Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,226cataloged exploits
35,420CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,266GitHub PoC 14,126VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
OpenDB 1.0.6 - 'user_profile.php?redirect_url' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Open Media Collectors Database (OpenDb) 1.0.6 allow remote attack
33RISK
open ↗Exploit-DB✓ VexDay Proof
OpenDB 1.0.6 - 'listings.php?title' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Open Media Collectors Database (OpenDb) 1.0.6 allow remote attack
33RISK
open ↗Exploit-DB✓ VexDay Proof
RedHat 8/9 - Directory Server Crafted Search Pattern Denial of Service
Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 allow remote atta
23RISK
open ↗Exploit-DB✓ VexDay Proof
MatterDaddy Market 1.1 - 'login.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in admin/login.php in Matterdaddy Market 1.1 allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kyocera Mita Scanner File Utility 3.3.0.1 - File Transfer Directory Traversal
Directory traversal vulnerability in the Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Smart Survey 1.0 - 'surveyresults.asp' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in surveyresults.asp in Smart Survey 1.0 allows remote attackers to inject arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Belkin Wireless G Router / ADSL2 Modem - Authentication Bypass
cgi-bin/setup_dns.exe on the Belkin F5D7230-4 router with firmware 9.01.10 does not require authentication, which allows
23RISK
open ↗Exploit-DB✓ VexDay Proof
Bluemoon inc. PopnupBlog 3.30 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in index.php in the Bluemoon PopnupBLOG module 3.20 and 3.30 for XOO
23RISK
open ↗Exploit-DB✓ VexDay Proof
Belkin Wireless G Router / ADSL2 Modem - Authentication Bypass
cgi-bin/setup_virtualserver.exe on the Belkin F5D7230-4 router with firmware 9.01.10 allows remote attackers to cause a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dana IRC 1.4a - Remote Buffer Overflow
Stack-based buffer overflow in artegic Dana IRC client 1.3 and earlier allows remote attackers to cause a denial of serv
23RISK
open ↗Exploit-DB✓ VexDay Proof
Belkin Wireless G Router / ADSL2 Modem - Authentication Bypass
The control panel on the Belkin F5D7230-4 router with firmware 9.01.10 maintains authentication state by IP address, whi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ruby 1.9 - REXML Remote Denial of Service
The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers t
28RISK
open ↗Exploit-DB✓ VexDay Proof
onenews Beta 2 - Cross-Site Scripting / HTML Injection / SQL Injection
SQL injection vulnerability in index.php in One-News Beta 2 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
One-News - Multiple Input Validation Vulnerabilities
SQL injection vulnerability in index.php in One-News Beta 2 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Accellion File Transfer - Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in Accellion File Transfer FTA_7_0_135 allows remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Media Services 'nskey.dll' 4.1 - ActiveX Control Remote Buffer Overflow
Buffer overflow in the CallHTMLHelp method in the Microsoft Windows Media Services ActiveX control in nskey.dll 4.1.00.3
35RISK
open ↗Exploit-DB✓ VexDay Proof
PicturesPro Photo Cart 3.9 - Search Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in PICTURESPRO Photo Cart 3.9 allows remote attackers to inject ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fujitsu Web-Based Admin View 2.1.2 - Directory Traversal
Directory traversal vulnerability in Fujitsu Web-Based Admin View 2.1.2 allows remote attackers to read arbitrary files
23RISK
open ↗Exploit-DB✓ VexDay Proof
Simasy CMS - 'id' SQL Injection
SQL injection vulnerability in index.php in Simasy CMS allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
FAR-PHP 1.0 - 'index.php' Local File Inclusion
Directory traversal vulnerability in index.php in FAR-PHP 1.00, when magic_quotes_gpc is disabled, allows remote attacke
23RISK
open ↗Exploit-DB✓ VexDay Proof
TimeTrex Time 2.2 and Attendance Module - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in interface/Login.php in TimeTrex 2.2.11 allow remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Scripts4Profit DXShopCart 4.30 - 'pid' SQL Injection
SQL injection vulnerability in product_detail.php in DXShopCart 4.30mc allows remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
YourFreeWorld Ad-Exchange Script - 'id' SQL Injection
SQL injection vulnerability in tr.php in YourFreeWorld Ad-Exchange Script allows remote attackers to execute arbitrary S
23RISK
open ↗Exploit-DB✓ VexDay Proof
vBulletin 3.6.10/3.7.2 - '$newpm[title]' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3, when "Show New Private Message Notificat
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mono 2.0 - 'System.Web' HTTP Header Injection
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers
23RISK
open ↗Exploit-DB✓ VexDay Proof
Vim 7.1.314 - Insufficient Shell Escaping Multiple Command Execution Vulnerabilities
Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Vanilla 1.1.4 - HTML Injection / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Lussumo Vanilla 1.1.4 and earlier (1) allow remote attackers to i
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/templates/Freeway/mainpage_modules/mainpage.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/includes/modules/newsdesk/newsdesk_article_require.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.