IBM Lotus Protector for Mail Security 2.1, 2.5, 2.5.1, and 2
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dir2web - '/system/src/dispatcher.php?oid' SQL Injection
SQL injection vulnerability in system/src/dispatcher.php in Dir2web 3.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alligra Calligra - Heap Buffer Overflow
Heap-based buffer overflow in the read function in filters/words/msword-odf/wv2/src/styles.cpp in the Microsoft import f
28RISK
open ↗Exploit-DB✓ VexDay Proof
TCExam 11.2.x - '/admin/code/tce_edit_question.php?subject_module_id' SQL Injection
Multiple SQL injection vulnerabilities in TCExam before 11.3.008 allow remote authenticated users with level 5 or greate
23RISK
open ↗Exploit-DB✓ VexDay Proof
TCExam 11.2.x - '/admin/code/tce_edit_answer.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in TCExam before 11.3.008 allow remote authenticated users with level 5 or greate
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle AutoVue - ActiveX Control SetMarkupMode Buffer Overflow (Metasploit)
Unspecified vulnerability in the Oracle AutoVue Office component in Oracle Supply Chain Products Suite 20.1.1 allows rem
50RISK
open ↗Exploit-DB✓ VexDay Proof
Open Constructor - 'confirm.php?q' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Open Constructor 3.12.0 allow remote attackers to inject arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Open Constructor - '/users/users.php?keyword' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Open Constructor 3.12.0 allow remote attackers to inject arbitrar
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.