Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,533cataloged exploits
35,607CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,407GitHub PoC 14,247VulnCheck XDB 8,663Nuclei 4,287Metasploit 3,474✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
eNdonesia 8.4 - 'banners.php?click Action bid' SQL Injection
Multiple SQL injection vulnerabilities in eNdonesia 8.4 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyServer 0.8.9 - Filename Parse Error Information Disclosure
MyServer 0.8.9 and earlier does not properly handle uppercase characters in filename extensions, which allows remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
BugHunter HTTP Server 1.6.2 - 'httpsv.exe' GET 404 Remote Denial of Service
BugHunter HTTP SERVER (httpsv.exe) 1.6.2 allows remote attackers to cause a denial of service (application crash) via a
23RISK
open ↗Exploit-DB✓ VexDay Proof
NetClassifieds 1.9.7 - Multiple Input Validation Vulnerabilities
Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition allow remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPAccounts 0.5 - 'index.php' Local File Inclusion
Directory traversal vulnerability in index.php in PHPAccounts 0.5 allows remote attackers to include arbitrary local fil
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ingress Database Server 2.6 - Multiple Remote Vulnerabilities
Multiple heap-based buffer overflows in the (1) Communications Server (iigcc.exe) and (2) Data Access Server (iigcd.exe)
28RISK
open ↗Exploit-DB✓ VexDay Proof
BugHunter HTTP Server 1.6.2 - Parse Error Information Disclosure
httpsv.exe in HTTP Server 1.6.2 allows remote attackers to obtain sensitive information (script source code) via a URI w
23RISK
open ↗Exploit-DB✓ VexDay Proof
W1L3D4 WEBmarket 0.1 - SQL Injection
SQL injection vulnerability in urunbak.asp in W1L3D4 WEBmarket 0.1 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Exploit-DB✓ VexDay Proof
FuseTalk 4.0 - 'AuthError.cfm' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, En
23RISK
open ↗Exploit-DB✓ VexDay Proof
FuseTalk 4.0 - 'blog/include/common/comfinish.cfm?FTVAR_SCRIPTRUN' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, En
23RISK
open ↗Exploit-DB✓ VexDay Proof
Comersus Cart 7.0.7 - 'comersus_customerAuthenticateForm.asp' redirectUrl Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Comersus Cart 7.07 allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
FuseTalk 4.0 - 'forum/include/common/comfinish.cfm?FTVAR_SCRIPTRUN' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, En
23RISK
open ↗Exploit-DB✓ VexDay Proof
Comersus Cart 7.0.7 - 'comersus_optReviewReadExec.asp?id' SQL Injection
SQL injection vulnerability in comersus_optReviewReadExec.asp in Comersus Shop Cart 7.07 allows remote attackers to exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Comersus Cart 7.0.7 - 'comersus_message.asp' redirectUrl Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Comersus Cart 7.07 allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
FuseTalk 2.0/3.0 - 'AuthError.cfm' SQL Injection
SQL injection vulnerability in forum/include/error/autherror.cfm in FuseTalk allows remote attackers to execute arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fuzzylime 1.0 - 'Low.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in low.php in Fuzzylime Forum 1.01b and earlier allows remote attackers to inje
23RISK
open ↗Exploit-DB✓ VexDay Proof
TDizin - 'Arama.asp' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in arama.asp in TDizin allows remote attackers to inject arbitrary web script o
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebIf - 'OutConfig' Local File Inclusion
Directory traversal vulnerability in webif.cgi in ifnet WEBIF allows remote attackers to include and execute arbitrary l
23RISK
open ↗Exploit-DB✓ VexDay Proof
WSPortal 1.0 - 'content.php' SQL Injection
content.php in WSPortal 1.0, when magic_quotes_gpc is disabled, allows remote attackers to obtain sensitive information
23RISK
open ↗Exploit-DB✓ VexDay Proof
YourFreeScreamer 1.0 - 'serverPath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in YourFreeScreamer 1.0, when register_globals is enabled, allow remo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Safari 3.0.1 for Windows - 'Corefoundation.dll' Denial of Service
corefoundation.dll in Apple Safari 3.0.1 (552.12.2) for Windows allows remote attackers to cause a denial of service (cr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kaspersky Internet Security 6.0 - SSDT Hooks Multiple Local Vulnerabilities
klif.sys in Kaspersky Internet Security 6.0 and 7.0, Kaspersky Anti-Virus (KAV) 6.0 and 7.0, KAV 6.0 for Windows Worksta
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache Tomcat 6.0.13 - JSP Example Web Applications Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomca
60RISK
open ↗Exploit-DB✓ VexDay Proof
Apache MyFaces Tomahawk JSF Framework 1.1.5 - 'Autoscroll' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6
35RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Letterman Subscriber Module 1.2.4 - 'Mod_Lettermansubscribe.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in mod_lettermansubscribe.php in the Letterman Subscriber (mod_letterman) befor
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Speech API ActiveX Control (Windows 2000 SP4) - Remote Buffer Overflow (MS07-033)
Multiple buffer overflows in the (1) ActiveListen (Xlisten.dll) and (2) ActiveVoice (Xvoice.dll) speech controls, as use
35RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Speech API ActiveX Control (Windows XP SP2) - Remote Buffer Overflow (MS07-033)
Multiple buffer overflows in the (1) ActiveListen (Xlisten.dll) and (2) ActiveVoice (Xvoice.dll) speech controls, as use
35RISK
open ↗Exploit-DB✓ VexDay Proof
Firebird SQL Fbserver 2.0 - Remote Buffer Overflow
Buffer overflow in fbserver.exe in Firebird SQL 2 before 2.0.1 allows remote attackers to execute arbitrary code via a l
28RISK
open ↗Exploit-DB✓ VexDay Proof
Mbedthis AppWeb 2.2.2 - URL Protocol Format String
Format string vulnerability in the MprLogToFile::logEvent function in Mbedthis AppWeb 2.0.5-4, when the build supports l
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Safari 3 for Windows - Protocol Handler Command Injection
Apple Safari Beta 3.0.1 for Windows allows remote attackers to execute arbitrary commands via shell metacharacters in a
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.