Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,647cataloged exploits
34,986CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,899GitHub PoC 14,014VulnCheck XDB 8,571Nuclei 4,248Metasploit 3,472✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB✓ VexDay Proof
DeluxeBB 1.3 - Multiple Vulnerabilities
misc.php in DeluxeBB 1.3 allows remote attackers to register accounts without a valid email address via a valemail actio
23RISK
open ↗Exploit-DB✓ VexDay Proof
The Uploader 2.0 - File Disclosure
Directory traversal vulnerability in api/download_checker.php in MegaLab The Uploader 2.0 allows remote attackers to rea
23RISK
open ↗Exploit-DB✓ VexDay Proof
DeluxeBB 1.3 - Multiple Vulnerabilities
DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a crafted page parameter to misc.php, which rev
23RISK
open ↗Exploit-DB
Allied Telesyn TFTP (AT-TFTP) Server/Daemon 1.9 - Denial of Service
Multiple stack-based buffer overflows in Allied Telesyn TFTP Server (AT-TFTP) 1.9, and possibly earlier, allow remote at
50RISK
open ↗Exploit-DB✓ VexDay Proof
Active Business Directory 2 - 'searchadvance.asp' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in searchadvance.asp in Active Business Directory 2 allows remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
DeluxeBB 1.3 - Multiple Vulnerabilities
DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
CoolPlayer 2.18 - M3U Playlist Buffer Overflow
Stack-based buffer overflow in CoolPlayer 2.18, and possibly other versions, allows user-assisted remote attackers to ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
Active PHP BookMarks 1.3 - SQL Injection
SQL injection vulnerability in view_group.php in Active PHP Bookmarks (APB) 1.1.02 and 1.2.06 allows remote attackers to
23RISK
open ↗Exploit-DB
Simple PHP Blog 0.5.1 - Local File Inclusion
Directory traversal vulnerability in languages_cgi.php in Simple PHP Blog 0.5.1 and earlier allows remote authenticated
23RISK
open ↗Exploit-DB✓ VexDay Proof
weenCompany - SQL Injection
SQL injection vulnerability in index.php in weenCompany 4.0.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
DeluxeBB 1.3 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in misc.php in DeluxeBB 1.3 allows remote attackers to inject arbitrary web scr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Easy RM to MP3 27.3.700 (Windows XP SP3) - Local Overflow
Stack-based buffer overflow in Easy RM to MP3 Converter allows remote attackers to execute arbitrary code via a long fil
28RISK
open ↗Exploit-DB✓ VexDay Proof
Mini File Host 1.5 - Arbitrary File Upload
Unrestricted file upload vulnerability in Mini File Host 1.5 allows remote attackers to execute arbitrary code by upload
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Calendar 1.1 - 'update08.php?configfile' Traversal Local File Inclusion
Multiple absolute path traversal vulnerabilities in PHP-Calendar 1.1 allow remote attackers to include and execute arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Angelo-emlak 1.0 - Database Disclosure
Angelo-Emlak 1.0 stores sensitive information under the web root with insufficient access control, which allows remote a
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPhotoalbum - Arbitrary File Upload
Multiple unrestricted file upload vulnerabilities in upload.php in PHPhotoalbum allow remote attackers to execute arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Calendar 1.1 - 'update10.php?configfile' Traversal Local File Inclusion
Multiple absolute path traversal vulnerabilities in PHP-Calendar 1.1 allow remote attackers to include and execute arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ultimate Uploader 1.3 - Arbitrary File Upload
Unrestricted file upload vulnerability in Element-IT Ultimate Uploader 1.3 allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPhotoalbum 0.5 - SQL Injection
Multiple SQL injection vulnerabilities in PHPhotoalbum 0.5 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB
VideoCMS 3.1 - SQL Injection
SQL injection vulnerability in index.php in CodeMight VideoCMS 3.1 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kasseler CMS 1.3.4 Lite - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Kasseler CMS 1.3.4 allow remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
Simplicity oF Upload 1.3.2 - Arbitrary File Upload
Unrestricted file upload vulnerability in upload.php in PHPSimplicity Simplicity oF Upload 1.3.2 allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
4Images 1.7.1 - SQL Injection
SQL injection vulnerability in search.php in 4images 1.7.x allows remote authenticated users to execute arbitrary SQL co
23RISK
open ↗Exploit-DB✓ VexDay Proof
phUploader 2 - Arbitrary File Upload
Unrestricted file upload vulnerability in phUploader.php in phphq.Net phUploader 1.2 allows remote attackers to upload a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ignition 1.2 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in Ignition 1.2, when magic_quotes_gpc is disabled, allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
8Pixel.net 2009. - Database Disclosure
8pixel.net Blog 4 stores sensitive information under the web root with insufficient access control, which allows remote
23RISK
open ↗Exploit-DB
3Com OfficeConnect Routers - Remote Denial of Service
Flash Messaging 5.2.0g (rev 1.1.2) and earlier allows remote attackers to cause a denial of service (application crash)
23RISK
open ↗Exploit-DB
Lizard Cart - Multiple SQL Injections
SQL injection vulnerability in (1) pages.php and (2) detail.php in Lizard Cart CMS 1.04 allows remote attackers to execu
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.2.12/5.3.1 - 'symlink()' open_basedir Bypass
The session extension in PHP before 5.2.4 might allow local users to bypass open_basedir restrictions via a session file
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.2.12/5.3.1 - 'symlink()' open_basedir Bypass
Race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restrictio
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.