Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,559cataloged exploits
34,978CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,899GitHub PoC 13,960VulnCheck XDB 8,542Nuclei 4,243Metasploit 3,472✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB✓ VexDay Proof
AJ Shopping Cart 1.0 (maincatid) - SQL Injection
SQL injection vulnerability in index.php in AJ Shopping Cart 1.0 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache Tomcat 5.5.0 < 5.5.29 / 6.0.0 < 6.0.26 - Information Disclosure
Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostna
35RISK
open ↗Exploit-DB
Microsoft Windows XP/2000/2003 - 'win32k.sys' SfnINSTRING Local kernel Denial of Service
The SfnINSTRING function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cacti 0.8.7e - SQL Injection
SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbit
23RISK
open ↗Exploit-DB
cms (id) 5.0 - SQL Injection
Multiple SQL injection vulnerabilities in Web Development House Alibaba Clone allow remote attackers to execute arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache ActiveMQ 5.2/5.3 - Source Code Information Disclosure
The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP
60RISK
open ↗Exploit-DB✓ VexDay Proof
phpGreetCards 3.7 - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component WMI 1.5.0 - Local File Inclusion
Directory traversal vulnerability in wmi.php in the Webmoney Web Merchant Interface (aka WMI or com_wmi) component 1.5.0
38RISK
open ↗Exploit-DB✓ VexDay Proof
ZipGenius 6.3.1.2552 - 'zgtips.dll' Local Stack Buffer Overflow
Stack-based buffer overflow in zgtips.dll in ZipGenius 6.3.1.2552 allows user-assisted remote attackers to execute arbit
28RISK
open ↗Exploit-DB✓ VexDay Proof
Viscom Software Movie Player Pro SDK ActiveX 6.8 - Remote Buffer Overflow
Stack-based buffer overflow in the MOVIEPLAYER.MoviePlayerCtrl.1 ActiveX control in MoviePlayer.ocx 6.8.0.0 in Viscom So
50RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component MMS Blog 2.3.0 - Local File Inclusion
Directory traversal vulnerability in the MMS Blog (com_mmsblog) component 2.3.0 for Joomla! allows remote attackers to r
43RISK
open ↗Exploit-DB✓ VexDay Proof
wb news (webmobo) 2.3.3 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in base/Comments.php in Webmobo WB News 2.3.3 allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache OFBiz - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlie
28RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component OrgChart 1.0.0 - Local File Inclusion
Directory traversal vulnerability in the OrgChart (com_orgchart) component 1.0.0 for Joomla! allows remote attackers to
43RISK
open ↗Exploit-DB✓ VexDay Proof
CactuShop - User Invoices Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in _invoice.asp in CactuShop before 6.155 allow remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
MIT Kerberos 5 - 'src/kdc/do_tgs_req.c' Ticket Renewal Double-Free Memory Corruption
Double free vulnerability in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7.x and 1.
28RISK
open ↗Exploit-DB
MusicBox 3.3 - SQL Injection
SQL injection vulnerability in genre_artists.php in MusicBox 3.3 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component JTM Reseller 1.9 Beta - SQL Injection
SQL injection vulnerability in the JTM Reseller (com_jtm) component 1.9 Beta for Joomla! allows remote attackers to exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Openregistrecil 1.02 - Local File Inclusion / Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in openMairie Openregistrecil 1.02, when register_globals is enabled,
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Online News Paper Manager 1.0 - 'cid' SQL Injection
SQL injection vulnerability in the Online News Paper Manager (com_jnewspaper) component 1.0 for Joomla!, when magic_quot
23RISK
open ↗Exploit-DB✓ VexDay Proof
HP Operations Manager 8.16 - 'srcvw4.dll' 'LoadFile()'/'SaveFile()' Remote Unicode Stack Overflow (PoC)
Multiple stack-based buffer overflows in a certain Tetradyne ActiveX control in HP Operations Manager 7.5, 8.10, and 8.1
28RISK
open ↗Exploit-DB✓ VexDay Proof
Mongoose Web Server 2.8 - Multiple Directory Traversals
Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending a / (slash) cha
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Online News Paper Manager 1.0 - 'cid' SQL Injection
SQL injection vulnerability in the Online News Paper Manager (com_jnewspaper) component 1.0 for Joomla! allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
Openregistrecil 1.02 - Local File Inclusion / Remote File Inclusion
Directory traversal vulnerability in scr/soustab.php in openMairie Openregistrecil 1.02, when register_globals is enable
23RISK
open ↗Exploit-DB
CMS Ariadna 2009 - SQL Injection
SQL injection vulnerability in detResolucion.php in CMS Ariadna 1.1 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Exploit-DB✓ VexDay Proof
TweakFS 1.0 FSX Edition - Stack Buffer Overflow
Stack-based buffer overflow in Create and Extract Zips TweakFS Zip Utility 1.0 for Flight Simulator X (FSX) allows remot
23RISK
open ↗Exploit-DB
CMS Ariadna 2009 - SQL Injection
SQL injection vulnerability in detResolucion.php in CMS Ariadna 1.1 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component GBU Facebook 1.0.5 - SQL Injection
SQL injection vulnerability in the GBU Facebook (com_gbufacebook) component 1.0.5 for Joomla! allows remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Gadget Factory 1.0.0 - Local File Inclusion
Directory traversal vulnerability in the Gadget Factory (com_gadgetfactory) component 1.0.0 and 1.5.0 for Joomla! allows
43RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component ZiMB Comment 0.8.1 - Local File Inclusion
Directory traversal vulnerability in the ZiMB Comment (com_zimbcomment) component 0.8.1 for Joomla! allows remote attack
43RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.