Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,107cataloged exploits
34,679CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,692GitHub PoC 13,812VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecentpopularrisk
21,692 exploits
Referência
CVE-2023-25440
Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to exe
33RISK
open ↗Referência
CVE-2009-2327
Cross-site scripting (XSS) vulnerability in add_voting.php in KerviNet Forum 1.1 and earlier allows remote authenticated
23RISK
open ↗Referência
CVE-2011-1665
PHPBoost 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attac
23RISK
open ↗Referência
CVE-2010-0978
KMSoft Guestbook (aka GBook) 1.0 stores sensitive information under the web root with insufficient access control, which
23RISK
open ↗Referência
CVE-2010-0978
KMSoft Guestbook (aka GBook) 1.0 stores sensitive information under the web root with insufficient access control, which
23RISK
open ↗Referência
CVE-2017-0412
An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
fungamez rc1 - Authentication Bypass / Local File Inclusion
includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by set
23RISK
open ↗Referência✓ VexDay Proof
CaLogic Calendars 1.2.2 - 'CLPath' Remote File Inclusion
PHP remote file inclusion vulnerability in CaLogic Calendars 1.2.2 allows remote attackers to execute arbitrary PHP code
23RISK
open ↗Referência✓ VexDay Proof
Teraway LinkTracker 1.0 - Insecure Cookie Handling
Teraway LinkTracker 1.0 allows remote attackers to bypass authentication and gain administrative access via a userid=1&l
23RISK
open ↗Referência✓ VexDay Proof
PageSquid CMS 0.3 Beta - 'index.php' SQL Injection
SQL injection vulnerability in index.php in PageSquid CMS 0.3 Beta allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
Chicomas 2.0.4 - Database Backup / File Disclosure / Cross-Site Scripting
Chilek Content Management System (aka ChiCoMaS) 2.0.4 and earlier stores sensitive information under the web root with i
23RISK
open ↗Referência✓ VexDay Proof
Absolute FAQ Manager 6.0 - Insecure Cookie Handling
Xigla Software Absolute FAQ Manager.NET 6.0 allows remote attackers to bypass authentication and gain administrative acc
23RISK
open ↗Referência✓ VexDay Proof
The Gemini Portal 4.7 - Insecure Cookie Handling
admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain
23RISK
open ↗Referência
CVE-2010-2684
SQL injection vulnerability in index.php in Customer Paradigm PageDirector CMS allows remote attackers to execute arbitr
23RISK
open ↗Referência
CVE-2010-0971
Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.6.4 allow remote authenticated users, with Instructor pr
23RISK
open ↗Referência
CVE-2010-0971
Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.6.4 allow remote authenticated users, with Instructor pr
23RISK
open ↗Referência
CVE-2010-2688
SQL injection vulnerability in detail.asp in Site2Nite Boat Classifieds allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Password Protector SD 1.3.1 - Insecure Cookie Handling
Ascad Networks Password Protector SD 1.3.1 allows remote attackers to bypass authentication and gain administrative acce
23RISK
open ↗Referência
CVE-2007-5816
dialog.php in CONTENTCustomizer 3.1mp and earlier allows remote attackers to obtain sensitive author credentials by maki
23RISK
open ↗Referência
CVE-2014-5101
Multiple cross-site scripting (XSS) vulnerabilities in WeBid 1.1.1 allow remote attackers to inject arbitrary web script
23RISK
open ↗Referência✓ VexDay Proof
Top Auction 1.0 - 'viewcat.php' SQL Injection
SQL injection vulnerability in PHP Labs Top Auction allows remote attackers to execute arbitrary SQL commands via the (1
23RISK
open ↗Referência✓ VexDay Proof
PHPWebThings 1.5.2 - 'help.php?module' Local File Inclusion
Directory traversal vulnerability in help.php in phpWebThings 1.5.2 and earlier, when magic_quotes_gpc is disabled, allo
23RISK
open ↗Referência
CVE-2012-5874
Multiple SQL injection vulnerabilities in the (1) update_whosonline_reg and (2) update_whosonline_guest functions in Eli
23RISK
open ↗Referência
CVE-2012-5874
Multiple SQL injection vulnerabilities in the (1) update_whosonline_reg and (2) update_whosonline_guest functions in Eli
23RISK
open ↗Referência
CVE-2013-2690
SQL injection vulnerability in index.php in Synchroweb Technology SynConnect 2.0 allows remote attackers to execute arbi
23RISK
open ↗Referência
CVE-2013-2690
SQL injection vulnerability in index.php in Synchroweb Technology SynConnect 2.0 allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
Informium 0.12.0 - 'common-menu.php' Remote File Inclusion
PHP remote file inclusion vulnerability in common-menu.php in Cameron McKay Informium 0.12.0 allows remote attackers to
23RISK
open ↗Referência
CVE-2018-14029
CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as dem
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.