Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,151cataloged exploits
35,370CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
Softbiz Classifieds Script - 'gallery.php?radio' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Classifieds Script allow remote attackers to inject arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Pre ASP Job Board - 'emp_login.asp' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Employee/emp_login.asp in Pre ASP Job Board allows remote attackers to injec
23RISK
open ↗Exploit-DB✓ VexDay Proof
E.Z. Poll 2 - Authentication Bypass
Multiple SQL injection vulnerabilities in admin/login.asp in E. Z. Poll 2 allow remote attackers to execute arbitrary SQ
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP JOBWEBSITE PRO - 'adname' SQL Injection
SQL injection vulnerability in siteadmin/forgot.php in PHP JOBWEBSITE PRO allows remote attackers to execute arbitrary S
23RISK
open ↗Exploit-DB✓ VexDay Proof
Octeth Oempro 3.5.5 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Octeth Oempro 3.5.5.1, and possibly other versions before 4, allow remote atta
23RISK
open ↗Exploit-DB✓ VexDay Proof
Softbiz Classifieds Script - 'showcategory.php?radio' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Classifieds Script allow remote attackers to inject arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Pre Classified Listings 1.0 - 'signup.asp' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in signup.asp in Pre Classified Listings 1.0 allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
ASP Forum Script - 'messages.asp?forum_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ASP Forum Script allow remote attackers to inject arbitrary web s
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP JOBWEBSITE PRO - 'forgot.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in siteadmin/forgot.php in PHP JOBWEBSITE PRO allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
CodeToad ASP Shopping Cart Script - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in CodeToad ASP Shopping Cart Script allows remote attackers to inject arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
ASP Forum Script - 'messages.asp?message_id' SQL Injection
SQL injection vulnerability in messages.asp in ASP Forum Script allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Exploit-DB✓ VexDay Proof
ASP Forum Script - 'new_message.asp?forum_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ASP Forum Script allow remote attackers to inject arbitrary web s
23RISK
open ↗Exploit-DB✓ VexDay Proof
ASP Forum Script - 'default.asp' Query String Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ASP Forum Script allow remote attackers to inject arbitrary web s
23RISK
open ↗Exploit-DB✓ VexDay Proof
Softbiz Classifieds Script - '/admin/adminhome.php?msg' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Classifieds Script allow remote attackers to inject arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Active Price Comparison 4 - 'ProductID' Blind SQL Injection
Multiple SQL injection vulnerabilities in Active Price Comparison 4 allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗Exploit-DB✓ VexDay Proof
Active Price Comparison 4 - 'ProductID' Blind SQL Injection
SQL injection vulnerability in links.asp in Active Price Comparison 4.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
KTP Computer Customer Database CMS 1.0 - Blind SQL Injection
SQL injection vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ocean12 Mailing LisManager Gold 2.04 - 'Email' SQL Injection
Multiple SQL injection vulnerabilities in Ocean12 Mailing List Manager Gold allow remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Active Web Mail 4 - Authentication Bypass
Multiple SQL injection vulnerabilities in login.aspx in Active Price Comparison 4.0 allow remote attackers to execute ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Active Force Matrix 2 - Authentication Bypass
SQL injection vulnerability in Account.asp in Active Time Billing 3.2 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Exploit-DB✓ VexDay Proof
RakhiSoftware Shopping Cart - PHPSESSID Cookie Manipulation Full Path Disclosure
RakhiSoftware Price Comparison Script (aka Shopping Cart) allows remote attackers to obtain sensitive information via an
23RISK
open ↗Exploit-DB✓ VexDay Proof
RakhiSoftware Shopping Cart - 'product.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in product.php in RakhiSoftware Price Comparison Script (aka Shoppin
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linksys WRT160N - 'apply.cgi' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in apply.cgi on the Linksys WRT160N allows remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Web Calendar System 3.12/3.30 - Multiple Vulnerabilities
SQL injection vulnerability in aspWebCalendar allows remote attackers to execute arbitrary SQL statements via (1) the us
23RISK
open ↗Exploit-DB✓ VexDay Proof
AssoCIateD 1.4.4 - 'menu' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in AssoCIateD (aka ACID) 1.2.0 and earlier allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
Turnkey Arcade Script - SQL Injection (1)
SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Exploit-DB✓ VexDay Proof
W3C Amaya 10.1 Web Browser - URL Bar Remote Stack Overflow (PoC)
Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0.1 allow remote attackers to execute arbitrary code v
28RISK
open ↗Exploit-DB✓ VexDay Proof
W3C Amaya 10.1 Web Browser - 'id' Remote Stack Overflow (PoC)
Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0.1 allow remote attackers to execute arbitrary code v
28RISK
open ↗Exploit-DB✓ VexDay Proof
Goople CMS 1.7 - Arbitrary Code Execution
win/content/upload.php in Goople CMS 1.7 allows remote attackers to bypass authentication and gain administrative access
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft XML Core Services DTD - Cross-Domain Scripting (MS08-069)
Cross-domain vulnerability in Microsoft XML Core Services 3.0 and 4.0, as used in Internet Explorer, allows remote attac
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.