Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,151cataloged exploits
35,370CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecentpopularrisk
22,233 exploits
Referência
CVE-2010-4631
Multiple cross-site scripting (XSS) vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to inject arbitrary
23RISK
open ↗Referência
CVE-2010-0703
Cross-site scripting (XSS) vulnerability in wa/auth in PortWise SSL VPN 4.6 allows remote attackers to inject arbitrary
23RISK
open ↗Referência
CVE-2010-5010
Cross-site scripting (XSS) vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers t
23RISK
open ↗Referência
CVE-2010-4873
Cross-site scripting (XSS) vulnerability in confirm.php in WeBid 0.8.5 P1 allows remote attackers to inject arbitrary we
23RISK
open ↗Referência✓ VexDay Proof
PHPDirector 0.21 - 'videos.php?id' SQL Injection
SQL injection vulnerability in videos.php in PHP Director 0.21 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Constructr CMS 3.02.5 stable - Multiple Vulnerabilities
Constructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent atta
23RISK
open ↗Referência
CVE-2017-9413
Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attacke
23RISK
open ↗Referência✓ VexDay Proof
Blog:CMS 4.2.1b - SQL Injection / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in BLOG:CMS 4.2.1b allow remote attackers to inject arbitrary web sc
23RISK
open ↗Referência✓ VexDay Proof
E-Store Kit-1 < 2 PayPal Edition - 'pid' SQL Injection
SQL injection vulnerability in viewdetails.php in MagicScripts E-Store Kit-1, E-Store Kit-2, E-Store Kit-1 Pro PayPal Ed
23RISK
open ↗Referência✓ VexDay Proof
OpenImpro 1.1 - 'image.php' SQL Injection
SQL injection vulnerability in image.php in OpenImpro 1.1 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
Quicksilver Forums 1.4.1 - SQL Injection
SQL injection vulnerability in index.php in Quicksilver Forums 1.4.1 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
TekBase All-in-One 3.1 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in TekBase All-in-One 3.1 allow remote authenticated users to execute arbitrary S
23RISK
open ↗Referência
CVE-2010-2156
ISC DHCP 4.1 before 4.1.1-P1 and 4.0 before 4.0.2-P1 allows remote attackers to cause a denial of service (server exit)
60RISK
open ↗Referência
CVE-2009-3512
Multiple cross-site scripting (XSS) vulnerabilities in MyWeight 1.0 allow remote attackers to inject arbitrary web scrip
23RISK
open ↗Referência
CVE-2026-5978
Totolink A7100RU CGI cstecgi.cgi setWiFiAclRules os command injection
48RISK
open ↗Referência
CVE-2026-10165
Edimax BR-6478AC POST Request formWanTcpipSetup stack-based overflow
41RISK
open ↗Referência✓ VexDay Proof
AuraCMS 2.2 - 'albums' Pramater SQL Injection
SQL injection vulnerability in mod/gallery/ajax/gallery_data.php in AuraCMS 2.2 allows remote attackers to execute arbit
23RISK
open ↗Referência
CVE-2017-0199
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Window
100RISK
open ↗Referência✓ VexDay Proof
Yblog 0.2.2.2 - Cross-Site Scripting / SQL Injection
Multiple cross-site scripting (XSS) vulnerabilities in yBlog 0.2.2.2 allow remote attackers to inject arbitrary web scri
23RISK
open ↗Referência
CVE-2017-0199
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Window
100RISK
open ↗Referência✓ VexDay Proof
TubeGuru Video Sharing Script - 'UID' SQL Injection
SQL injection vulnerability in ugroups.php in PozScripts TubeGuru Video Sharing Script allows remote attackers to execut
23RISK
open ↗Referência
CVE-2017-0199
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Window
100RISK
open ↗Referência✓ VexDay Proof
OneCMS 2.4 - SQL Injection / Upload
Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary
23RISK
open ↗Referência
CVE-2009-3368
Cross-site scripting (XSS) vulnerability in the Hotel Booking Reservation System (aka HBS or com_hbssearch) component fo
23RISK
open ↗Referência
CVE-2014-6420
Cross-site scripting (XSS) vulnerability in Livefyre LiveComments 3.0 allows remote attackers to inject arbitrary web sc
23RISK
open ↗Referência
CVE-2005-4415
Cross-site scripting (XSS) vulnerability in index.php in TML CMS 0.5 allows remote attackers to inject arbitrary web scr
23RISK
open ↗Referência
CVE-2019-9701
DLP 15.5 MP1 and all prior versions may be susceptible to a cross-site scripting (XSS) vulnerability, a type of issue th
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.