Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
24,696 exploits
Exploit-DB✓ VexDay Proof
Hosting Controller 0.6.1 - User Registration (2)
Hosting Controller 6.1 Hotfix 1.9 and earlier allows remote attackers to register arbitrary users via a direct request t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ethereal 0.10.10 - 'dissect_ipc_state' Remote Denial of Service
Multiple unknown vulnerabilities in the (1) TZSP, (2) MGCP, (3) ISUP, (4) SMB, or (5) Bittorrent dissectors in Ethereal
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 1.0.3 - Install Method Arbitrary Code Execution
The install function in Firefox 1.0.3 allows remote web sites on the browser's whitelist, such as update.mozilla.org or
28RISK
open ↗Exploit-DB✓ VexDay Proof
Apache 1.3.x - HTDigest Realm Command Line Argument Buffer Overflow (1)
Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. N
28RISK
open ↗Exploit-DB✓ VexDay Proof
4D WebSTAR 5.3/5.4 Tomcat Plugin - Remote Buffer Overflow
Buffer overflow in the Tomcat plugin in 4d WebSTAR 5.33 and 5.4 allows remote attackers to cause a denial of service and
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Advanced Transfer Manager 1.21 - Arbitrary File Upload
PHP Advanced Transfer Manager (phpATM) 1.21 allows remote attackers to upload arbitrary files via filenames containing m
23RISK
open ↗Exploit-DB✓ VexDay Proof
CJ Ultra Plus 1.0.3/1.0.4 - 'OUT.php' SQL Injection
SQL injection vulnerability in out.php in CJ Ultra (CJUltra) Plus 1.0.3 and 1.0.4 allows remote attackers to execute arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
MidiCart PHP - 'Search_List.php?SearchString' SQL Injection
Multiple SQL injection vulnerabilities in MidiCart PHP Shopping Cart allow remote attackers to execute arbitrary SQL com
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyBloggie 2.1 - 'index.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in myBloggie 2.1.1 allow remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
MegaBook 2.0/2.1 - 'Admin.cgi?EntryID' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in admin.cgi in MegaBook 2.0 and 2.1 allow remote attackers to injec
23RISK
open ↗Exploit-DB✓ VexDay Proof
software602 602 lan suite 2004 - Directory Traversal
Directory traversal vulnerability in the mail program in 602LAN SUITE 2004.0.05.0413 allows remote attackers to cause a
23RISK
open ↗Exploit-DB✓ VexDay Proof
FishCart 3.1 - 'upstracking.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting vulnerabilities in FishCart 3.1 allow remote attackers to inject arbitrary web script or H
23RISK
open ↗Exploit-DB✓ VexDay Proof
Gossamer Threads Links 2.x - 'User.cgi' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in user.cgi in Gossamer Threads Links SQL 2.x and 3.0 allows remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Hosting Controller 0.6.1 - User Registration (1)
Hosting Controller 6.1 Hotfix 1.9 and earlier allows remote attackers to register arbitrary users via a direct request t
23RISK
open ↗Exploit-DB✓ VexDay Proof
FishCart 3.1 - 'display.php?psku' SQL Injection
Multiple SQL injection vulnerabilities in FishCart 3.1 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
FishCart 3.1 - 'upstnt.php?cartid' SQL Injection
Multiple SQL injection vulnerabilities in FishCart 3.1 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
I-Mall Commerce - 'i-mall.cgi' Remote Command Execution
i-mall.cgi in I-Mall Commerce allows remote attackers to execute arbitrary commands via shell metacharacters via the p p
28RISK
open ↗Exploit-DB✓ VexDay Proof
FishCart 3.1 - 'display.php?nlst' Cross-Site Scripting
Multiple cross-site scripting vulnerabilities in FishCart 3.1 allow remote attackers to inject arbitrary web script or H
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX 10.x - BlueTooth Directory Traversal
Directory traversal vulnerability in the Bluetooth file and object exchange (OBEX) services in Mac OS X 10.3.9 allows re
23RISK
open ↗Exploit-DB✓ VexDay Proof
simplecam 1.2 - Directory Traversal
Directory traversal vulnerability in SimpleCam 1.2 allows remote attackers to read arbitrary files via a ..\ (dot dot ba
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebCrossing WebX 5.0 - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in WebX in Web Crossing 5.x allows remote attackers to inject arbitrary web scr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Maxwebportal 1.3 - 'pic_popular.asp' SQL Injection
Multiple SQL injection vulnerabilities in MaxWebPortal 2.x, 1.35, and other versions allow remote attackers to execute a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mtp-Target 1.2.2 Client - Remote Format String
Format string vulnerability in the client for Mtp-Target 1.2.2 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
CodetoSell ViArt Shop Enterprise 2.1.6 - 'page.php?page' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ViArt Shop Enterprise 2.1.6 allow remote attackers to inject arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
CodetoSell ViArt Shop Enterprise 2.1.6 - 'reviews.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in ViArt Shop Enterprise 2.1.6 allow remote attackers to inject arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Maxwebportal 1.3 - 'dl_toprated.asp' SQL Injection
Multiple SQL injection vulnerabilities in MaxWebPortal 2.x, 1.35, and other versions allow remote attackers to execute a
23RISK
open ↗Exploit-DB✓ VexDay Proof
CodetoSell ViArt Shop Enterprise 2.1.6 - 'news_view.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in ViArt Shop Enterprise 2.1.6 allow remote attackers to inject arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
CodetoSell ViArt Shop Enterprise 2.1.6 - 'products.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in ViArt Shop Enterprise 2.1.6 allow remote attackers to inject arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Maxwebportal 1.3 - 'links_popular.asp' SQL Injection
Multiple SQL injection vulnerabilities in MaxWebPortal 2.x, 1.35, and other versions allow remote attackers to execute a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Maxwebportal 1.3 - 'custom_link.asp' Multiple SQL Injections
Multiple SQL injection vulnerabilities in MaxWebPortal 2.x, 1.35, and other versions allow remote attackers to execute a
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.