Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,008cataloged exploits
34,638CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,662GitHub PoC 13,743VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecentpopularrisk
21,662 exploits
Referência✓ VexDay Proof
Papoo CMS 3.x - 'pfadhier' Local File Inclusion
Directory traversal vulnerability in lib/classes/message_class.php in Papoo CMS 3.6, when register_globals is enabled an
23RISK
open ↗Referência
Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scripting
FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an
23RISK
open ↗Referência
CVE-2008-0158
Directory traversal vulnerability in index.php in Shop-Script 2.0 and possibly other versions allows remote attackers to
23RISK
open ↗Referência
CVE-2014-5104
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência
Collabtive 3.1 - 'address' Persistent Cross-Site Scripting
Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit
23RISK
open ↗Referência
CVE-2017-5223
An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML docume
23RISK
open ↗Referência
CVE-2010-4721
SQL injection vulnerability in news.php in Immo Makler allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Referência
CVE-2009-3511
Multiple PHP remote file inclusion vulnerabilities in justVisual 1.2 allow remote attackers to execute arbitrary PHP cod
23RISK
open ↗Referência✓ VexDay Proof
Irokez Blog 0.7.1 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Irokez CMS 0.7.1 and earlier, when register_globals is enabled, al
23RISK
open ↗Referência✓ VexDay Proof
Shop-Script 2.0 - 'index.php' Remote File Disclosure
Directory traversal vulnerability in index.php in Shop-Script 2.0 and possibly other versions allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
WholeHogSoftware Password Protect - Authentication Bypass
Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Password Protect: Enhanced 1.x allow remot
23RISK
open ↗Referência✓ VexDay Proof
sma-db 0.3.12 - Remote File Inclusion / Cross-Site Scripting
PHP remote file inclusion vulnerability in format.php in SMA-DB 0.3.12 allows remote attackers to execute arbitrary PHP
23RISK
open ↗Referência
CVE-2016-0400
CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0
23RISK
open ↗Referência
CVE-2009-4993
PHP remote file inclusion vulnerability in home.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbit
23RISK
open ↗Referência
CVE-2015-4118
SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated user
23RISK
open ↗Referência
CVE-2015-4118
SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated user
23RISK
open ↗Referência
CVE-2021-41556
sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that ca
48RISK
open ↗Referência
CVE-2013-5039
Cross-site request forgery (CSRF) vulnerability in goform/wlanBasicSecurity on the HOT HOTBOX router with software 2.1.1
23RISK
open ↗Referência
CVE-2012-0899
Cross-site scripting (XSS) vulnerability in referencement/sites_inscription.php in Annuaire PHP allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
PHPMyRing 4.2.0 - 'view_com.php' SQL Injection
SQL injection vulnerability in view_com.php in Nicolas Grandjean PHPMyRing 4.2.0 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
phpBB Ajax Shoutbox 0.0.5 - Remote File Inclusion
PHP remote file inclusion vulnerability in shoutbox.php in the Ajax Shoutbox 0.0.5 and earlier module for phpBB allows r
23RISK
open ↗Referência✓ VexDay Proof
MiniGal b13 - Remote Code Execution
The imagecomments function in classes.php in MiniGal b13 allows remote attackers to inject arbitrary PHP code into a fil
23RISK
open ↗Referência✓ VexDay Proof
VWar 1.5.0 R15 - 'mvcw.php' Remote File Inclusion
PHP remote file inclusion vulnerability in convert/mvcw.php in Virtual War (VWar) 1.5.0 R15 and earlier allows remote at
23RISK
open ↗Referência✓ VexDay Proof
PHPNuke-Clan 4.2.0 - 'mvcw_conver.php' Remote File Inclusion
PHP remote file inclusion vulnerability in convert/mvcw_conver.php in the Virtual War (VWar) module for PHPNuke-Clan (PN
23RISK
open ↗Referência✓ VexDay Proof
Uebimiau Web-Mail 2.7.10/2.7.2 - Remote File Disclosure
Uebimiau Webmail 2.7.10 and 2.7.2 does not protect authentication state variables from being set through HTTP requests,
23RISK
open ↗Referência✓ VexDay Proof
zFeeder 1.6 - 'admin.php' Admin Bypass
zFeeder 1.6 allows remote attackers to gain administrative access via a direct request to admin.php.
23RISK
open ↗Referência
CVE-2007-1107
SQL injection vulnerability in thumbnails.php in Coppermine Photo Gallery (CPG) 1.3.x allows remote authenticated users
23RISK
open ↗Referência
CVE-2015-1576
Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.