Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,231cataloged exploits
35,420CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
UNAK-CMS 1.5 - 'connector.php' Local File Inclusion
Absolute path traversal vulnerability in fckeditor/editor/filemanager/browser/default/connectors/php/connector.php in UN
23RISK
open ↗Exploit-DB✓ VexDay Proof
XAMPP Linux 1.6 - 'iart.php?text' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in XAMPP 1.6.7, when register_globals is enabled, allow remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
Homes 4 Sale - 'results.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in result.php in Chris Bunting Homes 4 Sale allows remote attackers to inject a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Meeting Room Booking System (MRBS) 1.2.6 - 'month.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Meeting Room Booking System (MRBS) 1.2.6 allow remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Meeting Room Booking System (MRBS) 1.2.6 - 'report.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Meeting Room Booking System (MRBS) 1.2.6 allow remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Meeting Room Booking System (MRBS) 1.2.6 - 'search.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Meeting Room Booking System (MRBS) 1.2.6 allow remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Pcshey Portal - 'kategori.asp' SQL Injection
SQL injection vulnerability in kategori.asp in Pcshey Portal allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Exploit-DB✓ VexDay Proof
e-vision CMS 2.02 - SQL Injection / Arbitrary File Upload / Information Gathering
Multiple SQL injection vulnerabilities in e-Vision CMS 2.02 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Pligg CMS 9.9.5 - 'CAPTCHA' Registration Automation Security Bypass
The CAPTCHA implementation in (1) Pligg 9.9.5 and possibly (2) Francisco Burzi PHP-Nuke 8.1 provides a critical random n
23RISK
open ↗Exploit-DB✓ VexDay Proof
e-vision CMS 2.02 - SQL Injection / Arbitrary File Upload / Information Gathering
Unrestricted file upload vulnerability in admin/x_image.php in Szava Gyula and Csaba Tamas e-Vision CMS, probably 1.0, a
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Nuke Book Catalog Module 1.0 - 'catid' SQL Injection
SQL injection vulnerability in the Book Catalog module 1.0 for PHP-Nuke allows remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache Tomcat 6.0.16 - 'HttpServletResponse.sendError()' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through
45RISK
open ↗Exploit-DB✓ VexDay Proof
IrfanView 3.99 - '.IFF' File Local Stack Buffer Overflow
Buffer overflow in IrfanView 4.00 and earlier allows user-assisted remote attackers to execute arbitrary code via a craf
23RISK
open ↗Exploit-DB✓ VexDay Proof
freeForum 1.7 - 'acuparam' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in ZoneO-soft freeForum 1.7 allows remote attackers to inject arbitrary web scr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache Tomcat 6.0.16 - 'RequestDispatcher' Information Disclosure
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, pe
35RISK
open ↗Exploit-DB✓ VexDay Proof
libxslt 1.1.x - RC4 Encryption and Decryption functions Buffer Overflow
Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (a
28RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX 10.x - CoreGraphics Multiple Memory Corruption Vulnerabilities
Unspecified vulnerability in CoreGraphics in Apple Mac OS X 10.4.11 and 10.5.4 allows remote attackers to execute arbitr
28RISK
open ↗Exploit-DB✓ VexDay Proof
common Solutions csphonebook 1.02 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in common solutions csphonebook 1.02 allows remote attackers to in
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.x - 'net/ipv6/ip6_output.c' Null Pointer Dereference Denial of Service
The ip6_dst_lookup_tail function in net/ipv6/ip6_output.c in the Linux kernel before 2.6.27 does not properly handle cer
28RISK
open ↗Exploit-DB✓ VexDay Proof
MJGUEST 6.8 - 'Guestbook.js.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in guestbook.js.php in MJGuest 6.8 GT allows remote attackers to inject arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
Unreal Tournament 3 - Memory Corruption (Denial of Service)
Buffer overflow in Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (memory
28RISK
open ↗Exploit-DB✓ VexDay Proof
Pligg CMS 9.9.0 - Cross-Site Scripting / Local File Inclusion / SQL Injection
Multiple SQL injection vulnerabilities in submit.php in Pligg CMS 9.9.5 allow remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
Unreal Tournament 2004 - Null Pointer Remote Denial of Service
Unreal Tournament 2004 (UT2004) 3369 and earlier allows remote attackers to cause a denial of service (NULL pointer dere
23RISK
open ↗Exploit-DB✓ VexDay Proof
PozScripts Classified Ads Script - 'cid' SQL Injection
SQL injection vulnerability in showcategory.php in PozScripts Classified Ads allows remote attackers to execute arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Pligg CMS 9.9.0 - Remote Code Execution
Multiple SQL injection vulnerabilities in Pligg 9.9 and earlier allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
Eyeball MessengerSDK 'CoVideoWindow.ocx' 5.0.907 - ActiveX Control Remote Buffer Overflow
Buffer overflow in the CoVideoWindow.ocx ActiveX control 5.0.907.1 in Eyeball MessengerSDK, as used in products such as
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cisco IOS 12.3(18) (FTP Server) - Remote (Attached to GDB)
The FTP Server in Cisco IOS 11.3 through 12.4 does not properly check user authorization, which allows remote attackers
28RISK
open ↗Exploit-DB✓ VexDay Proof
e107 Plugin BLOG Engine 2.2 - Blind SQL Injection
SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Web Wiz Forum 9.5 - 'admin_category_details.asp?mode' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Web Wiz Forum 9.5 allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Web Wiz Forum 9.5 - 'admin_group_details.asp?mode' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Web Wiz Forum 9.5 allow remote attackers to inject arbitrary web
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.