Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,900cataloged exploits
36,847CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,475Referência 23,360GitHub PoC 15,228VulnCheck XDB 8,946Nuclei 4,390Metasploit 3,501✓ verified onlyrecentpopularrisk
24,475 exploits
Exploit-DB✓ VexDay Proof
MachForm < 4.2.3 - SQL Injection / Path Traversal / Upload Bypass
An issue was discovered in Appnitro MachForm before 4.2.3. There is a download.php SQL injection via the q parameter.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dolibarr ERP/CRM 7.0.0 - (Authenticated) SQL Injection
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vecto
60RISK
open ↗Exploit-DB
Procps-ng - Multiple Vulnerabilities
procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() return
28RISK
open ↗Exploit-DB
Procps-ng - Multiple Vulnerabilities
procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec
41RISK
open ↗Exploit-DB
Procps-ng - Multiple Vulnerabilities
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset
41RISK
open ↗Exploit-DB
Procps-ng - Multiple Vulnerabilities
A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory
28RISK
open ↗Exploit-DB
NUUO NVRmini2 / NVRsolo - Arbitrary File Upload
upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files.
23RISK
open ↗Exploit-DB
MyBB ChangUonDyU Plugin 1.0.2 - Cross-Site Scripting
An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonst
23RISK
open ↗Exploit-DB
Sitemakin SLAC 1.0 - 'my_item_search' SQL Injection
An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.
23RISK
open ↗Exploit-DB
wityCMS 0.6.1 - Cross-Site Scripting
Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "Ge
23RISK
open ↗Exploit-DB
DomainMod 4.09.03 - 'sslpaid' Cross-Site Scripting
DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter.
23RISK
open ↗Exploit-DB
DomainMod 4.09.03 - 'oid' Cross-Site Scripting
DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter.
23RISK
open ↗Exploit-DB
Bitmain Antminer D3/L3+/S9 - Remote Command Execution
Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution via the system restore function.
28RISK
open ↗Exploit-DB
Werewolf Online 0.8.8 - Information Disclosure
The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat outp
23RISK
open ↗Exploit-DB
ClipperCMS 1.3.3 - Cross-Site Scripting
Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in
23RISK
open ↗Exploit-DB
EasyService Billing 1.0 - Cross-Site Scripting
The parameter q is affected by Cross-site Scripting in jobcard-ongoing.php in EasyService Billing 1.0.
23RISK
open ↗Exploit-DB
EasyService Billing 1.0 - Cross-Site Request Forgery
A CSRF issue was discovered in EasyService Billing 1.0, which was triggered via a quotation-new3-new2.php?add=true&id= U
23RISK
open ↗Exploit-DB
EasyService Billing 1.0 - 'q' SQL Injection
A SQL Injection issue was observed in the parameter "q" in jobcard-ongoing.php in EasyService Billing 1.0.
23RISK
open ↗Exploit-DB
EasyService Billing 1.0 - Cross-Site Request Forgery
A CSRF issue was discovered on the User Add/System Settings Page (system-settings-user-new2.php) in EasyService Billing
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle WebCenter Sites 11.1.1.8.0/12.2.1.x - Cross-Site Scripting
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported
50RISK
open ↗Exploit-DB
Oracle WebCenter FatWire Content Server < 7 - Improper Access Control
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Support Tools). Support
23RISK
open ↗Exploit-DB✓ VexDay Proof
Skia and Firefox - Integer Overflow in SkTDArray Leading to Out-of-Bounds Write
An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks,
28RISK
open ↗Exploit-DB
SAP Internet Transaction Server 6200.x - Session Fixation / Cross-Site Scripting
SAP Internet Transaction Server (ITS) 6200.X.X has Reflected Cross Site Scripting (XSS) via certain wgate URIs. NOTE: th
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra - Cross Context Use-After-Free
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft
35RISK
open ↗Exploit-DB
Honeywell XL Web Controller - Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earli
23RISK
open ↗Exploit-DB✓ VexDay Proof
Samsung Galaxy S7 Edge - Overflow in OMACP WbXml String Extension Processing
A malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when processing the String Ex
23RISK
open ↗Exploit-DB
Siemens SCALANCE S613 - Remote Denial of Service
Siemens SCALANCE S613 allows remote attackers to cause a denial of service (web-server outage) via traffic to TCP port 4
23RISK
open ↗Exploit-DB
ERPnext 11 - Cross-Site Scripting
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.
23RISK
open ↗Exploit-DB
Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x
43RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - 'POP/MOV SS' Privilege Escalation
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) wa
43RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.