Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,231cataloged exploits
35,420CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
Datafeed Studio 1.6.2 - 'search.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in search.php in Datafeed Studio 1.6.2 allows remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
IDevSpot PHPLinkExchange 1.01/1.02 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in index.php in IDevSpot PhpLinkExchange 1.01 allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
Bugzilla 3.1.4 - '--attach_path' Directory Traversal
Directory traversal vulnerability in importxml.pl in Bugzilla before 2.22.5, and 3.x before 3.0.5, when --attach_path is
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ruby 1.9 - Safe Level Multiple Function Restriction Bypass
Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly rest
28RISK
open ↗Exploit-DB✓ VexDay Proof
Ruby 1.9 - 'WEBrick::HTTP::DefaultFileHandler' Crafted HTTP Request Denial of Service
httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to
28RISK
open ↗Exploit-DB✓ VexDay Proof
Ruby 1.9 dl - Module DL.dlopen Arbitrary Library Access
Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly rest
28RISK
open ↗Exploit-DB✓ VexDay Proof
Ruby 1.9 dl - Module DL.dlopen Arbitrary Library Access
The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does
28RISK
open ↗Exploit-DB✓ VexDay Proof
Ruby 1.9 - 'WEBrick::HTTP::DefaultFileHandler' Crafted HTTP Request Denial of Service
Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFile
60RISK
open ↗Exploit-DB✓ VexDay Proof
Kayako SupportSuite 3.x - 'index.php?filter' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Kayako SupportSuite 3.20.02 and earlier allow remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kayako SupportSuite 3.x - '/visitor/index.php?sessionid' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Kayako SupportSuite 3.20.02 and earlier allow remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Domain Group Network GooCMS 1.02 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Domain Group Network GooCMS 1.02 allows remote attackers to inj
23RISK
open ↗Exploit-DB✓ VexDay Proof
pPIM 1.0 - Upload/Change Password
Directory traversal vulnerability in upload.php in Phlatline's Personal Information Manager (pPIM) 1.0 allows remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
pPIM 1.0 - Upload/Change Password
Directory traversal vulnerability in notes.php in Phlatline's Personal Information Manager (pPIM) 1.01 allows remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kayako SupportSuite 3.x - '/staff/index.php?customfieldlinkid' SQL Injection
SQL injection vulnerability in staff/index.php in Kayako SupportSuite 3.20.02 and earlier allows remote authenticated us
23RISK
open ↗Exploit-DB✓ VexDay Proof
pPIM 1.0 - Upload/Change Password
Cross-site scripting (XSS) vulnerability in events.php in Phlatline's Personal Information Manager (pPIM) 1.0 allows rem
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ovidentia 6.6.5 - 'item' SQL Injection
SQL injection vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
pPIM 1.0 - Arbitrary File Delete / Cross-Site Scripting
Unrestricted file upload vulnerability in upload.php in Phlatline's Personal Information Manager (pPIM) 1.0 and earlier
23RISK
open ↗Exploit-DB✓ VexDay Proof
BlazeDVD 5.0 - '.PLF' Playlist File Remote Buffer Overflow
Stack-based buffer overflow in BlazeVideo BlazeDVD Standard and Professional 5.0, and possibly earlier, allows remote at
50RISK
open ↗Exploit-DB✓ VexDay Proof
pPIM 1.0 - Arbitrary File Delete / Cross-Site Scripting
Directory traversal vulnerability in notes.php in Phlatline's Personal Information Manager (pPIM) 1.01 allows remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
pPIM 1.0 - Arbitrary File Delete / Cross-Site Scripting
changepassword.php in Phlatline's Personal Information Manager (pPIM) 1.0 and earlier does not require administrative au
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cisco WebEx Meeting Manager UCF - 'atucfobj.dll' ActiveX Remote Buffer Overflow
20RISK
open ↗Exploit-DB✓ VexDay Proof
RMSOFT MiniShop 1.0 - 'search.php' Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in search.php in the RMSOFT MiniShop module 1.0 for Xoops allows remote attacke
23RISK
open ↗Exploit-DB✓ VexDay Proof
Yogurt Social Network 3.2 rc1 Module for XOOPS - 'index.php?uid' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Yogurt Social Network module 3.2 rc1 for XOOPS allow remote a
23RISK
open ↗Exploit-DB✓ VexDay Proof
RMSOFT Downloads Plus - '/(rmdp) 1.5/1.7 Module for XOOPS search.php?key' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the RMSOFT Downloads Plus (rmdp) module 1.5 and 1.7 for Xoops all
23RISK
open ↗Exploit-DB✓ VexDay Proof
Yogurt Social Network 3.2 rc1 Module for XOOPS - 'tribes.php?uid' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Yogurt Social Network module 3.2 rc1 for XOOPS allow remote a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Yogurt Social Network 3.2 rc1 Module for XOOPS - 'seutubo.php?uid' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Yogurt Social Network module 3.2 rc1 for XOOPS allow remote a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Yogurt Social Network 3.2 rc1 Module for XOOPS - 'scrapbook.php?uid' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Yogurt Social Network module 3.2 rc1 for XOOPS allow remote a
23RISK
open ↗Exploit-DB✓ VexDay Proof
RMSOFT Downloads Plus - '/(rmdp) 1.5/1.7 Module for XOOPS down.php?id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the RMSOFT Downloads Plus (rmdp) module 1.5 and 1.7 for Xoops all
23RISK
open ↗Exploit-DB✓ VexDay Proof
Yogurt Social Network 3.2 rc1 Module for XOOPS - 'friends.php?uid' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Yogurt Social Network module 3.2 rc1 for XOOPS allow remote a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Yogurt Social Network 3.2 rc1 Module for XOOPS - 'album.php?uid' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Yogurt Social Network module 3.2 rc1 for XOOPS allow remote a
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.