Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,284cataloged exploits
35,465CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,301GitHub PoC 14,134VulnCheck XDB 8,635Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
EncapsGallery 1.11.2 - 'catalog_watermark.php?file' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in EncapsGallery 1.11.2 allow remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Nuke Hadith Module - 'cat' SQL Injection
SQL injection vulnerability in Hadith module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Gallarific - 'search.php?query' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in search.php in Gallarific allows remote attackers to inject arbitrary web scr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Gallarific - Multiple Script Direct Request Authentication Bypass
Gallarific does not require authentication for (1) users.php and (2) index.php, which allows remote attackers to add and
23RISK
open ↗Exploit-DB✓ VexDay Proof
Drake CMS 0.4.11 RC8 - 'd_root' Local File Inclusion
Absolute path traversal vulnerability in install/index.php in Drake CMS 0.4.11 RC8 allows remote attackers to read and e
23RISK
open ↗Exploit-DB✓ VexDay Proof
RemotelyAnywhere 8.0.668 - 'Accept-Charset' Null Pointer Denial of Service
The RemotelyAnywhere.exe service in the Remotely Anywhere Server and Workstation 8.0.668 and earlier allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
Panda Internet Security/AntiVirus+Firewall 2008 - 'CPoint.sys' Memory Corruption
The cpoint.sys driver in Panda Internet Security 2008 and Antivirus+ Firewall 2008 allows local users to cause a denial
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alkacon OpenCMS 7.0.3 - 'logfileViewSettings.jsp?filePath.0' Arbitrary File Access
Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alkacon OpenCMS 7.0.3 - 'logfileViewSettings.jsp?filePath' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/log
23RISK
open ↗Exploit-DB✓ VexDay Proof
ImageVue 1.7 - 'dirxml.php?path' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in imageVue 1.7 allow remote attackers to inject arbitrary web scrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
ImageVue 1.7 - 'popup.php?path' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in imageVue 1.7 allow remote attackers to inject arbitrary web scrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
Neptune Web Server 3.0 - 404 Error Page Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Neptune Web Server 3.0 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
Specimen Image Database - 'taxonservice.php?dir' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Specimen Image Database (SID), when register_globals is enabled, a
23RISK
open ↗Exploit-DB✓ VexDay Proof
ImageVue 1.7 - 'upload.php?path' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in imageVue 1.7 allow remote attackers to inject arbitrary web scrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Core 2.3.2 - '/wp-admin/invites.php?to' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
MailEnable 3.13 - IMAP Service Multiple Remote Vulnerabilities
The IMAP service (MEIMAPS.exe) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Core 2.3.2 - '/wp-admin/users.php?inviteemail' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
ImageVue 1.7 - 'dir2.php?path' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in imageVue 1.7 allow remote attackers to inject arbitrary web scrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Office 2000/2003/2004/XP - File Memory Corruption
Unspecified vulnerability in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, Excel Viewer 2003 up to SP3, and Office 2004 f
35RISK
open ↗Exploit-DB✓ VexDay Proof
Yap Blog 1.1 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in wildmary Yap Blog 1.1 allows remote attackers to execute arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Nuke KutubiSitte Module - 'kid' SQL Injection
SQL injection vulnerability in the Kutub-i Sitte (KutubiSitte) 1.1 module for PHP-Nuke allows remote attackers to execut
23RISK
open ↗Exploit-DB✓ VexDay Proof
Check Point VPN-1 UTM Edge NGX 7.0.48x - Login Page Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the login page in Check Point VPN-1 UTM Edge W Embedded NGX 7.0.48x allows r
23RISK
open ↗Exploit-DB✓ VexDay Proof
Airspan ProST WiMAX Device - Web Interface Authentication Bypass
The administration panel on the Airspan WiMax ProST 4.1 antenna with 6.5.38.0 software does not verify authentication cr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sun Java Runtime Environment 1.x - Image Parsing Heap Buffer Overflow
Unspecified vulnerability in Java Runtime Environment Image Parsing Library in Sun JDK and JRE 6 Update 4 and earlier, a
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microworld eScan Server 9.0.742 - Directory Traversal
Absolute path traversal vulnerability in the FTP server in MicroWorld eScan Corporate Edition 9.0.742.98 and eScan Manag
23RISK
open ↗Exploit-DB✓ VexDay Proof
ICQ Toolbar 2.3 - ActiveX Remote Denial of Service
toolbaru.dll in ICQ Toolbar (ICQToolbar) 2.3 allows remote attackers to cause a denial of service (toolbar crash) via a
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Nuke 4nChat Module 0.91 - 'roomid' SQL Injection
SQL injection vulnerability in the 4nChat 0.91 module for PHP-Nuke allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Exploit-DB✓ VexDay Proof
Perforce Server 2007.3 - Multiple Remote Denial of Service Vulnerabilities
The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of
23RISK
open ↗Exploit-DB✓ VexDay Proof
Google Android Web Browser - '.BMP' File Integer Overflow
Integer overflow in the BMP::readFromStream method in the libsgl.so library in Google Android SDK m3-rc37a and earlier,
23RISK
open ↗Exploit-DB✓ VexDay Proof
Google Android Web Browser - '.GIF' File Heap Buffer Overflow
Heap-based buffer overflow in the GIF library in the WebKit framework for Google Android SDK m3-rc37a and earlier allows
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.