Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
80,184cataloged exploits
37,029CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,476Referência 23,521GitHub PoC 15,321VulnCheck XDB 8,970Nuclei 4,394Metasploit 3,502✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
XRms 1.99.2 - 'case_title' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in XRMS allow remote attackers to inject arbitrary web script or HTM
23RISK
open ↗Exploit-DB✓ VexDay Proof
CeleronDude Uploader 6.1 - 'account.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in account.php in Celerondude Uploader 6.1 allows remote attackers to inject ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
eliteCMS 1.0 - 'page' SQL Injection
SQL injection vulnerability in index.php in eliteCMS 1.0 allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Google Chrome 0.2.149 - Malformed 'title' Tag Remote Denial of Service
The tooltip manager (chrome/views/tooltip_manager.cc) in Google Chrome 0.2.149.29 Build 1798 and possibly other versions
23RISK
open ↗Exploit-DB✓ VexDay Proof
Softalk Mail Server 8.5.1 - 'APPEND' Remote Denial of Service
The IMAP server in Softalk Mail Server (formerly WorkgroupMail) 8.5.1.431 allows remote authenticated users to cause a d
23RISK
open ↗Exploit-DB✓ VexDay Proof
IDevSpot BizDirectory 2.04 - 'page' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in BizDirectory 2.04 and earlier allows remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
UBBCentral UBB.Threads 7.3.1 - 'Forum[]' Array SQL Injection
SQL injection vulnerability in dosearch.inc.php in UBB.threads 7.3.1 and earlier allows remote attackers to execute arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
vTiger CRM 5.0.4 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web s
23RISK
open ↗Exploit-DB✓ VexDay Proof
Full PHP Emlak Script - 'landsee.php' SQL Injection
SQL injection vulnerability in landsee.php in Full PHP Emlak Script allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Exploit-DB✓ VexDay Proof
OpenDB 1.0.6 - 'user_profile.php?redirect_url' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Open Media Collectors Database (OpenDb) 1.0.6 allow remote attack
33RISK
open ↗Exploit-DB✓ VexDay Proof
OpenDB 1.0.6 - 'user_admin.php?user_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Open Media Collectors Database (OpenDb) 1.0.6 allow remote attack
33RISK
open ↗Exploit-DB✓ VexDay Proof
OpenDB 1.0.6 - 'listings.php?title' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Open Media Collectors Database (OpenDb) 1.0.6 allow remote attack
33RISK
open ↗Exploit-DB✓ VexDay Proof
RedHat 8/9 - Directory Server Crafted Search Pattern Denial of Service
Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 allow remote atta
23RISK
open ↗Exploit-DB✓ VexDay Proof
Smart Survey 1.0 - 'surveyresults.asp' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in surveyresults.asp in Smart Survey 1.0 allows remote attackers to inject arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
MatterDaddy Market 1.1 - 'login.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in admin/login.php in Matterdaddy Market 1.1 allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kyocera Mita Scanner File Utility 3.3.0.1 - File Transfer Directory Traversal
Directory traversal vulnerability in the Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Belkin Wireless G Router / ADSL2 Modem - Authentication Bypass
cgi-bin/setup_virtualserver.exe on the Belkin F5D7230-4 router with firmware 9.01.10 allows remote attackers to cause a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Belkin Wireless G Router / ADSL2 Modem - Authentication Bypass
cgi-bin/setup_dns.exe on the Belkin F5D7230-4 router with firmware 9.01.10 does not require authentication, which allows
23RISK
open ↗Exploit-DB✓ VexDay Proof
Bluemoon inc. PopnupBlog 3.30 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in index.php in the Bluemoon PopnupBLOG module 3.20 and 3.30 for XOO
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dana IRC 1.4a - Remote Buffer Overflow
Stack-based buffer overflow in artegic Dana IRC client 1.3 and earlier allows remote attackers to cause a denial of serv
23RISK
open ↗Exploit-DB✓ VexDay Proof
Belkin Wireless G Router / ADSL2 Modem - Authentication Bypass
The control panel on the Belkin F5D7230-4 router with firmware 9.01.10 maintains authentication state by IP address, whi
23RISK
open ↗Exploit-DB✓ VexDay Proof
One-News - Multiple Input Validation Vulnerabilities
SQL injection vulnerability in index.php in One-News Beta 2 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ruby 1.9 - REXML Remote Denial of Service
The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers t
28RISK
open ↗Exploit-DB✓ VexDay Proof
onenews Beta 2 - Cross-Site Scripting / HTML Injection / SQL Injection
SQL injection vulnerability in index.php in One-News Beta 2 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Accellion File Transfer - Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in Accellion File Transfer FTA_7_0_135 allows remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
PicturesPro Photo Cart 3.9 - Search Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in PICTURESPRO Photo Cart 3.9 allows remote attackers to inject ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Media Services 'nskey.dll' 4.1 - ActiveX Control Remote Buffer Overflow
Buffer overflow in the CallHTMLHelp method in the Microsoft Windows Media Services ActiveX control in nskey.dll 4.1.00.3
35RISK
open ↗Exploit-DB✓ VexDay Proof
Simasy CMS - 'id' SQL Injection
SQL injection vulnerability in index.php in Simasy CMS allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fujitsu Web-Based Admin View 2.1.2 - Directory Traversal
Directory traversal vulnerability in Fujitsu Web-Based Admin View 2.1.2 allows remote attackers to read arbitrary files
23RISK
open ↗Exploit-DB✓ VexDay Proof
TimeTrex Time 2.2 and Attendance Module - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in interface/Login.php in TimeTrex 2.2.11 allow remote attackers to
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.