Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
80,324cataloged exploits
37,130CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,476Referência 23,614GitHub PoC 15,330VulnCheck XDB 9,001Nuclei 4,401Metasploit 3,502✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
Maian Uploader 4.0 - 'header.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
SmartBlog 1.3 - 'index.php' SQL Injection
Directory traversal vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to include arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
SiteXS CMS 0.1.1 - 'upload.php' Arbitrary File Upload
Unrestricted file upload vulnerability in adm/visual/upload.php in SiteXS CMS 0.1.1 allows remote attackers to execute a
23RISK
open ↗Exploit-DB✓ VexDay Proof
SmartBlog 1.3 - 'index.php' SQL Injection
Multiple SQL injection vulnerabilities in SMartBlog (aka SMBlog) 1.3 allow remote attackers to execute arbitrary SQL com
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alumni 1.0.8/1.0.9 - 'index.php?year' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in pages/news.page.inc in Project Alumni 1.0.9 allows remote attackers to injec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Zen Cart 2008 - 'index.php?keyword' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to inject ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alumni 1.0.8/1.0.9 - 'info.php?id' SQL Injection
SQL injection vulnerability in info.php in Project Alumni 1.0.9 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Exploit-DB✓ VexDay Proof
EJ3 BlackBook 1.0 - 'header.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in EJ3 BlackBook 1.0 allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
EJ3 BlackBook 1.0 - 'footer.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in EJ3 BlackBook 1.0 allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Chicomas 2.0.4 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Chilek Content Management System (aka ChiCoMaS) 2.0.4 allows re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Zen Cart 2008 - 'index.php?keyword' SQL Injection
SQL injection vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
Call of Duty 4 1.5 - 'stats' Denial of Service
Call of Duty 4 (CoD4) 1.5 and earlier allows remote authenticated users to cause a denial of service (crash) via a type
23RISK
open ↗Exploit-DB✓ VexDay Proof
MJGUEST 6.7 - 'QT 'mjguest.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in mjguest.php in Mjguest 6.7 GT Rev.01 allows remote attackers to inject arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
VWar 1.6.1 R2 - Multiple Remote Vulnerabilities
SQL injection vulnerability in article.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to execute arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
C-News 1.0.1 - 'install.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in install.php in C-News.fr C-News 1.0.1 allows remote attackers to inject arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
PeerCast 0.1218 - 'getAuthUserPass' Multiple Buffer Overflow Vulnerabilities
Stack-based buffer overflow in the HTTP::getAuthUserPass function (core/common/http.cpp) in Peercast 0.1218 and gnome-pe
28RISK
open ↗Exploit-DB✓ VexDay Proof
LibTiff 3.x - Double-Free Memory Corruption
Double free vulnerability in tif_jpeg.c in libtiff before 3.8.1 allows context-dependent attackers to cause a denial of
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Alphacontent 2.5.8 - Blind SQL Injection
SQL injection vulnerability in the Bernard Gilly AlphaContent (com_alphacontent) 2.5.8 component for Joomla! allows remo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Siteman 2.0.x2 - 'module' Cross-Site Scripting / Local File Inclusion
Cross-site scripting (XSS) vulnerability in index.php in Siteman 2.0.x2 allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Visites 1.1 - MosConfig_absolute_path Remote File Inclusion
PHP remote file inclusion vulnerability in core/include/myMailer.class.php in the Visites (com_joomla-visites) component
43RISK
open ↗Exploit-DB✓ VexDay Proof
Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow
The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote a
28RISK
open ↗Exploit-DB✓ VexDay Proof
Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow
VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via a crafted Cinepak file that triggers a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow
Heap-based buffer overflow in modules/access/rtsp/real_sdpplin.c in the Xine library, as used in VideoLAN VLC Media Play
28RISK
open ↗Exploit-DB✓ VexDay Proof
Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow
Array index error in the sdpplin_parse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP serve
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow
Heap-based buffer overflow in the libaccess_realrtsp plugin in VideoLAN VLC Media Player 0.8.6d and earlier on Windows m
28RISK
open ↗Exploit-DB✓ VexDay Proof
Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow
Stack-based buffer overflow in modules/demux/subtitle.c in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitr
28RISK
open ↗Exploit-DB✓ VexDay Proof
Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow
Integer overflow in the MP4_ReadBox_rdrf function in libmp4.c for VLC 0.8.6e allows remote attackers to cause a denial o
28RISK
open ↗Exploit-DB✓ VexDay Proof
Pixel Motion Blog - 'list_article.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in liste_article.php in Blog Pixel Motion (aka PixelMotion) allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Lotus Expeditor 6.1 - URI Handler Command Execution
Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1
28RISK
open ↗Exploit-DB✓ VexDay Proof
Eclipse 3.3.2 IDE - 'Help Server help/advanced/workingSetManager.jsp?workingSet' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclips
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.