Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,231cataloged exploits
35,420CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/english/account.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/templates/Freeway/boxes/loginbox.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ovidentia 6.6.5 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
NewsHOWLER 1.03 - Cookie Data SQL Injection
SQL injection vulnerability in NewsHOWLER 1.03 Beta allows remote attackers to execute arbitrary SQL commands via the ne
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/templates/Freeway/mainpage_modules/mainpage.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/templates/Freeway/boxes/whos_online.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/french/account_newsletters.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
AWStats 6.8 - 'AWStats.pl' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeway 1.4.1.171 - '/includes/modules/faqdesk/faqdesk_article_require.php?language' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mambo Open Source 4.6.2 - '/mambots/editors/mostlyce/' PHP/connector.php?Query String Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.2 and 4.6.5, when register_globals is enabled, allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mambo Open Source 4.6.2 - '/administrator/popups/index3pop.php?mosConfig_sitename' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.2 and 4.6.5, when register_globals is enabled, allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
FipsCMS 2.1 - 'neu.asp' SQL Injection
SQL injection vulnerability in forum/neu.asp in fipsCMS 2.1 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
FlexCMS 2.5 - 'inc-core-admin-editor-previouscolorsjs.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in inc-core-admin-editor-previouscolorsjs.php in the FlexCMS 2.5 and earlier, w
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPizabi 0.848b C1 HP3 - 'id' Local File Inclusion
Directory traversal vulnerability in index.php in PHPizabi 0.848b C1 HFP3 allows remote authenticated administrators to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Yelp 2.23.1 - Invalid URI Format String
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24
28RISK
open ↗Exploit-DB✓ VexDay Proof
Meet#Web 0.8 - 'ManagerResource.class.php?root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Meet#Web 0.8 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Realty - 'dpage.php' SQL Injection
SQL injection vulnerability in dpage.php in YPN PHP Realty allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Meet#Web 0.8 - 'RegForm.class.php?root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Meet#Web 0.8 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗Exploit-DB✓ VexDay Proof
Nortel Networks SRG V16 - 'modules.php?module' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in NavBoard 16 (2.6.0) allow remote attackers to include and execute arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Meet#Web 0.8 - 'ManagerRightsResource.class.php?root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Meet#Web 0.8 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗Exploit-DB✓ VexDay Proof
YapBB 1.2 - 'class_yapbbcooker.php' Remote File Inclusion
PHP remote file inclusion vulnerability in include/class_yapbbcooker.php in YapBB 1.2.Beta 2 allows remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Fusion 4.01 - 'readmore.php' SQL Injection
SQL injection vulnerability in readmore.php in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
Nukeviet 2.0 - '/admin/login.php' Cookie Authentication Bypass
Nukeviet 2.0 Beta allows remote attackers to bypass authentication and gain administrative access by setting the admf co
23RISK
open ↗Exploit-DB✓ VexDay Proof
Meet#Web 0.8 - 'RegRightsResource.class.php?root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Meet#Web 0.8 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗Exploit-DB✓ VexDay Proof
Meet#Web 0.8 - 'RegResource.class.php?root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Meet#Web 0.8 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗Exploit-DB✓ VexDay Proof
Meet#Web 0.8 - 'modules.php?root_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Meet#Web 0.8 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗Exploit-DB✓ VexDay Proof
Nortel Networks SRG V16 - 'modules.php?module' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in modules.php in NavBoard 16 (2.6.0) allows remote attackers to inject arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
Nortel Networks SRG V16 - 'admin_modules.php?module' Traversal Local File Inclusion
Multiple directory traversal vulnerabilities in NavBoard 16 (2.6.0) allow remote attackers to include and execute arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Datafeed Studio - 'patch.php' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/bin/patch.php in MartinWood Datafeed Studio before 1.6.3 allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Datafeed Studio 1.6.2 - 'search.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in search.php in Datafeed Studio 1.6.2 allows remote attackers to inject arbitr
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.