Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
19,067 exploits
Exploit-DB✓ VexDay Proof
Joomla! / Mambo Component com_detail - 'id' SQL Injection
SQL injection vulnerability in the com_detail component for Joomla! and Mambo allows remote attackers to execute arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
RunCMS 1.6.1 - 'admin.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in system/admin.php in RunCMS 1.6.1 allows remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebcamXP 3.72.440/4.05.280 Beta - '/pocketpc?camnum' Arbitrary Memory Disclosure
Multiple array index errors in the HTTP server in Darkwet Network webcamXP 3.72.440.0 and earlier and beta 4.05.280 and
23RISK
open ↗Exploit-DB✓ VexDay Proof
Yellow Swordfish Simple Forum 1.x - 'sf-profile.php' SQL Injection
SQL injection vulnerability in ahah/sf-profile.php in the Yellow Swordfish Simple Forum module for Wordpress allows remo
23RISK
open ↗Exploit-DB✓ VexDay Proof
ProjectPier 0.8 - Multiple HTML Injection / Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in ProjectPier 0.8 and earlier allow remote attackers to inject arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
freeSSHd 1.2 - 'SSH2_MSG_NEWKEYS' Remote Denial of Service
freeSSHd 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a SSH2_MSG_NEWKEYS packet to T
23RISK
open ↗Exploit-DB✓ VexDay Proof
BanPro Dms 1.0 - 'index.php' Local File Inclusion
Directory traversal vulnerability in DMS/index.php in BanPro DMS 1.0 allows remote attackers to include and execute arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Foxit WAC Remote Access Server 2.0 Build 3503 - Heap Buffer Overflow
Heap-based buffer overflow in Foxit Remote Access Server (aka WAC Server) 2.0 Build 3503 allows remote attackers to caus
23RISK
open ↗Exploit-DB✓ VexDay Proof
Power Phlogger 2.2.x - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in dspStats.php in PowerPhlogger 2.2.5 allows remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! / Mambo Component Filebase - 'filecatid' SQL Injection
SQL injection vulnerability in the com_filebase component for Joomla! and Mambo allows remote attackers to execute arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dokeos 1.8.4 - '/main/admin/session_list.php?cmessage' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 allow remote attackers to inject arbitrary web scrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dokeos 1.8.4 - 'whoisonline.php?id' SQL Injection
Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dokeos 1.8.4 - '/main/calendar/myagenda.php?courseCode' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 allow remote attackers to inject arbitrary web scrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! / Mambo Component com_scheduling - 'id' SQL Injection
SQL injection vulnerability in the com_scheduling module for Joomla! and Mambo allows remote attackers to execute arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dokeos 1.8.4 - '/main/mySpace/index.php?tracking_list_coaches_column' SQL Injection
Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! / Mambo Component com_sg - 'pid' SQL Injection
SQL injection vulnerability in the com_sg component for Joomla! and Mambo allows remote attackers to execute arbitrary S
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dokeos 1.8.4 - '/main/create_course/add_course.php?tutor_name' SQL Injection
Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dokeos 1.8.4 - 'main/inc/lib/events.lib.inc.php' Referer HTTP Header SQL Injection
Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dokeos 1.8.4 - '/main/admin/course_category.php?category' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 allow remote attackers to inject arbitrary web scrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sophos Email Appliance 2.1 - Web Interface Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface in Sophos ES1000 and ES4000 Emai
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sami FTP Server 2.0.x - Multiple Commands Remote Denial of Service Vulnerabilities
KarjaSoft Sami FTP Server 2.0.x allows remote attackers to cause a denial of service (daemon crash or hang) via certain
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! / Mambo Component com_salesrep - 'rid' SQL Injection
SQL injection vulnerability in the com_salesrep component for Joomla! and Mambo allows remote attackers to execute arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
PlutoStatus Locator 1.0pre alpha - 'index.php' Local File Inclusion
Directory traversal vulnerability in index.php in PlutoStatus Locator 1.0 pre alpha allows remote attackers to include a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cisco Unified Communications Manager 6.1 - 'key' SQL Injection
SQL injection vulnerability in Cisco Unified CallManager/Communications Manager (CUCM) 5.0/5.1 before 5.1(3a) and 6.0/6.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Site2Nite Real Estate Web - 'agentlist.asp' Multiple SQL Injections
Multiple SQL injection vulnerabilities in Site2Nite Real Estate Web allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Office 2003 - '.wps' Local Stack Overflow (MS08-011)
wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2, Works 8.0, and Works Suite 2005, allows re
35RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Office 2003 - '.wps' Local Stack Overflow (MS08-011)
Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows remote att
35RISK
open ↗Exploit-DB✓ VexDay Proof
okul siteleri 'com_mezun' Component - SQL Injection
SQL injection vulnerability in the com_mezun component for Joomla! allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cacti 0.8.7 - '/index.php/sql.php?Login Action login_username' SQL Injection
Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote authenticated u
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cacti 0.8.7 - 'tree.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote authenticated u
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.