Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
80,184cataloged exploits
37,029CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,476Referência 23,521GitHub PoC 15,321VulnCheck XDB 8,970Nuclei 4,394Metasploit 3,502✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
Simasy CMS - 'id' SQL Injection
SQL injection vulnerability in index.php in Simasy CMS allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
Scripts4Profit DXShopCart 4.30 - 'pid' SQL Injection
SQL injection vulnerability in product_detail.php in DXShopCart 4.30mc allows remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mono 2.0 - 'System.Web' HTTP Header Injection
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers
23RISK
open ↗Exploit-DB✓ VexDay Proof
YourFreeWorld Ad-Exchange Script - 'id' SQL Injection
SQL injection vulnerability in tr.php in YourFreeWorld Ad-Exchange Script allows remote attackers to execute arbitrary S
23RISK
open ↗Exploit-DB✓ VexDay Proof
vBulletin 3.6.10/3.7.2 - '$newpm[title]' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3, when "Show New Private Message Notificat
23RISK
open ↗Exploit-DB✓ VexDay Proof
Vanilla 1.1.4 - HTML Injection / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Lussumo Vanilla 1.1.4 and earlier (1) allow remote attackers to i
23RISK
open ↗Exploit-DB✓ VexDay Proof
Vim 7.1.314 - Insufficient Shell Escaping Multiple Command Execution Vulnerabilities
Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/english/account.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/includes/modules/faqdesk/faqdesk_article_require.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/templates/Freeway/boxes/loginbox.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ovidentia 6.6.5 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/templates/Freeway/boxes/card1.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/templates/Freeway/boxes/whos_online.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
AWStats 6.8 - 'AWStats.pl' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/includes/modules/newsdesk/newsdesk_article_require.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/templates/Freeway/mainpage_modules/mainpage.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
NewsHOWLER 1.03 - Cookie Data SQL Injection
SQL injection vulnerability in NewsHOWLER 1.03 Beta allows remote attackers to execute arbitrary SQL commands via the ne
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/french/account_newsletters.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPizabi 0.848b C1 HP3 - 'id' Local File Inclusion
Directory traversal vulnerability in index.php in PHPizabi 0.848b C1 HFP3 allows remote authenticated administrators to
23RISK
open ↗Exploit-DB✓ VexDay Proof
FipsCMS 2.1 - 'neu.asp' SQL Injection
SQL injection vulnerability in forum/neu.asp in fipsCMS 2.1 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
FlexCMS 2.5 - 'inc-core-admin-editor-previouscolorsjs.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in inc-core-admin-editor-previouscolorsjs.php in the FlexCMS 2.5 and earlier, w
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mambo Open Source 4.6.2 - '/administrator/popups/index3pop.php?mosConfig_sitename' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.2 and 4.6.5, when register_globals is enabled, allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mambo Open Source 4.6.2 - '/mambots/editors/mostlyce/' PHP/connector.php?Query String Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.2 and 4.6.5, when register_globals is enabled, allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Yelp 2.23.1 - Invalid URI Format String
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24
28RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Realty - 'dpage.php' SQL Injection
SQL injection vulnerability in dpage.php in YPN PHP Realty allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Nortel Networks SRG V16 - 'admin_modules.php?module' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in NavBoard 16 (2.6.0) allow remote attackers to include and execute arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Meet#Web 0.8 - 'RegForm.class.php?root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Meet#Web 0.8 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗Exploit-DB✓ VexDay Proof
YapBB 1.2 - 'class_yapbbcooker.php' Remote File Inclusion
PHP remote file inclusion vulnerability in include/class_yapbbcooker.php in YapBB 1.2.Beta 2 allows remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Meet#Web 0.8 - 'modules.php?root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Meet#Web 0.8 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.