Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
19,067 exploits
Exploit-DB✓ VexDay Proof
RedCMS 0.1 - 'profile.php?u' SQL Injection
Multiple SQL injection vulnerabilities in RedCMS 0.1 allow remote attackers to execute arbitrary SQL commands via the (1
23RISK
open ↗Exploit-DB✓ VexDay Proof
RedCMS 0.1 - 'register.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in register.php in RedCMS 0.1 allow remote attackers to inject arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Claroline 1.x - 'rqmkhtml.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in document/rqmkhtml.php in Claroline 1.7.4 and earlier allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
SoftBiz Image Gallery - 'suggest_image.php?cid' SQL Injection
Multiple SQL injection vulnerabilities in Softbiz Image Gallery allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
SoftBiz Image Gallery - 'template.php?provided' SQL Injection
Multiple SQL injection vulnerabilities in Softbiz Image Gallery allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
RedCMS 0.1 - 'login.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in RedCMS 0.1 allow remote attackers to execute arbitrary SQL commands via the (1
23RISK
open ↗Exploit-DB✓ VexDay Proof
Claroline 1.x - 'rqmkhtml.php' Information Disclosure
Cross-site scripting (XSS) vulnerability in document/rqmkhtml.php in Claroline 1.7.4 and earlier allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
Blank'N'Berg 0.2 - Directory Traversal
Directory traversal vulnerability in index.php in Blank'N'Berg 0.2 allows remote attackers to read arbitrary files via a
23RISK
open ↗Exploit-DB✓ VexDay Proof
DbbS 2.0 - 'Topics.php' SQL Injection
SQL injection vulnerability in topics.php in Dynamic Bulletin Board System (DbbS) 2.0-alpha and earlier allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
O2PHP Oxygen 1.0/1.1 - 'post.php' SQL Injection
SQL injection vulnerability in post.php in Oxygen 1.1.3 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Exploit-DB✓ VexDay Proof
MediaSlash Gallery - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in MediaSlash Gallery allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
X-Changer 0.20 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in X-Changer 0.2 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
VNews 1.2 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in vscripts (aka Kuba Kunkiewicz) VNews 1.2 allow remote attackers to execute arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
PhxContacts 0.93 - 'contact_view.php?id_contact' SQL Injection
Multiple SQL injection vulnerabilities in Phoetux.net PhxContacts 0.93.1 beta and earlier allow remote attackers to exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 4.x/5.x - 'Html_Entity_Decode()' Information Disclosure
PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script
28RISK
open ↗Exploit-DB✓ VexDay Proof
PhxContacts 0.93 - 'carnet.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in Phoetux.net PhxContacts 0.93.1 beta and earlier allow remote attackers to exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
PhxContacts 0.93 - 'login.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in login.php in Phoetux.net PhxContacts 0.93.1 beta and earlier allows remote a
23RISK
open ↗Exploit-DB✓ VexDay Proof
OneOrZero 1.6.3 Helpdesk - 'index.php' SQL Injection
SQL injection vulnerability in index.php in OneOrZero 1.6.3.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
CONTROLzx Hms 3.3.4 - 'shared_order.php?sharedPlanID' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in CONTROLzx HMS (formerly DRZES) 3.3.4 and earlier allow remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
Connect Daily 3.2.8/3.2.9 - 'ViewDay.html' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in MH Software Connect Daily Web Calendar Software 3.2.9 and earlier
23RISK
open ↗Exploit-DB✓ VexDay Proof
AL-Caricatier 2.5 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in view_caricatier.php in AL-Caricatier 2.5 allow remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Arab Portal 2.0 - 'download.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Arab Portal 2.0 (aka Arab Dynamic Portal or ADP) stable allow rem
23RISK
open ↗Exploit-DB✓ VexDay Proof
phpMyFamily 1.4.1 - 'Track.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in track.php in phpmyfamily 1.4.1 allows remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
Connect Daily 3.2.8/3.2.9 - 'ViewCal.html?item_type_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in MH Software Connect Daily Web Calendar Software 3.2.9 and earlier
23RISK
open ↗Exploit-DB✓ VexDay Proof
Arab Portal 2.0 - 'online.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Arab Portal 2.0 (aka Arab Dynamic Portal or ADP) stable allow rem
23RISK
open ↗Exploit-DB✓ VexDay Proof
RealPlayer 10.5 (6.0.12.1040-1348) - SWF Buffer Overflow (PoC)
Buffer overflow in swfformat.dll in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Playe
28RISK
open ↗Exploit-DB✓ VexDay Proof
CONTROLzx Hms 3.3.4 - 'server_management.php?plan_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in CONTROLzx HMS (formerly DRZES) 3.3.4 and earlier allow remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
Connect Daily 3.2.8/3.2.9 - 'ViewSearch.html' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in MH Software Connect Daily Web Calendar Software 3.2.9 and earlier
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPCOIN 1.2 - 'mod.php?fs' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in phpCOIN 1.2.2 and earlier allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
CONTROLzx Hms 3.3.4 - 'dedicated_order.php?dedicatedPlanID' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in CONTROLzx HMS (formerly DRZES) 3.3.4 and earlier allow remote att
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.