Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,989cataloged exploits
40,450CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,042VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
19,067 exploits
Exploit-DB✓ VexDay Proof
Simasy CMS - 'id' SQL Injection
SQL injection vulnerability in index.php in Simasy CMS allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
Scripts4Profit DXShopCart 4.30 - 'pid' SQL Injection
SQL injection vulnerability in product_detail.php in DXShopCart 4.30mc allows remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
TimeTrex Time 2.2 and Attendance Module - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in interface/Login.php in TimeTrex 2.2.11 allow remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
YourFreeWorld Ad-Exchange Script - 'id' SQL Injection
SQL injection vulnerability in tr.php in YourFreeWorld Ad-Exchange Script allows remote attackers to execute arbitrary S
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mono 2.0 - 'System.Web' HTTP Header Injection
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers
23RISK
open ↗Exploit-DB✓ VexDay Proof
vBulletin 3.6.10/3.7.2 - '$newpm[title]' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3, when "Show New Private Message Notificat
23RISK
open ↗Exploit-DB✓ VexDay Proof
Vim 7.1.314 - Insufficient Shell Escaping Multiple Command Execution Vulnerabilities
Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Vanilla 1.1.4 - HTML Injection / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Lussumo Vanilla 1.1.4 and earlier (1) allow remote attackers to i
23RISK
open ↗Exploit-DB✓ VexDay Proof
NewsHOWLER 1.03 - Cookie Data SQL Injection
SQL injection vulnerability in NewsHOWLER 1.03 Beta allows remote attackers to execute arbitrary SQL commands via the ne
23RISK
open ↗Exploit-DB✓ VexDay Proof
AWStats 6.8 - 'AWStats.pl' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/templates/Freeway/mainpage_modules/mainpage.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ovidentia 6.6.5 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/includes/modules/faqdesk/faqdesk_article_require.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/includes/modules/newsdesk/newsdesk_article_require.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/french/account_newsletters.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/templates/Freeway/boxes/loginbox.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/templates/Freeway/boxes/whos_online.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/english/account.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/templates/Freeway/boxes/card1.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
FlexCMS 2.5 - 'inc-core-admin-editor-previouscolorsjs.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in inc-core-admin-editor-previouscolorsjs.php in the FlexCMS 2.5 and earlier, w
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mambo Open Source 4.6.2 - '/administrator/popups/index3pop.php?mosConfig_sitename' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.2 and 4.6.5, when register_globals is enabled, allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mambo Open Source 4.6.2 - '/mambots/editors/mostlyce/' PHP/connector.php?Query String Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.2 and 4.6.5, when register_globals is enabled, allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
FipsCMS 2.1 - 'neu.asp' SQL Injection
SQL injection vulnerability in forum/neu.asp in fipsCMS 2.1 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPizabi 0.848b C1 HP3 - 'id' Local File Inclusion
Directory traversal vulnerability in index.php in PHPizabi 0.848b C1 HFP3 allows remote authenticated administrators to
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Fusion 4.01 - 'readmore.php' SQL Injection
SQL injection vulnerability in readmore.php in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
Nukeviet 2.0 - '/admin/login.php' Cookie Authentication Bypass
Nukeviet 2.0 Beta allows remote attackers to bypass authentication and gain administrative access by setting the admf co
23RISK
open ↗Exploit-DB✓ VexDay Proof
Meet#Web 0.8 - 'ManagerRightsResource.class.php?root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Meet#Web 0.8 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗Exploit-DB✓ VexDay Proof
Meet#Web 0.8 - 'RegResource.class.php?root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Meet#Web 0.8 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Realty - 'dpage.php' SQL Injection
SQL injection vulnerability in dpage.php in YPN PHP Realty allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.