Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,401cataloged exploits
35,511CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,332GitHub PoC 14,209VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
NetClassifieds 1.9.7 - Multiple Input Validation Vulnerabilities
Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition allow remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPAccounts 0.5 - 'index.php' Local File Inclusion
Directory traversal vulnerability in index.php in PHPAccounts 0.5 allows remote attackers to include arbitrary local fil
23RISK
open ↗Exploit-DB✓ VexDay Proof
BugHunter HTTP Server 1.6.2 - Parse Error Information Disclosure
httpsv.exe in HTTP Server 1.6.2 allows remote attackers to obtain sensitive information (script source code) via a URI w
23RISK
open ↗Exploit-DB✓ VexDay Proof
Comersus Cart 7.0.7 - 'comersus_customerAuthenticateForm.asp' redirectUrl Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Comersus Cart 7.07 allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Comersus Cart 7.0.7 - 'comersus_message.asp' redirectUrl Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Comersus Cart 7.07 allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
FuseTalk 4.0 - 'AuthError.cfm' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, En
23RISK
open ↗Exploit-DB✓ VexDay Proof
FuseTalk 4.0 - 'forum/include/common/comfinish.cfm?FTVAR_SCRIPTRUN' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, En
23RISK
open ↗Exploit-DB✓ VexDay Proof
Comersus Cart 7.0.7 - 'comersus_optReviewReadExec.asp?id' SQL Injection
SQL injection vulnerability in comersus_optReviewReadExec.asp in Comersus Shop Cart 7.07 allows remote attackers to exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
W1L3D4 WEBmarket 0.1 - SQL Injection
SQL injection vulnerability in urunbak.asp in W1L3D4 WEBmarket 0.1 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Exploit-DB✓ VexDay Proof
FuseTalk 4.0 - 'blog/include/common/comfinish.cfm?FTVAR_SCRIPTRUN' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, En
23RISK
open ↗Exploit-DB✓ VexDay Proof
FuseTalk 2.0/3.0 - 'AuthError.cfm' SQL Injection
SQL injection vulnerability in forum/include/error/autherror.cfm in FuseTalk allows remote attackers to execute arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
WSPortal 1.0 - 'content.php' SQL Injection
content.php in WSPortal 1.0, when magic_quotes_gpc is disabled, allows remote attackers to obtain sensitive information
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebIf - 'OutConfig' Local File Inclusion
Directory traversal vulnerability in webif.cgi in ifnet WEBIF allows remote attackers to include and execute arbitrary l
23RISK
open ↗Exploit-DB✓ VexDay Proof
TDizin - 'Arama.asp' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in arama.asp in TDizin allows remote attackers to inject arbitrary web script o
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fuzzylime 1.0 - 'Low.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in low.php in Fuzzylime Forum 1.01b and earlier allows remote attackers to inje
23RISK
open ↗Exploit-DB✓ VexDay Proof
YourFreeScreamer 1.0 - 'serverPath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in YourFreeScreamer 1.0, when register_globals is enabled, allow remo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Safari 3.0.1 for Windows - 'Corefoundation.dll' Denial of Service
corefoundation.dll in Apple Safari 3.0.1 (552.12.2) for Windows allows remote attackers to cause a denial of service (cr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kaspersky Internet Security 6.0 - SSDT Hooks Multiple Local Vulnerabilities
klif.sys in Kaspersky Internet Security 6.0 and 7.0, Kaspersky Anti-Virus (KAV) 6.0 and 7.0, KAV 6.0 for Windows Worksta
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache Tomcat 6.0.13 - JSP Example Web Applications Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomca
60RISK
open ↗Exploit-DB✓ VexDay Proof
Apache MyFaces Tomahawk JSF Framework 1.1.5 - 'Autoscroll' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6
35RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Letterman Subscriber Module 1.2.4 - 'Mod_Lettermansubscribe.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in mod_lettermansubscribe.php in the Letterman Subscriber (mod_letterman) befor
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Speech API ActiveX Control (Windows XP SP2) - Remote Buffer Overflow (MS07-033)
Multiple buffer overflows in the (1) ActiveListen (Xlisten.dll) and (2) ActiveVoice (Xvoice.dll) speech controls, as use
35RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Speech API ActiveX Control (Windows 2000 SP4) - Remote Buffer Overflow (MS07-033)
Multiple buffer overflows in the (1) ActiveListen (Xlisten.dll) and (2) ActiveVoice (Xvoice.dll) speech controls, as use
35RISK
open ↗Exploit-DB✓ VexDay Proof
Firebird SQL Fbserver 2.0 - Remote Buffer Overflow
Buffer overflow in fbserver.exe in Firebird SQL 2 before 2.0.1 allows remote attackers to execute arbitrary code via a l
28RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Safari 3 for Windows - Protocol Handler Command Injection
Apple Safari Beta 3.0.1 for Windows allows remote attackers to execute arbitrary commands via shell metacharacters in a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mbedthis AppWeb 2.2.2 - URL Protocol Format String
Format string vulnerability in the MprLogToFile::logEvent function in Mbedthis AppWeb 2.0.5-4, when the build supports l
23RISK
open ↗Exploit-DB✓ VexDay Proof
JFFNms 0.8.3 - 'auth.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in auth.php in Just For Fun Network Management System (JFFNMS) 0.8.3, when magic_
23RISK
open ↗Exploit-DB✓ VexDay Proof
Beehive Forum 0.7.1 - 'links.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in links.php in Beehive Forum 0.7.1 allow remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
WindowsPT 1.2 - User ID Key Spoofing
Visual truncation vulnerability in Windows Privacy Tray (WinPT) 1.2.0 allows user-assisted remote attackers to install a
23RISK
open ↗Exploit-DB✓ VexDay Proof
bbPress 0.8.1 - 'BB-login.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in bb-login.php in bbPress 0.8.1 allows remote attackers to inject arbitrary we
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.