Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
80,930cataloged exploits
37,572CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,482Referência 23,973GitHub PoC 15,478VulnCheck XDB 9,069Nuclei 4,426Metasploit 3,502✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
Xaraya 1.0.0 RC4 - 'create()' Denial of Service
Directory traversal vulnerability in the create function in xarMLSXML2PHPBackend.php in Xaraya 1.0 allows remote attacke
23RISK
open ↗Exploit-DB✓ VexDay Proof
Post Affiliate Pro 2.0.4 - 'index.php' SQL Injection
SQL injection vulnerability in merchants/index.php in Post Affiliate Pro 2.0.4 and earlier allows remote attackers to ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
Orca Ringmaker 2.3 - 'Ringmaker.php' SQL Injection
SQL injection vulnerability in ringmaker.php in Orca Ringmaker 2.3c and earlier allows remote attackers to execute arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
FAQ System 1.1 - 'index.php?category_id' SQL Injection
Multiple SQL injection vulnerabilities in ilyav FAQ System 1.1 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Entergal MX 2.0 - Multiple SQL Injections
SQL injection vulnerability in index.php in Entergal MX 2.0 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Orca Blog 1.3 - 'blog.php' SQL Injection
SQL injection vulnerability in blog.php in Orca Blog 1.3b and earlier allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Exploit-DB✓ VexDay Proof
GhostScripter Amazon Shop 5.0 - 'search.php' SQL Injection
Cross-site scripting (XSS) vulnerability in search.php in GhostScripter Amazon Shop 5.0.0, and other versions before 5.0
23RISK
open ↗Exploit-DB✓ VexDay Proof
Orca KnowledgeBase 2.1 - 'KnowledgeBase.php' SQL Injection
SQL injection vulnerability in knowledgebase-control.php in Orca Knowledgebase 2.1b and earlier allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Metafile - 'gdi32.dll' Denial of Service (MS05-053)
Unspecified vulnerability in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2
35RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Upload Center - 'index.php' Directory Traversal
Directory traversal vulnerability in index.php in PHP Upload Center allows remote attackers to read arbitrary files via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fantastic Scripts Fantastic News 2.1.1 - 'news.php' SQL Injection
SQL injection vulnerability in news.php in Fantastic News 2.1.1 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
phpWordPress 3.0 - Multiple SQL Injections
SQL injection vulnerability in phpWordPress PHP News and Article Manager 3.0 allows remote attackers to execute arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Bedeng PSP 1.1 - 'index.php?a.nsub' SQL Injection
SQL injection vulnerability in Bedeng PSP 1.1 allows remote attackers to execute arbitrary SQL commands via the cwhere p
23RISK
open ↗Exploit-DB✓ VexDay Proof
Unalz 0.x - Archive Filename Buffer Overflow
Buffer overflow in unalz before 0.53 allows remote attackers to execute arbitrary code via long file names in ALZ archiv
28RISK
open ↗Exploit-DB✓ VexDay Proof
Helpdesk Issue Manager 0.x - 'find.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in Central Manchester CLC Helpdesk Issue Manager 0.9 and earlier allow remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
Randshop - Multiple SQL Injections
SQL injection vulnerability in themes/kategorie/index.php in Randshop allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Exploit-DB✓ VexDay Proof
Babe Logger 2.0 - 'index.php?gal' SQL Injection
SQL injection vulnerability in Babe Logger 2 allows remote attackers to execute arbitrary SQL commands via the (1) gal p
23RISK
open ↗Exploit-DB✓ VexDay Proof
GuppY 4.5 - 'nwlmail.php?lng' Traversal Arbitrary File Access
Multiple directory traversal vulnerabilities in GuppY 4.5.9 and earlier allow remote attackers to read and include arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
UGroup 2.6.2 - 'forum.php?FORUM_ID' SQL Injection
Multiple SQL injection vulnerabilities in Ugroup 2.6.2 and earlier allow remote attackers to execute arbitrary SQL comma
23RISK
open ↗Exploit-DB✓ VexDay Proof
AllWeb Search 3.0 - SQL Injection
SQL injection vulnerability in index.php in AllWeb search 3.0 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗Exploit-DB✓ VexDay Proof
Guppy 4.5.9 - 'REMOTE_ADDR' Remote Command Execution
Direct static code injection vulnerability in error.php in GuppY 4.5.9 and earlier, when register_globals is disabled, a
23RISK
open ↗Exploit-DB✓ VexDay Proof
GuppY 4.5 - 'editorTypetool.php?meskin' Traversal Arbitrary File Access
Multiple directory traversal vulnerabilities in GuppY 4.5.9 and earlier allow remote attackers to read and include arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Zainu 2.0 - SQL Injection
Multiple SQL injection vulnerabilities in the search action in Zainu 2.0 and earlier allow remote attackers to execute a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Softbiz Resource Repository Script - 'details_res.php?sbres_id' SQL Injection
Multiple SQL injection vulnerabilities in Softbiz Resource Repository Script 1.1 and earlier allow remote attackers to e
23RISK
open ↗Exploit-DB✓ VexDay Proof
Top Music Module 3.0 - SQL Injection
Multiple SQL injection vulnerabilities in SergiDs Top Music module 3.0 PR3 and earlier for PHP-Nuke allow remote attacke
23RISK
open ↗Exploit-DB✓ VexDay Proof
GuppY 4.5 - 'dbbatch.php?lng' Traversal Arbitrary File Access
Multiple directory traversal vulnerabilities in GuppY 4.5.9 and earlier allow remote attackers to read and include arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Softbiz Resource Repository Script - 'report_link.php?sbres_id' SQL Injection
Multiple SQL injection vulnerabilities in Softbiz Resource Repository Script 1.1 and earlier allow remote attackers to e
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Doc System 1.5.1 - Local File Inclusion
Directory traversal vulnerability in index.php in PHP Doc System 1.5.1 and earlier allows remote attackers to access or
23RISK
open ↗Exploit-DB✓ VexDay Proof
Bedeng PSP 1.1 - 'download.php?a.ngroup' SQL Injection
SQL injection vulnerability in Bedeng PSP 1.1 allows remote attackers to execute arbitrary SQL commands via the cwhere p
23RISK
open ↗Exploit-DB✓ VexDay Proof
BerliOS SourceWell 1.1.3 - SQL Injection
SQL injection vulnerability in index.php in SourceWell 1.1.2 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.