Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
80,409cataloged exploits
37,196CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,478Referência 23,664GitHub PoC 15,347VulnCheck XDB 9,003Nuclei 4,415Metasploit 3,502✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
OpenBase 10.0.x - Remote Buffer Overflow / Remote Command Execution
OpenBase 10.0.5 and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in
23RISK
open ↗Exploit-DB✓ VexDay Proof
easyGB 2.1.1 - 'index.php' Local File Inclusion
Directory traversal vulnerability in index.php in easyGB 2.1.1 allows remote attackers to include arbitrary files via th
23RISK
open ↗Exploit-DB✓ VexDay Proof
i-Gallery 3.4 - 'igallery.asp' Remote Information Disclosure
Directory traversal vulnerability in igallery.asp in Blue-Collar Productions i-Gallery 3.4 allows remote attackers to re
23RISK
open ↗Exploit-DB✓ VexDay Proof
MySQL 5.1.23 - Server InnoDB CONVERT_SEARCH_MODE_TO_INNOBASE Function Denial of Service
The convert_search_mode_to_innobase function in ha_innodb.cc in the InnoDB engine in MySQL 5.1.23-BK and earlier allows
28RISK
open ↗Exploit-DB✓ VexDay Proof
JLMForo System - 'Buscado.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in buscador.php in JLMForo System allows remote attackers to inject arbitrary w
33RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Helpdesk 0.6.16 - 'index.php' Local File Inclusion
Directory traversal vulnerability in index.php in phphelpdesk 0.6.16 allows remote attackers to include and execute arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Quick and Dirty Blog (qdblog) 0.4 - 'categories.php' Local File Inclusion
Multiple directory traversal vulnerabilities in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
Synergiser 1.2 RC1 - Local File Inclusion / Full Path Disclosure
Directory traversal vulnerability in index.php in Firewolf Technologies Synergiser 1.2 RC1 and earlier allows remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
Helios Calendar 1.1/1.2 - 'admin/index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in admin/index.php in Helios Calendar 1.2.1 Beta allows remote attackers to inj
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ubuntu 6.06 - DHCPd Remote Denial of Service
in.dhcpd in the DHCP implementation in Sun Solaris 8 through 10, and OpenSolaris before snv_103, allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
GNU Emacs 22.1 - Local Variable Handling Code Execution
The hack-local-variables function in Emacs before 22.2, when enable-local-variables is set to :safe, does not properly s
23RISK
open ↗Exploit-DB✓ VexDay Proof
CONTENTCustomizer 3.1 - 'Dialog.php' Information Disclosure
dialog.php in CONTENTCustomizer 3.1mp and earlier allows remote attackers to obtain sensitive author credentials by maki
23RISK
open ↗Exploit-DB✓ VexDay Proof
Synergiser 1.2 - 'index.php' Local File Inclusion
Directory traversal vulnerability in index.php in Firewolf Technologies Synergiser 1.2 RC1 and earlier allows remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
SonicWALL SSL VPN 1.3 3 WebCacheCleaner - ActiveX FileDelete Method Traversal Arbitrary File Deletion
Absolute path traversal vulnerability in the WebCacheCleaner ActiveX control 1.3.0.3 in SonicWall SSL-VPN 200 before 2.1
23RISK
open ↗Exploit-DB✓ VexDay Proof
Yarssr 0.2.2 - GUI.PM Remote Code Injection
GUI.pm in yarssr 0.2.2, when Gnome default URL handling is disabled, allows remote attackers to execute arbitrary comman
23RISK
open ↗Exploit-DB✓ VexDay Proof
Perdition 1.17 - IMAPD __STR_VWRITE Remote Format String
The format string protection mechanism in IMAPD for Perdition Mail Retrieval Proxy 1.17 and earlier allows remote attack
28RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-AGTC Membership System 1.1a - Remote Add Admin
adduser.php in PHP-AGTC Membership (AGTC-Membership) System 1.1a does not require authentication, which allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlobalLink 2.7.0.8 - ConnectAndEnterRoom ActiveX Control Stack Buffer Overflow
Stack-based buffer overflow in a certain ActiveX control in GLChat.ocx 2.5.1.32 in GlobalLink 2.7.0.8, as used in Ourgam
28RISK
open ↗Exploit-DB✓ VexDay Proof
Saxon 5.4 - 'Menu.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in admin/menu.php in SAXON 5.4 allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Blue Coat ProxySG Management Console - URI Handler Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in the management console in Blue Coat ProxySG before 4.2.6.1, and 5.x before 5
23RISK
open ↗Exploit-DB✓ VexDay Proof
Smart-Shop - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Smart-Shop allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
Saxon 5.4 - 'Example.php' SQL Injection
SQL injection vulnerability in example.php in SAXON 5.4 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Core 2.3 - 'Edit-Post-Rows.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inje
23RISK
open ↗Exploit-DB✓ VexDay Proof
Omnistar Live - 'KB.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Omnistar Live allow remote attackers to inject arbitrary web scri
23RISK
open ↗Exploit-DB✓ VexDay Proof
CA BrightStor HSM r11.5 - Remote Stack Overflow / Denial of Service
Multiple stack-based buffer overflows in Computer Associates (CA) BrightStor Hierarchical Storage Manager (HSM) before r
50RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Tivoli Storage Manager 5.3 - Express CAD Service Buffer Overflow
Buffer overflow in the Client Acceptor Daemon (CAD), dsmcad.exe, in certain IBM Tivoli Storage Manager (TSM) clients 5.1
60RISK
open ↗Exploit-DB✓ VexDay Proof
Shttp 0.0.x - Directory Traversal
The safe_path function in shttp before 0.0.5 allows remote attackers to conduct directory traversal attacks and read fil
23RISK
open ↗Exploit-DB✓ VexDay Proof
TikiWiki 1.9.8.1 - Local File Inclusion
Multiple directory traversal vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to include and execu
23RISK
open ↗Exploit-DB✓ VexDay Proof
Multi-Forums - 'Directory.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3, for
23RISK
open ↗Exploit-DB✓ VexDay Proof
Aleris Web Publishing Server 3.0 - 'Page.asp' SQL Injection
SQL injection vulnerability in calendar/page.asp in Aleris Web Publishing Server 3.0 allows remote attackers to execute
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.