Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,020cataloged exploits
35,276CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,446Referência 22,166GitHub PoC 14,080VulnCheck XDB 8,604Nuclei 4,251Metasploit 3,473✓ verified onlyrecentpopularrisk
21,899 exploits
Referência✓ VexDay Proof
Maian Guestbook 3.2 - Insecure Cookie Handling
admin/index.php in Maian Guestbook 3.2 and earlier allows remote attackers to bypass authentication and gain administrat
23RISK
open ↗Referência✓ VexDay Proof
Maian Uploader 4.0 - Insecure Cookie Handling
admin/index.php in Maian Uploader 4.0 and earlier allows remote attackers to bypass authentication and gain administrati
23RISK
open ↗Referência
CVE-2000-1196
PSCOErrPage.htm in Netscape PublishingXpert 2.5 before SP2 allows remote attackers to read arbitrary files by specifying
23RISK
open ↗Referência
CVE-2021-27885
usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.
23RISK
open ↗Referência
CVE-2018-0749
The Microsoft Server Message Block (SMB) Server in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2
23RISK
open ↗Referência✓ VexDay Proof
IntelliTamper 2.07 - 'imgsrc' Remote Buffer Overflow
Buffer overflow in the HTML parser in IntelliTamper 2.07 allows remote attackers to execute arbitrary code via a long UR
23RISK
open ↗Referência
CVE-2013-1409
Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
GreenCart PHP Shopping Cart - 'id' SQL Injection
Multiple SQL injection vulnerabilities in PozScripts GreenCart PHP Shopping Cart allow remote attackers to execute arbit
23RISK
open ↗Referência
CVE-2020-8819
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in
23RISK
open ↗Referência
CVE-2023-24217
AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.
41RISK
open ↗Referência✓ VexDay Proof
Joomla! Component EZ Store Remote - Blind SQL Injection
SQL injection vulnerability in the EZ Store (com_ezstore) component for Joomla! allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
phsBlog 0.1.1 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in phsBlog 0.1.1 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Referência✓ VexDay Proof
TR Forum 2.0 - SQL Injection / Bypass Security Restriction
Tr Forum 2.0 allows remote attackers to bypass authentication and add an administrative account via the login and passwo
23RISK
open ↗Referência✓ VexDay Proof
WikkiTikkiTavi 1.11 - Arbitrary '.PHP' File Upload
Unrestricted file upload vulnerability in upload.php in WikkiTikkiTavi 1.11 allows remote attackers to execute arbitrary
23RISK
open ↗Referência
CVE-2009-4059
SQL injection vulnerability in the JoomClip (com_joomclip) component for Joomla! allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
Gigaset SE461 WiMAX Router - Remote Denial of Service
Siemens Gigaset SE461 WiMAX router 1.5-BL024.9.6401, and possibly other versions, allows remote attackers to cause a den
23RISK
open ↗Referência
CVE-2018-17182
An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles
23RISK
open ↗Referência
CVE-2021-27964
SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Con
50RISK
open ↗Referência
CVE-2009-3597
Digitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access control, which allows rem
23RISK
open ↗Referência
CVE-2012-4362
hydra.exe in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance has a hardcoded password of L0CAlu53R for the global$a
23RISK
open ↗Referência
CVE-2012-4362
hydra.exe in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance has a hardcoded password of L0CAlu53R for the global$a
23RISK
open ↗Referência✓ VexDay Proof
b1gbb 2.24.0 - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in visitenkarte.php in b1gBB 2.24.0 allows remote attackers to inject arbitrary
23RISK
open ↗Referência✓ VexDay Proof
PHP-Ring Webring System 0.9.1 - Insecure Cookie Handling
admin/wr_admin.php in PHP-Ring Webring System (aka uPHP_ring_website) 0.9.1 allows remote attackers to bypass authentica
23RISK
open ↗Referência
CVE-2023-38951
ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arb
48RISK
open ↗Referência
CVE-2007-1524
Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier allows remote attackers to include arb
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.