Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
78,137cataloged exploits
35,961CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,657GitHub PoC 14,424VulnCheck XDB 8,773Nuclei 4,340Metasploit 3,485✓ verified onlyrecentpopularrisk
22,657 exploits
Referência
CVE-2013-5748
Cross-site request forgery (CSRF) vulnerability in management/prioritize_planning.php in SimpleRisk before 20130916-001
23RISK
open ↗Referência✓ VexDay Proof
Siteframe CMS 3.2.3 - 'folder.php' SQL Injection
SQL injection vulnerability in folder.php in Siteframe CMS 3.2.3 and earlier, and Siteframe Beaumont 5.0.5 and earlier,
23RISK
open ↗Referência
CVE-2021-47812
GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)
48RISK
open ↗Referência
CVE-2026-16650
Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass
33RISK
open ↗Referência
CVE-2017-16568
Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality.
23RISK
open ↗Referência✓ VexDay Proof
cwmCounter 5.1.1 - 'statistic.php' Remote File Inclusion
PHP remote file inclusion vulnerability in statistic.php in cwmCounter 5.1.1 and earlier allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
HIOX Browser Statistics 2.0 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in HIOX Browser Statistics (HBS) 2.0 allow remote attackers to execut
23RISK
open ↗Referência✓ VexDay Proof
clickandemail - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in admin_dblayers.asp in ClickAndEmail allows remote attackers to inject arbitr
23RISK
open ↗Referência✓ VexDay Proof
Simple Machines Forum (SMF) 1.1.6 - Code Execution
Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 all
23RISK
open ↗Referência✓ VexDay Proof
MGB 0.5.4.5 - 'email.php?id' SQL Injection
SQL injection vulnerability in email.php in MGB OpenSource Guestbook 0.5.4.5 and earlier allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
Webyapar 2.0 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Webyapar 2.0 allow remote attackers to execute arbitrary SQL commands via (1)
23RISK
open ↗Referência
CVE-2023-27040
Simple Image Gallery v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the username paramet
48RISK
open ↗Referência
CVE-2017-0115
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers
28RISK
open ↗Referência
CVE-2015-6516
SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitra
23RISK
open ↗Referência
CVE-2009-2218
Multiple PHP remote file inclusion vulnerabilities in phpCollegeExchange 0.1.5c, when register_globals is enabled, allow
23RISK
open ↗Referência
CVE-2009-3359
Multiple cross-site scripting (XSS) vulnerabilities in Match Agency BiZ 1.0 allow remote attackers to inject arbitrary w
23RISK
open ↗Referência
CVE-2009-3186
Multiple cross-site scripting (XSS) vulnerabilities in VideoGirls BiZ allow remote attackers to inject arbitrary web scr
23RISK
open ↗Referência✓ VexDay Proof
Angelo-Emlak 1.0 - Multiple SQL Injections
Cross-site scripting (XSS) vulnerability in hpz/admin/Default.asp in Angelo-Emlak 1.0 allows remote attackers to inject
23RISK
open ↗Referência
CVE-2009-3715
Multiple SQL injection vulnerabilities in scr_login.php in MCshoutbox 1.1, when magic_quotes_gpc is disabled, allow remo
23RISK
open ↗Referência✓ VexDay Proof
W1L3D4 philboard 1.2 - Blind SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in search.asp in W1L3D4 Philboard 1.14 and 1.2 allows remote attackers to injec
23RISK
open ↗Referência✓ VexDay Proof
phpcrs 2.06 - 'importFunction' Local File Inclusion
Directory traversal vulnerability in frame.php in phpcrs 2.06 and earlier, when magic_quotes_gpc is disabled, allows rem
23RISK
open ↗Referência
CVE-2018-18858
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
23RISK
open ↗Referência
CVE-2018-18858
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
23RISK
open ↗Referência✓ VexDay Proof
Yet Another NOCC 0.1.0 - Local File Inclusion
Directory traversal vulnerability in check_lang.php in Yet Another NOCC (YANOCC) 0.1.0 and earlier allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
LiveCMS 3.4 - 'categoria.php?cid' SQL Injection
Cross-site scripting (XSS) vulnerability in LiveCMS 3.4 and earlier allows remote attackers to inject arbitrary web scri
23RISK
open ↗Referência✓ VexDay Proof
Dokeos 1.8.4 - Arbitrary File Upload
Unrestricted file upload vulnerability in the "My productions" component for main/auth/profile.php (aka the "My profile"
23RISK
open ↗Referência
CVE-2015-6517
Cross-site request forgery (CSRF) vulnerability in phpLiteAdmin 1.1 allows remote attackers to hijack the authentication
23RISK
open ↗Referência
RAD SecFlow-1v SF_0290_2.3.01.26 - Persistent Cross-Site Scripting
A vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could allow an authenticated
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.