Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
71,957cataloged exploits
32,195CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,003GitHub PoC 13,307VulnCheck XDB 8,182Nuclei 4,217Metasploit 3,462✓ verified onlyrecentpopularrisk
22,786 exploits
Exploit-DB
Joomla! Component NS Download Shop 2.2.6 - 'id' SQL Injection
The NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in
23RISK
open ↗Exploit-DB
iStock Management System 1.0 - Arbitrary File Upload
iStock Management System 1.0 allows Arbitrary File Upload via user/profile.
23RISK
open ↗Exploit-DB
Sokial Social Network Script 1.0 - SQL Injection
Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members_view.php.
23RISK
open ↗Exploit-DB
SoftDatepro Dating Social Network 1.3 - SQL Injection
SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php
23RISK
open ↗Exploit-DB
Php Inventory - Arbitrary File Upload
Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/.
23RISK
open ↗Exploit-DB
CPA Lead Reward Script - SQL Injection
CPA Lead Reward Script allows SQL Injection via the username parameter.
23RISK
open ↗Exploit-DB
Website Broker Script - 'status_id' SQL Injection
Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php.
23RISK
open ↗Exploit-DB
Protected Links - SQL Injection
Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter.
23RISK
open ↗Exploit-DB
Shareet - 'photo' SQL Injection
Shareet - Photo Sharing Social Network 1.0 allows SQL Injection via the photo parameter.
23RISK
open ↗Exploit-DB
Fake Magazine Cover Script - SQL Injection
Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter.
23RISK
open ↗Exploit-DB
iTech Gigs Script 1.21 - SQL Injection
iTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the service-provider.php ser pa
23RISK
open ↗Exploit-DB
Vastal I-Tech Agent Zone - 'searchCommercial.php' / 'searchResidential.php' SQL Injection
Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type
23RISK
open ↗Exploit-DB
iProject Management System 1.0 - 'ID' SQL Injection
iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php.
23RISK
open ↗Exploit-DB
MyBuilder Clone 1.0 - 'subcategory' SQL Injection
MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter.
23RISK
open ↗Exploit-DB
MyMagazine 1.0 - 'id' SQL Injection
MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing
23RISK
open ↗Exploit-DB
Basic B2B Script - SQL Injection
Basic B2B Script allows SQL Injection via the product_view1.php pid or id parameter.
23RISK
open ↗Exploit-DB
Online Exam Test Application - 'sort' SQL Injection
Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action.
23RISK
open ↗Exploit-DB
US Zip Codes Database - 'state' SQL Injection
US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter.
23RISK
open ↗Exploit-DB
CmsLite 1.4 - 'S' SQL Injection
Creative Management System (CMS) Lite 1.4 allows SQL Injection via the S parameter to index.php.
23RISK
open ↗Exploit-DB
Mailing List Manager Pro 3.0 - SQL Injection
Mailing List Manager Pro 3.0 allows SQL Injection via the edit parameter to admin/users in a sort=login action, or the e
23RISK
open ↗Exploit-DB
AROX School ERP PHP Script - 'id' SQL Injection
AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter.
23RISK
open ↗Exploit-DB
PG All Share Video 1.0 - SQL Injection
PG All Share Video 1.0 allows SQL Injection via the PATH_INFO to search/tag, friends/index, users/profile, or video_cata
23RISK
open ↗Exploit-DB
Zomato Clone Script - 'resid' SQL Injection
Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter.
23RISK
open ↗Exploit-DB
Nice PHP FAQ Script - 'nice_theme' SQL Injection
Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-2008
23RISK
open ↗Exploit-DB
D-Park Pro 1.0 - SQL Injection
D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.
23RISK
open ↗Exploit-DB
Adult Script Pro 2.2.4 - SQL Injection
Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-200
23RISK
open ↗Exploit-DB
Job Board Script - 'nice_theme' SQL Injection
Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.
23RISK
open ↗Exploit-DB
PHP Melody 2.6.1 - SQL Injection
In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.
23RISK
open ↗Exploit-DB
PHPMyFAQ 2.9.8 - Cross-Site Scripting (3)
In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment.
23RISK
open ↗Exploit-DB
phpMyFAQ 2.9.8 - Cross-Site Request Forgery
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.