Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,231cataloged exploits
35,420CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
ClassSystem 2.0/2.3 - 'HomepageTop.php?teacher_id' SQL Injection
Multiple SQL injection vulnerabilities in ClassSystem 2.3 allow remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Exploit-DB✓ VexDay Proof
ClassSystem 2.0/2.3 - 'class/ApplyDB.php' Unrestricted Arbitrary File Upload / Arbitrary Code Execution
Unrestricted file upload vulnerability in class/ApplyDB.php in ClassSystem 2.3 allows remote attackers to execute arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
ClassSystem 2.0/2.3 - 'HomepageMain.php?teacher_id' SQL Injection
Multiple SQL injection vulnerabilities in ClassSystem 2.3 allow remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPFix 2.0 - '/auth/00_pass.php?account' SQL Injection
Multiple SQL injection vulnerabilities in phpFix 2.0 allow remote attackers to execute arbitrary SQL commands via the (1
23RISK
open ↗Exploit-DB✓ VexDay Proof
Excuse Online - 'pwd.asp' SQL Injection
SQL injection vulnerability in pwd.asp in Excuse Online allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPFix 2.0 - '/fix/browse.php?kind' SQL Injection
Multiple SQL injection vulnerabilities in phpFix 2.0 allow remote attackers to execute arbitrary SQL commands via the (1
23RISK
open ↗Exploit-DB✓ VexDay Proof
AbleSpace 1.0 - 'adv_cat.php' SQL Injection
SQL injection vulnerability in adv_cat.php in AbleSpace 1.0 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Campus Bulletin Board 3.4 - '/post3/view.asp?id' SQL Injection
Multiple SQL injection vulnerabilities in Campus Bulletin Board 3.4 allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗Exploit-DB✓ VexDay Proof
Campus Bulletin Board 3.4 - '/post3/book.asp?review' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in post3/Book.asp in Campus Bulletin Board 3.4 allows remote attackers to injec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Campus Bulletin Board 3.4 - '/post3/book.asp?review' SQL Injection
Multiple SQL injection vulnerabilities in Campus Bulletin Board 3.4 allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗Exploit-DB✓ VexDay Proof
DZOIC Handshakes 3.5 - 'fname' SQL Injection
SQL injection vulnerability in index.php in DZOIC Handshakes 3.5 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗Exploit-DB✓ VexDay Proof
Horde Multiple Product - 'day.php?Timestamp' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware, Groupware Webmail Edition, and Kronolith allow r
23RISK
open ↗Exploit-DB✓ VexDay Proof
Horde Multiple Product - 'week.php?Timestamp' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware, Groupware Webmail Edition, and Kronolith allow r
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Upload File - 'wp-uploadfile.php' SQL Injection
SQL injection vulnerability in wp-uploadfile.php in the Upload File plugin for WordPress allows remote attackers to exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Horde Multiple Product - 'workweek.php?Timestamp' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Horde Groupware, Groupware Webmail Edition, and Kronolith allow r
23RISK
open ↗Exploit-DB✓ VexDay Proof
VideoLAN VLC Media Player 0.8.6d SSA Parsing Double Sh311 - Universal
Stack-based buffer overflow in the ParseSSA function (modules/demux/subtitle.c) in VLC 0.8.6e allows remote attackers to
28RISK
open ↗Exploit-DB✓ VexDay Proof
AbleDating 2.4 - 'search_results.php?keyword' SQL Injection
SQL injection vulnerability in search_results.php in ABK-Soft AbleDating 2.4 allows remote attackers to execute arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
phpSQLiteCMS 1 RC2 - '/cms/includes/login.inc.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in phpSQLiteCMS 1 RC2 allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
phpSQLiteCMS 1 RC2 - '/cms/includes/header.inc.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in phpSQLiteCMS 1 RC2 allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPFreeForum 1.0 rc2 - '/part/menu.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in PHPFreeForum 1.0 RC2 and earlier allow remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
Barracuda Spam Firewall 3.5.11 - 'ldap_test.cgi' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in ldap_test.cgi in Barracuda Spam Firewall (BSF) before 3.5.11.025 allows remo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Safari Montage 3.1.3 - 'forgotPW.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in forgotPW.php in Library Video Company SAFARI Montage 3.1.x allow
23RISK
open ↗Exploit-DB✓ VexDay Proof
BMForum 5.6 - 'bsd01footer.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in BMForum 5.6 allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
BMForum 5.6 - 'bsd01header.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in BMForum 5.6 allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
BMForum 5.6 - 'index.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in BMForum 5.6 allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPFreeForum 1.0 rc2 - 'error.php?message' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in PHPFreeForum 1.0 RC2 and earlier allow remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
AbleDating 2.4 - 'search_results.php?keyword' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in search_results.php in ABK-Soft AbleDating 2.4 allows remote attackers to inj
23RISK
open ↗Exploit-DB✓ VexDay Proof
SAP Web Application Server 7.0 - '/sap/bc/gui/sap/its/webgui/' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (ak
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Lotus Sametime 8.0 - Multiplexer Buffer Overflow
Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1
60RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 2.0.0.14 - JSframe Heap Corruption Denial of Service
Mozilla Firefox 2.0.0.14 allows remote attackers to cause a denial of service (heap corruption and application crash) or
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.