Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,302cataloged exploits
35,469CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,301GitHub PoC 14,141VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
PHP Helpdesk 0.6.16 - 'index.php' Local File Inclusion
Directory traversal vulnerability in index.php in phphelpdesk 0.6.16 allows remote attackers to include and execute arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Synergiser 1.2 RC1 - Local File Inclusion / Full Path Disclosure
Directory traversal vulnerability in index.php in Firewolf Technologies Synergiser 1.2 RC1 and earlier allows remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
Helios Calendar 1.1/1.2 - 'admin/index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in admin/index.php in Helios Calendar 1.2.1 Beta allows remote attackers to inj
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ubuntu 6.06 - DHCPd Remote Denial of Service
in.dhcpd in the DHCP implementation in Sun Solaris 8 through 10, and OpenSolaris before snv_103, allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
GNU Emacs 22.1 - Local Variable Handling Code Execution
The hack-local-variables function in Emacs before 22.2, when enable-local-variables is set to :safe, does not properly s
23RISK
open ↗Exploit-DB✓ VexDay Proof
SonicWALL SSL VPN 1.3 3 WebCacheCleaner - ActiveX FileDelete Method Traversal Arbitrary File Deletion
Absolute path traversal vulnerability in the WebCacheCleaner ActiveX control 1.3.0.3 in SonicWall SSL-VPN 200 before 2.1
23RISK
open ↗Exploit-DB✓ VexDay Proof
CONTENTCustomizer 3.1 - 'Dialog.php' Information Disclosure
dialog.php in CONTENTCustomizer 3.1mp and earlier allows remote attackers to obtain sensitive author credentials by maki
23RISK
open ↗Exploit-DB✓ VexDay Proof
Synergiser 1.2 - 'index.php' Local File Inclusion
Directory traversal vulnerability in index.php in Firewolf Technologies Synergiser 1.2 RC1 and earlier allows remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
Yarssr 0.2.2 - GUI.PM Remote Code Injection
GUI.pm in yarssr 0.2.2, when Gnome default URL handling is disabled, allows remote attackers to execute arbitrary comman
23RISK
open ↗Exploit-DB✓ VexDay Proof
Perdition 1.17 - IMAPD __STR_VWRITE Remote Format String
The format string protection mechanism in IMAPD for Perdition Mail Retrieval Proxy 1.17 and earlier allows remote attack
28RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-AGTC Membership System 1.1a - Remote Add Admin
adduser.php in PHP-AGTC Membership (AGTC-Membership) System 1.1a does not require authentication, which allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
Smart-Shop - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Smart-Shop allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlobalLink 2.7.0.8 - ConnectAndEnterRoom ActiveX Control Stack Buffer Overflow
Stack-based buffer overflow in a certain ActiveX control in GLChat.ocx 2.5.1.32 in GlobalLink 2.7.0.8, as used in Ourgam
28RISK
open ↗Exploit-DB✓ VexDay Proof
Omnistar Live - 'KB.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Omnistar Live allow remote attackers to inject arbitrary web scri
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Core 2.3 - 'Edit-Post-Rows.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inje
23RISK
open ↗Exploit-DB✓ VexDay Proof
Saxon 5.4 - 'Example.php' SQL Injection
SQL injection vulnerability in example.php in SAXON 5.4 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Exploit-DB✓ VexDay Proof
Saxon 5.4 - 'Menu.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in admin/menu.php in SAXON 5.4 allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Blue Coat ProxySG Management Console - URI Handler Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in the management console in Blue Coat ProxySG before 4.2.6.1, and 5.x before 5
23RISK
open ↗Exploit-DB✓ VexDay Proof
CA BrightStor HSM r11.5 - Remote Stack Overflow / Denial of Service
Multiple stack-based buffer overflows in Computer Associates (CA) BrightStor Hierarchical Storage Manager (HSM) before r
50RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Tivoli Storage Manager 5.3 - Express CAD Service Buffer Overflow
Buffer overflow in the Client Acceptor Daemon (CAD), dsmcad.exe, in certain IBM Tivoli Storage Manager (TSM) clients 5.1
60RISK
open ↗Exploit-DB✓ VexDay Proof
Shttp 0.0.x - Directory Traversal
The safe_path function in shttp before 0.0.5 allows remote attackers to conduct directory traversal attacks and read fil
23RISK
open ↗Exploit-DB✓ VexDay Proof
TikiWiki 1.9.8.1 - Local File Inclusion
Multiple directory traversal vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to include and execu
23RISK
open ↗Exploit-DB✓ VexDay Proof
Aleris Web Publishing Server 3.0 - 'Page.asp' SQL Injection
SQL injection vulnerability in calendar/page.asp in Aleris Web Publishing Server 3.0 allows remote attackers to execute
23RISK
open ↗Exploit-DB✓ VexDay Proof
Multi-Forums - 'Directory.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3, for
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle 10g - 'CTX_DOC.MARKUP' SQL Injection
Multiple SQL injection vulnerabilities in the CTXSYS Intermedia application for the Oracle Text component (CTX_DOC) in O
23RISK
open ↗Exploit-DB✓ VexDay Proof
Korean GHBoard - 'Component/upload.jsp' Arbitrary File Upload
Unrestricted file upload vulnerability in component/upload.jsp in Korean GHBoard allows remote attackers to upload arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Korean GHBoard FlashUpload Component - 'download.jsp?name' Arbitrary File Access
Directory traversal vulnerability in component/flashupload/download.jsp in the FlashUpload component in Korean GHBoard a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Japanese PHP Gallery Hosting - Arbitrary File Upload
Unrestricted file upload vulnerability in upload/upload.php in Japanese PHP Gallery Hosting, when Open directory mode is
23RISK
open ↗Exploit-DB✓ VexDay Proof
deeemm CMS (dmcms) 0.7 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in DeeEmm.com DM CMS 0.7.0.Beta allows remote attackers to execute arbitrary SQ
23RISK
open ↗Exploit-DB✓ VexDay Proof
Hackish 1.1 - 'Blocco.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in shoutbox/blocco.php in Hackish BETA 1.1 allows remote attackers to inject ar
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.