Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
24,696 exploits
Exploit-DB✓ VexDay Proof
EasyImageCatalogue 1.31 - 'addcomment.php?d' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in onlinetools.org EasyImageCatalogue 1.3.1 allow remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Chris LaPointe Download Center 1.2 - login Action Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the default URI in Chris LaPointe RedGalaxy Download Center 1.2 a
23RISK
open ↗Exploit-DB✓ VexDay Proof
McAfee Framework ePolicy 3.x - Orchestrator '_naimcomn_Log' Remote Format String
Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (P
23RISK
open ↗Exploit-DB✓ VexDay Proof
Chris LaPointe Download Center 1.2 - 'category' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the default URI in Chris LaPointe RedGalaxy Download Center 1.2 a
23RISK
open ↗Exploit-DB✓ VexDay Proof
EasyImageCatalogue 1.31 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in onlinetools.org EasyImageCatalogue 1.3.1 allow remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
eWeather - 'chart' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in the eWebsite eWeather (Weather) module for PHP-Nuke allows remo
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Nuke NukeC30 3.0 Module - 'id_catg' SQL Injection
SQL injection vulnerability in the Sudirman Angriawan NukeC30 3.0 module for PHP-Nuke allows remote attackers to execute
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Nuke zClassifieds Module - 'cat' SQL Injection
SQL injection vulnerability in the ZClassifieds module for PHP-Nuke allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Exploit-DB✓ VexDay Proof
EncapsGallery 1.11.2 - 'catalog_watermark.php?file' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in EncapsGallery 1.11.2 allow remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
RemotelyAnywhere 8.0.668 - 'Accept-Charset' Null Pointer Denial of Service
The RemotelyAnywhere.exe service in the Remotely Anywhere Server and Workstation 8.0.668 and earlier allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
Gallarific - 'search.php?query' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in search.php in Gallarific allows remote attackers to inject arbitrary web scr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Drake CMS 0.4.11 RC8 - 'd_root' Local File Inclusion
Absolute path traversal vulnerability in install/index.php in Drake CMS 0.4.11 RC8 allows remote attackers to read and e
23RISK
open ↗Exploit-DB✓ VexDay Proof
EncapsGallery 1.11.2 - 'watermark.php?File' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in EncapsGallery 1.11.2 allow remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
Gallarific - Multiple Script Direct Request Authentication Bypass
Gallarific does not require authentication for (1) users.php and (2) index.php, which allows remote attackers to add and
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Nuke Hadith Module - 'cat' SQL Injection
SQL injection vulnerability in Hadith module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alkacon OpenCMS 7.0.3 - 'logfileViewSettings.jsp?filePath.0' Arbitrary File Access
Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon
23RISK
open ↗Exploit-DB✓ VexDay Proof
Panda Internet Security/AntiVirus+Firewall 2008 - 'CPoint.sys' Memory Corruption
The cpoint.sys driver in Panda Internet Security 2008 and Antivirus+ Firewall 2008 allows local users to cause a denial
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alkacon OpenCMS 7.0.3 - 'logfileViewSettings.jsp?filePath' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/log
23RISK
open ↗Exploit-DB✓ VexDay Proof
ImageVue 1.7 - 'upload.php?path' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in imageVue 1.7 allow remote attackers to inject arbitrary web scrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Core 2.3.2 - '/wp-admin/users.php?inviteemail' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
Specimen Image Database - 'taxonservice.php?dir' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Specimen Image Database (SID), when register_globals is enabled, a
23RISK
open ↗Exploit-DB✓ VexDay Proof
MailEnable 3.13 - IMAP Service Multiple Remote Vulnerabilities
The IMAP service (MEIMAPS.exe) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Office 2000/2003/2004/XP - File Memory Corruption
Unspecified vulnerability in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, Excel Viewer 2003 up to SP3, and Office 2004 f
35RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Core 2.3.2 - '/wp-admin/invites.php?to' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
ImageVue 1.7 - 'dir2.php?path' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in imageVue 1.7 allow remote attackers to inject arbitrary web scrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
ImageVue 1.7 - 'dirxml.php?path' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in imageVue 1.7 allow remote attackers to inject arbitrary web scrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
ImageVue 1.7 - 'popup.php?path' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in imageVue 1.7 allow remote attackers to inject arbitrary web scrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
Neptune Web Server 3.0 - 404 Error Page Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Neptune Web Server 3.0 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
Airspan ProST WiMAX Device - Web Interface Authentication Bypass
The administration panel on the Airspan WiMax ProST 4.1 antenna with 6.5.38.0 software does not verify authentication cr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Yap Blog 1.1 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in wildmary Yap Blog 1.1 allows remote attackers to execute arbitra
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.