Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,494 exploits
Referência✓ VexDay Proof
Joomla! Component Pony Gallery 1.5 - SQL Injection
SQL injection vulnerability in index.php in the Pony Gallery (com_ponygallery) 1.5 and earlier component for Joomla! all
23RISK
open ↗Referência✓ VexDay Proof
xGB 2.0 - 'xGB.php' Remote Security Bypass
xGB.php in xGB 2.0 does not require authentication for an admin edit action, which allows remote attackers to make unspe
23RISK
open ↗Referência✓ VexDay Proof
PHPizabi 0.848b C1 HFP3 - Database Information Disclosure
The AssignUser function in template.class.php in PHPizabi 0.848b C1 HFP3 performs unsafe macro expansions on strings del
23RISK
open ↗Referência✓ VexDay Proof
DreamNews Manager - 'id' SQL Injection
SQL injection vulnerability in dreamnews-rss.php in DreamNews Manager allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência
CVE-2015-5465
Silicon Integrated Systems WindowsXP Display Manager (aka VGA Driver Manager and VGA Display Manager) 6.14.10.3930 allow
23RISK
open ↗Referência✓ VexDay Proof
sma-db 0.3.12 - Remote File Inclusion / Cross-Site Scripting
PHP remote file inclusion vulnerability in format.php in SMA-DB 0.3.12 allows remote attackers to execute arbitrary PHP
23RISK
open ↗Referência
CVE-2017-5223
An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML docume
23RISK
open ↗Referência
CVE-2019-9978
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio
100RISK
open ↗Referência
Collabtive 3.1 - 'address' Persistent Cross-Site Scripting
Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit
23RISK
open ↗Referência
CVE-2009-3511
Multiple PHP remote file inclusion vulnerabilities in justVisual 1.2 allow remote attackers to execute arbitrary PHP cod
23RISK
open ↗Referência
CVE-2008-0158
Directory traversal vulnerability in index.php in Shop-Script 2.0 and possibly other versions allows remote attackers to
23RISK
open ↗Referência
CVE-2026-97883
mathurvishal CloudClassroom-PHP-Project updatequery.php sql injection
33RISK
open ↗Referência
CVE-2013-3721
SQL injection vulnerability in awards.php in PsychoStats 3.2.2b allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência
CVE-2014-5104
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
UltraISO 8.6.2.2011 - '.cue/'.bin' Local Buffer Overflow (PoC)
Stack-based buffer overflow in UltraISO 8.6.2.2011 and earlier allows user-assisted remote attackers to execute arbitrar
50RISK
open ↗Referência✓ VexDay Proof
MFORUM 0.1a - Arbitrary Add Admin
Multiple SQL injection vulnerabilities in usercp.php in mForum 0.1a, when magic_quotes_gpc is disabled, allow remote att
23RISK
open ↗Referência
CVE-2026-78393
Link Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb Links
33RISK
open ↗Referência✓ VexDay Proof
Million Dollar Text Links 1.0 - Arbitrary Authentication Bypass
Million Dollar Text Links 1.0 does not properly restrict administrator access to admin.home.php, which allows remote att
23RISK
open ↗Referência
CVE-2014-9237
SQL injection vulnerability in Proticaret E-Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via a
23RISK
open ↗Referência
CVE-2026-4163
Wavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injection
48RISK
open ↗Referência✓ VexDay Proof
Vistered Little 1.6a - 'skin' Remote File Disclosure
Directory traversal vulnerability in skins/common.css.php in Vistered Little 1.6a allows remote attackers to read arbitr
23RISK
open ↗Referência
CVE-2014-4943
The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by
23RISK
open ↗Referência
CVE-2009-4156
PHP remote file inclusion vulnerability in modules/pms/index.php in Ciamos CMS 0.9.5 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
DesktopOnNet 3 Beta - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in DesktopOnNet 3 Beta allow remote attackers to execute arbitrary PH
23RISK
open ↗Referência
CVE-2010-1106
PHP remote file inclusion vulnerability in cgi/index.php in AdvertisementManager 3.1.0 allows remote attackers to execut
23RISK
open ↗Referência
CVE-2018-5479
FoxSash ImgHosting 1.5 (according to footer information) is vulnerable to XSS attacks. The affected function is its sear
23RISK
open ↗Referência✓ VexDay Proof
Ultimate PHP Board 2.2.1 - Privilege Escalation
Cross-site scripting (XSS) vulnerability in Ultimate PHP Board (UPB) 2.2.2, 2.2.1, and earlier 2.x versions allows remot
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.