Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,058cataloged exploits
35,300CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,175GitHub PoC 14,096VulnCheck XDB 8,607Nuclei 4,255Metasploit 3,474✓ verified onlyrecentpopularrisk
22,175 exploits
Referência✓ VexDay Proof
BlogPHP 2 - 'id' Cross-Site Scripting / SQL Injection
CVE-2008-0679—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in BlogPHP 2.0 allows remote attackers to inject arbitrary web scr
23RISK
open ↗
Referência
CVE-2017-0284
CVE-2017-0284—
Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT
23RISK
open ↗
Referência
CVE-2009-3530
CVE-2009-3530—
Cross-site scripting (XSS) vulnerability in storefront.php in RadScripts RadBids Gold 4 allows remote attackers to injec
23RISK
open ↗
Referência
CVE-2009-4869
CVE-2009-4869—
Cross-site scripting (XSS) vulnerability in index.php in Nasim Guest Book 1.2 allows remote attackers to inject arbitrar
23RISK
open ↗
Referência
CVE-2019-13977
CVE-2019-13977—
index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=crea
23RISK
open ↗
Referência
CVE-2010-4877
CVE-2010-4877—
Cross-site scripting (XSS) vulnerability in index.php in OneCMS 2.6.1 allows remote attackers to inject arbitrary web sc
23RISK
open ↗
Referência
CVE-2014-9322
CVE-2014-9322—
arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack S
23RISK
open ↗
Referência✓ VexDay Proof
mm chat 1.5 - Local File Inclusion / Cross-Site Scripting
CVE-2008-2973—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in chathead.php in MM Chat 1.5 allow remote attackers to inject arbi
23RISK
open ↗
Referência✓ VexDay Proof
phpdaily - SQL Injection / Cross-Site Scripting / Local File Download
CVE-2008-4756—webappsphp
Cross-site scripting (XSS) vulnerability in add_prest_date.php in PHP-Daily allows remote attackers to inject arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Butterfly ORGanizer 2.0.0 - SQL Injection / Cross-Site Scripting
CVE-2008-6700—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Butterfly Organizer 2.0.0 allow remote attackers to inject arbitr
23RISK
open ↗
Referência✓ VexDay Proof
zeeproperty 1.0 - Arbitrary File Upload / Cross-Site Scripting
CVE-2008-6915—webappsphp
Cross-site scripting (XSS) vulnerability in view_prop_details.php in Zeeways ZEEPROPERTY 1.0 allows remote attackers to
23RISK
open ↗
Referência
CVE-2009-4692
CVE-2009-4692—
Cross-site scripting (XSS) vulnerability in index.php in RadScripts RadLance Gold 7.5 allows remote attackers to inject
23RISK
open ↗
Referência
CVE-2009-4697
CVE-2009-4697—
Multiple cross-site scripting (XSS) vulnerabilities in index.php in RadNICS Gold 5 allow remote attackers to inject arbi
23RISK
open ↗
Referência
CVE-2009-3719
CVE-2009-3719—
Cross-site scripting (XSS) vulnerability in comment.asp in Battle Blog 1.25 and 1.30 build 2 allows remote attackers to
23RISK
open ↗
Referência
CVE-2010-2340
CVE-2010-2340—
SQL injection vulnerability in members.php in Arab Portal 2.2, when magic_quotes_gpc is disabled, allows remote attacker
23RISK
open ↗
Referência
CVE-2016-7083
CVE-2016-7083—
VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado Thin
23RISK
open ↗
Referência
CVE-2017-16843
CVE-2017-16843—
Vonage VDV-23 115 3.2.11-0.9.40 devices have stored XSS via the NewKeyword or NewDomain field to /goform/RgParentalBasic
23RISK
open ↗
Referência
CVE-2014-125116
CVE-2014-125116CRITICAL
HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration Injection
63RISK
open ↗
Referência
CVE-2014-125116
CVE-2014-125116CRITICAL
HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration Injection
63RISK
open ↗
Referência
CVE-2014-125116
CVE-2014-125116CRITICAL
HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration Injection
63RISK
open ↗
Referência
CVE-2020-8493
CVE-2020-8493MEDIUM
A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via
33RISK
open ↗
Referência
CVE-2008-6325
CVE-2008-6325—
Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Classifieds Script allow remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2009-3562
CVE-2009-3562—
Cross-site scripting (XSS) vulnerability in Xerver HTTP Server 4.32 allows remote attackers to inject arbitrary web scri
23RISK
open ↗
Referência
CVE-2011-10010
CVE-2011-10010CRITICAL
QuickShare File Server 1.2.1 Path Traversal RCE
63RISK
open ↗
Referência
CVE-2011-10010
CVE-2011-10010CRITICAL
QuickShare File Server 1.2.1 Path Traversal RCE
63RISK
open ↗
Referência
CVE-2011-10010
CVE-2011-10010CRITICAL
QuickShare File Server 1.2.1 Path Traversal RCE
63RISK
open ↗
Referência
CVE-2011-10010
CVE-2011-10010CRITICAL
QuickShare File Server 1.2.1 Path Traversal RCE
63RISK
open ↗
Referência✓ VexDay Proof
PHP-Fusion 6.01.14 - Blind SQL Injection
CVE-2008-1918—webappsphp
SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the
23RISK
open ↗
Referência
CVE-2009-4857
CVE-2009-4857—
Cross-site scripting (XSS) vulnerability in login.php in PHP Photo Vote 1.3F allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2009-4523
CVE-2009-4523—
Cross-site scripting (XSS) vulnerability in index.php in Zainu 1.0 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗
← previouspage 401 / 740next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.