Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
78,338cataloged exploits
36,057CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,721GitHub PoC 14,491VulnCheck XDB 8,829Nuclei 4,350Metasploit 3,489✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
Ingress-NGINX 4.11.0 - Remote Code Execution (RCE)
ingress-nginx admission controller RCE escalation
85RISK
open ↗Exploit-DB✓ VexDay Proof
DocsGPT 0.12.0 - Remote Code Execution
Remote Code Execution in DocsGPT
68RISK
open ↗Exploit-DB✓ VexDay Proof
Social-Commerce 3.1.6 - Reflected XSS
mooSocial mooStore cross site scripting
43RISK
open ↗Exploit-DB✓ VexDay Proof
mooSocial 3.1.8 - Reflected XSS
mooSocial mooStore index cross site scripting
43RISK
open ↗Exploit-DB✓ VexDay Proof
Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated)
An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafte
23RISK
open ↗Exploit-DB✓ VexDay Proof
RosarioSIS 10.8.4 - CSV Injection
RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.
33RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin AN_Gradebook 5.0.1 - SQLi
AN_GradeBook <= 5.0.1 - Subscriber+ SQLi
23RISK
open ↗Exploit-DB✓ VexDay Proof
copyparty v1.8.6 - Reflected Cross Site Scripting (XSS)
copyparty vulnerable to reflected cross-site scripting via k304 parameter
48RISK
open ↗Exploit-DB✓ VexDay Proof
Online Piggery Management System v1.0 - unauthenticated file upload vulnerability
Online Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can upload a php file by send
43RISK
open ↗Exploit-DB✓ VexDay Proof
Super Socializer 7.13.52 - Reflected XSS
Super Socializer < 7.13.52 - Reflected XSS
48RISK
open ↗Exploit-DB✓ VexDay Proof
SPIP v4.2.0 - Remote Code Execution (Unauthenticated)
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. T
85RISK
open ↗Exploit-DB✓ VexDay Proof
PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
Code Injection in pyload/pyload
85RISK
open ↗Exploit-DB✓ VexDay Proof
Sales Tracker Management System v1.0 - Multiple Vulnerabilities
SourceCodester Sales Tracker Management System cross site scripting
28RISK
open ↗Exploit-DB✓ VexDay Proof
Faculty Evaluation System 1.0 - Unauthenticated File Upload
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_u
61RISK
open ↗Exploit-DB✓ VexDay Proof
Online Security Guards Hiring System 1.0 - Reflected XSS
PHPGurukul Online Security Guards Hiring System search-request.php cross site scripting
43RISK
open ↗Exploit-DB✓ VexDay Proof
Camaleon CMS v2.7.0 - Server-Side Template Injection (SSTI)
Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats para
60RISK
open ↗Exploit-DB✓ VexDay Proof
Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)
Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's securit
23RISK
open ↗Exploit-DB✓ VexDay Proof
GetSimple CMS v3.3.16 - Remote Code Execution (RCE)
GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file paramete
46RISK
open ↗Exploit-DB✓ VexDay Proof
Online Pizza Ordering System v1.0 - Unauthenticated File Upload
SourceCodester Online Pizza Ordering System unrestricted upload
33RISK
open ↗Exploit-DB✓ VexDay Proof
Bang Resto v1.0 - 'Multiple' SQL Injection
Bang Resto 1.0 was discovered to contain multiple SQL injection vulnerabilities via the btnMenuItemID, itemID, itemPrice
41RISK
open ↗Exploit-DB✓ VexDay Proof
Bang Resto v1.0 - Stored Cross-Site Scripting (XSS)
Bang Resto 1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the itemName parameter in
33RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! v4.2.8 - Unauthenticated information disclosure
[20230201] - Core - Improper access check in webservice endpoints
100RISK
open ↗Exploit-DB✓ VexDay Proof
Simple Food Ordering System v1.0 - Cross-Site Scripting (XSS)
SourceCodester Simple Food Ordering System process_order.php cross site scripting
28RISK
open ↗Exploit-DB✓ VexDay Proof
Auto Dealer Management System v1.0 - SQL Injection
SourceCodester Auto Dealer Management System sql injection
33RISK
open ↗Exploit-DB✓ VexDay Proof
Auto Dealer Management System 1.0 - Broken Access Control Exploit
SourceCodester Auto Dealer Management System Users.php access control
33RISK
open ↗Exploit-DB✓ VexDay Proof
Music Gallery Site v1.0 - SQL Injection on music_list.php
SourceCodester Music Gallery Site GET Request music_list.php sql injection
33RISK
open ↗Exploit-DB✓ VexDay Proof
Auto Dealer Management System v1.0 - SQL Injection in sell_vehicle.php
SourceCodester Auto Dealer Management System sql injection
33RISK
open ↗Exploit-DB✓ VexDay Proof
Art Gallery Management System Project in PHP v 1.0 - SQL injection
Art Gallery Management System Project in PHP 1.0 was discovered to contain a SQL injection vulnerability via the pid par
23RISK
open ↗Exploit-DB✓ VexDay Proof
Music Gallery Site v1.0 - SQL Injection on page view_music_details.php
SourceCodester Music Gallery Site GET Request view_music_details.php sql injection
33RISK
open ↗Exploit-DB✓ VexDay Proof
Music Gallery Site v1.0 - Broken Access Control
SourceCodester Music Gallery Site POST Request Users.php access control
41RISK
open ↗page 1 / 636next →
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.