Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
78,137cataloged exploits
35,961CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,657GitHub PoC 14,424VulnCheck XDB 8,773Nuclei 4,340Metasploit 3,485✓ verified onlyrecentpopularrisk
22,657 exploits
Referência✓ VexDay Proof
InoutMailingListManager 3.1 - Remote Command Execution
InoutMailingListManager 3.1 and earlier allows remote attackers to access certain restricted functionality, and upload a
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke 8.0 Final - 'sid' SQL Injection
SQL injection vulnerability in index.php in the Search module in PHP-Nuke 8.0 FINAL and earlier, when magic_quotes_gpc i
23RISK
open ↗Referência
Sentrifugo 3.2 - Persistent Cross-Site Scripting
Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or
23RISK
open ↗Referência
CVE-2020-10220
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php
60RISK
open ↗Referência
CVE-2020-10220
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php
60RISK
open ↗Referência
CVE-2020-10220
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php
60RISK
open ↗Referência
CVE-2023-27040
Simple Image Gallery v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the username paramet
48RISK
open ↗Referência
CVE-2017-0115
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers
28RISK
open ↗Referência
CVE-2015-6516
SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitra
23RISK
open ↗Referência
CVE-2009-2218
Multiple PHP remote file inclusion vulnerabilities in phpCollegeExchange 0.1.5c, when register_globals is enabled, allow
23RISK
open ↗Referência
CVE-2009-3359
Multiple cross-site scripting (XSS) vulnerabilities in Match Agency BiZ 1.0 allow remote attackers to inject arbitrary w
23RISK
open ↗Referência
CVE-2009-3186
Multiple cross-site scripting (XSS) vulnerabilities in VideoGirls BiZ allow remote attackers to inject arbitrary web scr
23RISK
open ↗Referência✓ VexDay Proof
Angelo-Emlak 1.0 - Multiple SQL Injections
Cross-site scripting (XSS) vulnerability in hpz/admin/Default.asp in Angelo-Emlak 1.0 allows remote attackers to inject
23RISK
open ↗Referência
CVE-2009-3715
Multiple SQL injection vulnerabilities in scr_login.php in MCshoutbox 1.1, when magic_quotes_gpc is disabled, allow remo
23RISK
open ↗Referência✓ VexDay Proof
W1L3D4 philboard 1.2 - Blind SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in search.asp in W1L3D4 Philboard 1.14 and 1.2 allows remote attackers to injec
23RISK
open ↗Referência✓ VexDay Proof
phpcrs 2.06 - 'importFunction' Local File Inclusion
Directory traversal vulnerability in frame.php in phpcrs 2.06 and earlier, when magic_quotes_gpc is disabled, allows rem
23RISK
open ↗Referência
CVE-2018-18858
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
23RISK
open ↗Referência
CVE-2018-18858
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
23RISK
open ↗Referência✓ VexDay Proof
Yet Another NOCC 0.1.0 - Local File Inclusion
Directory traversal vulnerability in check_lang.php in Yet Another NOCC (YANOCC) 0.1.0 and earlier allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
LiveCMS 3.4 - 'categoria.php?cid' SQL Injection
Cross-site scripting (XSS) vulnerability in LiveCMS 3.4 and earlier allows remote attackers to inject arbitrary web scri
23RISK
open ↗Referência✓ VexDay Proof
Dokeos 1.8.4 - Arbitrary File Upload
Unrestricted file upload vulnerability in the "My productions" component for main/auth/profile.php (aka the "My profile"
23RISK
open ↗Referência
CVE-2015-6517
Cross-site request forgery (CSRF) vulnerability in phpLiteAdmin 1.1 allows remote attackers to hijack the authentication
23RISK
open ↗Referência
RAD SecFlow-1v SF_0290_2.3.01.26 - Persistent Cross-Site Scripting
A vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could allow an authenticated
23RISK
open ↗Referência✓ VexDay Proof
Barracuda Spam Firewall 3.5.11.020 Model 600 - SQL Injection
SQL injection vulnerability in index.cgi in the Account View page in Barracuda Spam Firewall (BSF) before 3.5.12.007 all
23RISK
open ↗Referência
CVE-2024-34833
Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Users can upload images via the "save_settin
48RISK
open ↗Referência
CVE-2010-3419
Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote atta
23RISK
open ↗Referência
CVE-2012-2105
Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitr
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.