Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,837cataloged exploits
35,811CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,572GitHub PoC 14,291VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
VBZooM Forum 1.11 - 'contact.php?UserID' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in vbzoom 1.11 allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
VBZooM Forum 1.11 - 'comment.php?UserID' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in vbzoom 1.11 allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
Easy Forum 2.5 - New User Image File HTML Injection
Cross-site scripting vulnerability in Easy Forum 2.5 allows remote attackers to inject arbitrary web script or HTML via
23RISK
open ↗Exploit-DB✓ VexDay Proof
CutePHP CuteNews 1.4.1 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTM
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyBulletinBoard (MyBB) 1.04 - 'misc.php' SQL Injection (2)
SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when register_globals is enabled, allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
NZ eCommerce System - 'index.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
LogIT 1.3/1.4 - Remote File Inclusion
PHP remote file include vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a U
23RISK
open ↗Exploit-DB✓ VexDay Proof
vBulletin 3.0/3.5 - 'profile.php?Email' HTML Injection
Cross-site scripting (XSS) vulnerability in vBulletin 3.0.12 and 3.5.3 allows remote attackers to inject arbitrary web s
23RISK
open ↗Exploit-DB✓ VexDay Proof
PluggedOut Nexus 0.1 - 'forgotten_password.php' SQL Injection
SQL injection vulnerability in forgotten_password.php in Jonathan Beckett PluggedOut Nexus 0.1 allows remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
DCI-Designs Dawaween 1.03 - 'Poems.php' SQL Injection
SQL injection vulnerability in poems.php in DCI-Designs Dawaween 1.03 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Mail.App 10.5.0 (OSX) - Image Attachment Command Execution (Metasploit)
The Download Validation in Mail in Mac OS X 10.4 does not properly recognize attachment file types to warn a user of an
50RISK
open ↗Exploit-DB✓ VexDay Proof
SMBlog 1.2 - Arbitrary PHP Command Execution
PHP remote file include vulnerability in index.php in SMartBlog (aka SMBlog) 1.2 allows remote attackers to include and
23RISK
open ↗Exploit-DB✓ VexDay Proof
Limbo CMS 1.0.4.2 - 'itemID' Remote Code Execution
The frontpage option in Limbo CMS 1.0.4.2 and 1.0.4.1 allows remote attackers to execute arbitrary PHP commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
Woltlab Burning Board 2.x - Datenbank MOD 'fileid' SQL Injection
SQL injection vulnerability in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allows remote attackers to execut
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX - '/usr/bin/passwd' Custom Passwd Privilege Escalation
passwd in Directory Services in Mac OS X 10.3.x before 10.3.9 and 10.4.x before 10.4.5 allows local users to create arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
phpRPC Library 0.7 - XML Data Decoding Remote Code Execution (1)
Eval injection vulnerability in the decode function in rpc_decoder.php for phpRPC 0.7 and earlier, as used by runcms, ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 4.x/5.0/5.1 with Sendmail Mail Function - 'additional_param' Arbitrary File Creation
Argument injection vulnerability in certain PHP 3.x, 4.x, and 5.x applications, when used with sendmail and when accepti
28RISK
open ↗Exploit-DB✓ VexDay Proof
Farsinews 2.5 - Directory Traversal Arbitrary 'users.db' Access
Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to (1) read arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kerio Personal Firewall 2.1.4 - Remote Authentication Packet Overflow (Metasploit)
Buffer overflow in the administrator authentication process for Kerio Personal Firewall (KPF) 2.1.4 and earlier allows r
50RISK
open ↗Exploit-DB✓ VexDay Proof
FreeBSD 6.0 - 'nfsd' Remote Kernel Panic (Denial of Service)
nfsd in FreeBSD 6.0 kernel allows remote attackers to cause a denial of service via a crafted NFS mount request, as demo
50RISK
open ↗Exploit-DB✓ VexDay Proof
PEHEPE Membership Management System 3.0 - Remote PHP Script Code Injection
PHP remote file include vulnerability in sol_menu.php in PeHePe Uyelik Sistemi (aka PeHePe MemberShip Management System)
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 4.x/5.0/5.1 - 'mb_send_mail()' Restriction Bypass
Argument injection vulnerability in certain PHP 4.x and 5.x applications, when used with sendmail and when accepting rem
23RISK
open ↗Exploit-DB✓ VexDay Proof
QwikiWiki 1.4 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in QwikiWiki 1.4 allows remote attackers to inject arbitrary web s
23RISK
open ↗Exploit-DB✓ VexDay Proof
EJ3 TOPo 2.2.178 - 'Inc_header.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in inc_header.php in EJ3 TOPo 2.2.178 allows remote attackers to inject arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Thunderbird 1.5 - Multiple Remote Information Disclosure Vulnerabilities
The HTML rendering engine in Mozilla Thunderbird 1.5, when "Block loading of remote images in mail messages" is enabled,
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alt-N MDaemon 8.1.1 IMAP Server - Remote Format String
Format string vulnerability in the IMAP4rev1 server in Alt-N MDaemon 8.1.1 and possibly 8.1.4 allows remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fantastic News 2.1.1 - SQL Injection
SQL injection vulnerability in news.php in Tony Baird Fantastic News 2.1.1 allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
n8cms 1.1/1.2 - 'mailto.php?userid' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in N8cms 1.1 and 1.2 allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
n8cms 1.1/1.2 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in N8cms 1.1 and 1.2 allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Woltlab Burning Board 1.1.1/2.x - 'galerie_index.php?Username' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Woltlab Burning Board (wBB) allow remote attackers to inject arbi
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.