Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,151cataloged exploits
35,370CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
Cars & Vehicle - 'page.php' SQL Injection
SQL injection vulnerability in page.php in Cars & Vehicle (aka Cars-Vehicle Script) allows remote attackers to execute a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sun Solaris 9/10 Text Editors - Command Execution
Multiple unspecified vulnerabilities in Sun Solaris 8 through 10 allow local users to gain privileges via vectors relate
23RISK
open ↗Exploit-DB✓ VexDay Proof
Quick Cart 3.1 - 'admin.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in admin.php in Quick.Cart 3.1 allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Quick CMS Lite 2.1 - 'admin.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in admin.php in OpenSolution Quick.Cms.Lite 2.1 allows remote attackers to inje
23RISK
open ↗Exploit-DB✓ VexDay Proof
Postfix < 2.4.9/2.5.5/2.6-20080902 - '.forward' Local Denial of Service
20RISK
open ↗Exploit-DB✓ VexDay Proof
Unreal Engine - 'UnChan.cpp' Failed Assertion Remote Denial of Service
The Unreal engine, as used in Unreal Tournament 3 1.3, Unreal Tournament 2003 and 2004, Dead Man's Hand, Pariah, WarPath
23RISK
open ↗Exploit-DB✓ VexDay Proof
CzarNews 1.20 - Account Hijacking SQL Injection
SQL injection vulnerability in cn_users.php in CzarNews 1.20 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗Exploit-DB✓ VexDay Proof
phpMyAdmin 3.2 - 'server_databases.php' Remote Command Execution
libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrar
28RISK
open ↗Exploit-DB✓ VexDay Proof
Accellion File Transfer Appliance Error Report Message - Open Email Relay
courier/1000@/api_error_email.html (aka "error reporting page") in Accellion File Transfer Appliance FTA_7_0_178, and po
23RISK
open ↗Exploit-DB✓ VexDay Proof
Unreal Engine 3 - Failed Memory Allocation Remote Denial of Service
Unreal engine 3, as used in Unreal Tournament 3 1.3, Frontlines: Fuel of War 1.1.1, and other products, allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple iOS 1.1.4/2.0 / iPod 1.1.4/2.0 touch Safari WebKit - 'alert()' Remote Denial of Service
Off-by-one error in the _web_drawInRect:withFont:ellipsis:alignment:measureOnly function in WebKit in Safari in Apple iP
23RISK
open ↗Exploit-DB✓ VexDay Proof
Avant Browser 11.7 Build 9 - JavaScript Engine Integer Overflow
Integer overflow in the JavaScript engine in Avant Browser 11.7 Build 9 and earlier allows remote attackers to cause a d
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dynamic MP3 Lister 2.0.1 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Dynamic MP3 Lister 2.0.1 allow remote attackers to i
23RISK
open ↗Exploit-DB✓ VexDay Proof
Paranews 3.4 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in news.php in s0nic Paranews 3.4 allow remote attackers to inject a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Nooms 1.1 - 'search.php?q' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in NooMS 1.1 allow remote attackers to inject arbitrary web script o
23RISK
open ↗Exploit-DB✓ VexDay Proof
Nooms 1.1 - 'smileys.php?page_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in NooMS 1.1 allow remote attackers to inject arbitrary web script o
23RISK
open ↗Exploit-DB✓ VexDay Proof
Autodealers CMS AutOnline - 'pageid' SQL Injection
SQL injection vulnerability in index.php in Zanfi Autodealers CMS AutOnline allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Autodealers CMS AutOnline - 'id' SQL Injection
SQL injection vulnerability in index.php in Zanfi Autodealers CMS AutOnline allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
ZoneAlarm Security Suite 7.0 - AntiVirus Directory Path Buffer Overflow (PoC)
Buffer overflow in multiscan.exe in Check Point ZoneAlarm Security Suite 7.0.483.000 and 8.0.020.000 allows local users
23RISK
open ↗Exploit-DB✓ VexDay Proof
Yourownbux 4.0 - 'cookie' Authentication Bypass
SQL injection vulnerability in referrals.php in YourOwnBux 4.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
Easy Photo Gallery 2.1 - Cross-Site Scripting / File Disclosure/Bypass / SQL Injection
SQL injection vulnerability in gallery.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 allows remote attackers to exe
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sports Clubs Web Panel 0.0.1 - 'id' SQL Injection
Directory traversal vulnerability in index.php in Sports Clubs Web Panel 0.0.1 allows remote attackers to include and ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
Horde 3.2 - MIME Attachment Filename Insufficient Filtering Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in MIME/MIME/Contents.php in the MIME library in Horde 3.2.x before 3.2.2 allow
23RISK
open ↗Exploit-DB✓ VexDay Proof
Hot Links SQL-PHP - 'news.php' SQL Injection
SQL injection vulnerability in Mr. CGI Guy Hot Links SQL-PHP 3 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Horde Application Framework 3.2.1 - Forward Slash Insufficient Filtering Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in (1) Text_Filter/Filter/xss.php in Horde 3.1.x before 3.1.9 and 3.2.x before
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Core 2.6.1 - Admin Takeover (SQL Column Truncation)
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the
28RISK
open ↗Exploit-DB✓ VexDay Proof
Libera CMS 1.12 - 'cookie' SQL Injection
SQL injection vulnerability in admin.php in Libera CMS 1.12, when magic_quotes_gpc is disabled, allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alstrasoft Forum - 'catid' SQL Injection
SQL injection vulnerability in index.php in AlstraSoft Forum Pay Per Post Exchange allows remote attackers to execute ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Bonjour for Windows 1.0.4 - mDNSResponder Null Pointer Dereference Denial of Service
mDNSResponder in the Bonjour Namespace Provider in Apple Bonjour for Windows before 1.0.5 allows attackers to cause a de
23RISK
open ↗Exploit-DB✓ VexDay Proof
eXtrovert software Thyme 1.3 - 'pick_users.php' SQL Injection
SQL injection vulnerability in pick_users.php in the groups module in eXtrovert Thyme 1.3 allows remote attackers to exe
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.