Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
80,409cataloged exploits
37,196CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,478Referência 23,664GitHub PoC 15,347VulnCheck XDB 9,003Nuclei 4,415Metasploit 3,502✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
Korean GHBoard FlashUpload Component - 'download.jsp?name' Arbitrary File Access
Directory traversal vulnerability in component/flashupload/download.jsp in the FlashUpload component in Korean GHBoard a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Korean GHBoard - 'Component/upload.jsp' Arbitrary File Upload
Unrestricted file upload vulnerability in component/upload.jsp in Korean GHBoard allows remote attackers to upload arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle 10g - 'CTX_DOC.MARKUP' SQL Injection
Multiple SQL injection vulnerabilities in the CTXSYS Intermedia application for the Oracle Text component (CTX_DOC) in O
23RISK
open ↗Exploit-DB✓ VexDay Proof
Japanese PHP Gallery Hosting - Arbitrary File Upload
Unrestricted file upload vulnerability in upload/upload.php in Japanese PHP Gallery Hosting, when Open directory mode is
23RISK
open ↗Exploit-DB✓ VexDay Proof
Hackish 1.1 - 'Blocco.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in shoutbox/blocco.php in Hackish BETA 1.1 allows remote attackers to inject ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Jeebles Technology Jeebles Directory 2.9.60 - 'download.php' Local File Inclusion
Absolute path traversal vulnerability in download.php in Jeebles Directory 2.9.60 allows remote attackers to read arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
deeemm CMS (dmcms) 0.7 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in DeeEmm.com DM CMS 0.7.0.Beta allows remote attackers to execute arbitrary SQ
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache Tomcat - WebDAV SSL Remote File Disclosure
Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.
35RISK
open ↗Exploit-DB✓ VexDay Proof
SearchSimon Lite 1.0 - 'Filename.asp' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in filename.asp in ASP Site Search SearchSimon Lite 1.0 allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
ReloadCMS 1.2.5 - 'index.php' Local File Inclusion
Directory traversal vulnerability in system.php in ReloadCMS 1.2.7 allows remote attackers to include and execute arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
rNote 0.9.7 - 'rnote.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in rnote.php in rNote 0.9.7.5 allow remote attackers to inject arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Socketmail 2.2.1 - 'lostpwd.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in lostpwd.php in Creative Digital Resources SocketMail 2.2.1 allows remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
SocketKB 1.1.5 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in SocketKB 1.1.5 allow remote attackers to inject arbitrary web scr
23RISK
open ↗Exploit-DB✓ VexDay Proof
SiteBar 3.3.8 - '/translator.php?upd/cmd/Action/edit' Arbitrary PHP Code Execution
Eval injection vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated use
23RISK
open ↗Exploit-DB✓ VexDay Proof
SiteBar 3.3.8 - 'index.php?target' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in SiteBar 3.3.8 allow remote attackers to inject arbitrary web scri
23RISK
open ↗Exploit-DB✓ VexDay Proof
Nortel Networks UNIStim IP SoftPhone 2050 - RTCP Port Buffer Overflow
Buffer overflow in the Nortel UNIStim IP Softphone 2050 allows remote attackers to cause a denial of service (applicatio
23RISK
open ↗Exploit-DB✓ VexDay Proof
SiteBar 3.3.8 - 'command.php?Modify User Action uid' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in SiteBar 3.3.8 allow remote attackers to inject arbitrary web scri
23RISK
open ↗Exploit-DB✓ VexDay Proof
Macrovision SafeDisc - 'SecDRV.SYS' Method_Neither Privilege Escalation
Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0, as shipped in Microsoft Windows XP SP2, XP Professio
23RISK
open ↗Exploit-DB✓ VexDay Proof
Nortel Networks - Multiple UNIStim VoIP Products Remote Eavesdrop Vulnerabilities
The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communi
23RISK
open ↗Exploit-DB✓ VexDay Proof
SpeedFan - 'Speedfan.sys' Local Privilege Escalation
Speedfan.sys in Alfredo Milani Comparetti SpeedFan 4.33, when used on Microsoft Windows Vista x64, allows local users to
23RISK
open ↗Exploit-DB✓ VexDay Proof
RealPlayer 10.0/10.5/11 - 'ierpplug.dll' ActiveX Control Import Playlist Name Stack Buffer Overflow
Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and e
50RISK
open ↗Exploit-DB✓ VexDay Proof
Alcatel Lucent Omnivista 4760 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Alcatel OmniVista 4760 R4.2 and earlier allow remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
SiteBar 3.3.8 - 'integrator.php?lang' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in SiteBar 3.3.8 allow remote attackers to inject arbitrary web scri
23RISK
open ↗Exploit-DB✓ VexDay Proof
SiteBar 3.3.8 - 'translator.php?dir' Traversal Arbitrary File Access
Absolute path traversal vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenti
23RISK
open ↗Exploit-DB✓ VexDay Proof
phpMyAdmin 2.11.1 - 'Server_Status.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Asterisk 'asterisk-addons' 1.2.7/1.4.3 - CDR_ADDON_MYSQL Module SQL Injection
Multiple SQL injection vulnerabilities in cdr_addon_mysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow
23RISK
open ↗Exploit-DB✓ VexDay Proof
GCALDaemon 1.0-beta13 - Remote Denial of Service
The readRequest method in org/gcaldaemon/core/http/HTTPListener.java in GCALDaemon 1.0-beta13 allows remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Netgear SSL312 PROSAFE SSL VPN-Concentrator 25 - Error Page Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in cgi-bin/welcome (aka the login page) in Netgear SSL312 PROSAFE SSL VPN-Conce
23RISK
open ↗Exploit-DB✓ VexDay Proof
InnovaPortal - 'msg.jsp?msg' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in InnovaAge InnovaShop allow remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
InnovaPortal - 'tc/contents/home001.jsp?contentid' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in InnovaAge InnovaShop allow remote attackers to inject arbitrary w
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.