Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,600cataloged exploits
39,734CVEs with public exploitation
24,695lab-tested
AllReferência 25,742Exploit-DB 24,486GitHub PoC 16,618VulnCheck XDB 9,736Nuclei 4,493Metasploit 3,525✓ verified onlyrecentpopularrisk
24,695 exploits
Exploit-DB✓ VexDay Proof
Opensource Classified Ads Script 3.2 - SQL Injection
CVE-2017-17623—webappsphp11 Dec 2017
Opensource Classified Ads Script 3.2 has SQL Injection via the advance_result.php keyword parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Vanguard 1.4 - SQL Injection
CVE-2017-17873—webappsphp11 Dec 2017
Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATH_INFO to the /p URI.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Car Rental Script 2.0.4 - 'val' SQL Injection
CVE-2017-17637—webappsphp11 Dec 2017
Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Laundry Booking Script 1.0 - 'list?city' SQL Injection
CVE-2017-17619—webappsphp11 Dec 2017
Laundry Booking Script 1.0 has SQL Injection via the /list city parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Multivendor Penny Auction Clone Script 1.0 - SQL Injection
CVE-2017-17621—webappsphp11 Dec 2017
Multivendor Penny Auction Clone Script 1.0 has SQL Injection via the PATH_INFO to the /detail URI.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Lawyer Search Script 1.1 - 'lawyer-list?city' SQL Injection
CVE-2017-17620—webappsphp11 Dec 2017
Lawyer Search Script 1.1 has SQL Injection via the /lawyer-list city parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Food Order Script 1.0 - 'list?city' SQL Injection
CVE-2017-17614—webappsphp11 Dec 2017
Food Order Script 1.0 has SQL Injection via the /list city parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Yoga Class Script 1.0 - 'list?city' SQL Injection
CVE-2017-17630—webappsphp11 Dec 2017
Yoga Class Script 1.0 has SQL Injection via the /list city parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
MLM Forced Matrix 2.0.9 - 'newid' SQL Injection
CVE-2017-17636—webappsphp11 Dec 2017
MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Muslim Matrimonial Script 3.02 - 'succid' SQL Injection
CVE-2017-17639—webappsphp11 Dec 2017
Muslim Matrimonial Script 3.02 has SQL Injection via the success-story.php succid parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Advanced Real Estate Script 4.0.7 - SQL Injection
CVE-2017-17603—webappsphp11 Dec 2017
Advanced Real Estate Script 4.0.7 has SQL Injection via the search-results.php Projectmain, proj_type, searchtext, sell_
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Multiplex Movie Theater Booking Script 3.1.5 - 'moid' / 'eid' SQL Injection
CVE-2017-17633—webappsphp11 Dec 2017
Multiplex Movie Theater Booking Script 3.1.5 has SQL Injection via the trailer-detail.php moid parameter, show-time.php
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Readymade Video Sharing Script 3.2 - SQL Injection
CVE-2017-17627—webappsphp11 Dec 2017
Readymade Video Sharing Script 3.2 has SQL Injection via the single-video-detail.php report_videos array parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FS Expedia Clone 1.0 - 'fl_orig' / 'fl_dest' / 'id' SQL Injection
CVE-2017-17570—webappsphp09 Dec 2017
FS Expedia Clone 1.0 has SQL Injection via the pages.php or content.php id parameter, or the show-flight-result.php fl_o
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FS Indiamart Clone 1.0 - 'token' / 'id' / 'c' SQL Injection
CVE-2017-17587—webappsphp09 Dec 2017
FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or c
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Basic B2B Script 2.0.8 - 'product_details.php?id' SQL Injection
CVE-2017-17600—webappsphp09 Dec 2017
Basic B2B Script 2.0.8 has SQL Injection via the product_details.php id parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FS Foodpanda Clone 1.0 - SQL Injection
CVE-2017-17571—webappsphp09 Dec 2017
FS Foodpanda Clone 1.0 has SQL Injection via the /food keywords parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FS Ebay Clone 1.0 - 'id' / 'sub_category_id' / 'category_id' SQL Injection
CVE-2017-17573—webappsphp09 Dec 2017
FS Ebay Clone 1.0 has SQL Injection via the product.php id parameter, or the search.php category_id or sub_category_id p
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FS Care Clone 1.0 - 'jobFrequency' / 'jobType' SQL Injection
CVE-2017-17574—webappsphp09 Dec 2017
FS Care Clone 1.0 has SQL Injection via the searchJob.php jobType or jobFrequency parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FS Grubhub Clone 1.0 - 'keywords' SQL Injection
CVE-2017-17582—webappsphp09 Dec 2017
FS Grubhub Clone 1.0 has SQL Injection via the /food keywords parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FS Crowdfunding Script 1.0 - 'latest_news_details.php?id' SQL Injection
CVE-2017-17578—webappsphp09 Dec 2017
FS Crowdfunding Script 1.0 has SQL Injection via the latest_news_details.php id parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FS Linkedin Clone 1.0 - 'grid' / 'fid' / 'id' SQL Injection
CVE-2017-17580—webappsphp09 Dec 2017
FS Linkedin Clone 1.0 has SQL Injection via the group.php grid parameter, profile.php fid parameter, or company_details.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Advance Online Learning Management Script 3.1 - 'subcatid' / 'popcourseid' SQL Injection
CVE-2017-17599—webappsphp09 Dec 2017
Advance Online Learning Management Script 3.1 has SQL Injection via the courselist.php subcatid or popcourseid parameter
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FS Freelancer Clone 1.0 - 'profile.php?u' SQL Injection
CVE-2017-17579—webappsphp09 Dec 2017
FS Freelancer Clone 1.0 has SQL Injection via the profile.php u parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FS Gigs Script 1.0 - 'cat' / 'sc' SQL Injection
CVE-2017-17576—webappsphp09 Dec 2017
FS Gigs Script 1.0 has SQL Injection via the browse-category.php cat parameter, browse-scategory.php sc parameter, or se
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FS IMDB Clone 1.0 - 'f' / 's' / 'id' SQL Injection
CVE-2017-17588—webappsphp09 Dec 2017
FS IMDB Clone 1.0 has SQL Injection via the movie.php f parameter, tvshow.php s parameter, or show_misc_video.php id par
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Beauty Parlour Booking Script 1.0 - 'gender' / 'city' SQL Injection
CVE-2017-17595—webappsphp09 Dec 2017
Beauty Parlour Booking Script 1.0 has SQL Injection via the /list gender or city parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FS Amazon Clone 1.0 - SQL Injection
CVE-2017-17572—webappsphp09 Dec 2017
FS Amazon Clone 1.0 has SQL Injection via the PATH_INFO to /VerAyari.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Advance B2B Script 2.1.3 - 'show_id' / 'pid' SQL Injection
CVE-2017-17602—webappsphp09 Dec 2017
Advance B2B Script 2.1.3 has SQL Injection via the tradeshow-list-detail.php show_id or view-product.php pid parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FS Trademe Clone 1.0 - 'search' / 'id' SQL Injection
CVE-2017-17577—webappsphp09 Dec 2017
FS Trademe Clone 1.0 has SQL Injection via the search_item.php search parameter or the general_item_details.php id param
23RISK
open ↗
← previouspage 33 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.