Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,205cataloged exploits
35,417CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,266GitHub PoC 14,123VulnCheck XDB 8,617Nuclei 4,274Metasploit 3,474✓ verified onlyrecentpopularrisk
22,233 exploits
Referência✓ VexDay Proof
WebFileExplorer 3.1 - Authentication Bypass
SQL injection vulnerability in body.asp in Web File Explorer 3.1 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗Referência✓ VexDay Proof
2DayBiz Business Community Script - Multiple Vulnerabilities
SQL injection vulnerability in admin/member_details.php in 2daybiz Business Community Script allows remote attackers to
23RISK
open ↗Referência
CVE-2010-1583
SQL injection vulnerability in the loadByKey function in the TznDbConnection class in tzn_mysql.php in Tirzen (aka TZN)
23RISK
open ↗Referência
CVE-2010-3154
Untrusted search path vulnerability in Adobe Extension Manager CS5 5.0.298 allows local users, and possibly remote attac
28RISK
open ↗Referência✓ VexDay Proof
Intel 2200BG 802.11 - disassociation packet Kernel Memory Corruption
The Intel 2200BG 802.11 Wireless Mini-PCI driver 9.0.3.9 (w29n51.sys) allows remote attackers to cause a denial of servi
23RISK
open ↗Referência
CVE-2010-2909
SQL injection vulnerability in ttvideo.php in the TTVideo (com_ttvideo) component 1.0 for Joomla! allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
wpQuiz 2.7 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the id
23RISK
open ↗Referência
CVE-2015-5736
The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel
23RISK
open ↗Referência
CVE-2015-5736
The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel
23RISK
open ↗Referência✓ VexDay Proof
123tkShop 0.9.1 - Remote Authentication Bypass
SQL injection vulnerability in shop/mainfile.php in 123tkShop 0.9.1 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
CMS NetCat 3.12 - Multiple Vulnerabilities
Multiple open redirect vulnerabilities in AIST NetCat 3.12 and earlier allow remote attackers to redirect users to arbit
23RISK
open ↗Referência
CVE-2024-1783
Totolink LR1200GB Web Interface cstecgi.cgi loginAuth stack-based overflow
48RISK
open ↗Referência✓ VexDay Proof
PHPfan 3.3.4 - 'init.php' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/init.php in phpFan 3.3.4 allows remote attackers to execute arbitrar
23RISK
open ↗Referência
CVE-2010-2040
Cross-site scripting (XSS) vulnerability in search.php in V-EVA Shopzilla Affiliate Script PHP allows remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
OpenInvoice 0.9 - Arbitrary Change User Password
resetpass.php in openInvoice 0.90 beta and earlier allows remote authenticated users to change the passwords of arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Dagger CMS 2008 - 'dir_inc' Remote File Inclusion
PHP remote file inclusion vulnerability in skins/default.php in Geody Labs Dagger - The Cutting Edge r12feb2008, when re
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component gigCalendar 1.0 - SQL Injection
SQL injection vulnerability in the GigCalendar (com_gigcal) component 1.0 for Mambo and Joomla! allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
NetHoteles 3.0 - 'ficha.php' SQL Injection
SQL injection vulnerability in publico/ficha.php in NetHoteles 3.0 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência
CVE-2017-15971
Same Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php send
23RISK
open ↗Referência
CVE-2017-2528
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The
23RISK
open ↗Referência✓ VexDay Proof
phpBB Insert User Mod 0.1.2 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBB Insert User 0.1.2 and earlier allows
23RISK
open ↗Referência✓ VexDay Proof
PHP121 Instant Messenger 1.4 - Remote Code Execution
SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
Crea-Book 1.0 - Admin Access Bypass / Database Disclosure / Code Execution
Multiple direct static code injection vulnerabilities in admin/configurer2.php in Crea-Book 1.0 and earlier allow remote
23RISK
open ↗Referência
CVE-2019-19493
Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, lea
23RISK
open ↗Referência✓ VexDay Proof
W1L3D4 philboard 0.2 - 'W1L3D4_bolum.asp' SQL Injection
SQL injection vulnerability in W1L3D4_bolum.asp in W1L3D4 Philboard 0.2 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
QuickCart 2.0 - 'categories.php' Local File Inclusion
Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0, when register_globals is enabled and magic
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.