Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,401cataloged exploits
35,511CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,332GitHub PoC 14,209VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
PHPX 3.5.15/3.5.16 - 'news.php' SQL Injection
Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the (
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPX 3.5.15/3.5.16 - 'gallery.php' SQL Injection
Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the (
23RISK
open ↗Exploit-DB✓ VexDay Proof
NetVIOS Portal - 'page.asp' SQL Injection
SQL injection vulnerability in page.asp in NetVIOS 2.0 and earlier allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.1.6 - Mb_Parse_Str Function Register_Globals Activation
The mb_parse_str function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 sets the internal register_globals flag and
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Core < 2.1.2 - 'PHP_Self' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in th
23RISK
open ↗Exploit-DB✓ VexDay Proof
File(1) 4.13 - Command File_PrintF Integer Underflow
Integer underflow in the file_printf function in the "file" program before 4.20 allows user-assisted attackers to execut
28RISK
open ↗Exploit-DB✓ VexDay Proof
PHPX 3.5.15/3.5.16 - 'forums.php' SQL Injection
Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the (
23RISK
open ↗Exploit-DB✓ VexDay Proof
Net Portal Dynamic System (NPDS) 5.10 - Remote Code Execution (1)
Variable extraction vulnerability in grab_globals.php in Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Net Portal Dynamic System (NPDS) 5.10 - Remote Code Execution (1)
Static code injection vulnerability in admin/settings.php in Net Portal Dynamic System (NPDS) 5.10 and earlier allows re
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 4.4.6/5.2.1 - 'array_user_key_compare()' ZVAL dtor Local Overflow
The array_user_key_compare function in PHP 4.4.6 and earlier, and 5.x up to 5.2.1, makes erroneous calls to zval_dtor, w
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle Portal 10g - 'P_OldURL' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in PORTAL.wwv_main.render_warning_screen in the Oracle Portal 10g allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Holtstraeter Rot 13 - 'Enkrypt.php' Directory Traversal
Directory traversal vulnerability in enkrypt.php in Sascha Schroeder krypt (aka Holtstraeter Rot 13) allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
CA BrightStor ARCserve - 'msgeng.exe' Remote Stack Overflow
Multiple buffer overflows in CA BrightStor ARCserve Backup r11.5 SP1 and earlier, r11.1, and 9.01; BrightStor ARCserve B
60RISK
open ↗Exploit-DB✓ VexDay Proof
DirectAdmin 1.292 - 'CMD_USER_STATS' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in CMD_USER_STATS in DirectAdmin allows remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
Orion-Blog 2.0 - Remote Authentication Bypass
admin/default.asp in Orion-Blog 2.0 allows remote attackers to bypass authentication controls and gain privileges via a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Absolute Image Gallery 2.0 - 'gallery.asp?categoryId' SQL Injection
SQL injection vulnerability in gallery.asp in Absolute Image Gallery 2.0 allows remote attackers to execute arbitrary SQ
23RISK
open ↗Exploit-DB✓ VexDay Proof
Symantec 'SYMTDI.SYS' Device Driver - Local Denial of Service
The SymTDI device driver (SYMTDI.SYS) in Symantec Norton Personal Firewall 2006 9.1.1.7 and earlier, Internet Security 2
23RISK
open ↗Exploit-DB✓ VexDay Proof
WarFTP 1.65 (Windows 2000 SP4) - 'USER' Remote Buffer Overflow
Stack-based buffer overflow in War FTP Daemon 1.65, and possibly earlier, allows remote attackers to cause a denial of s
35RISK
open ↗Exploit-DB✓ VexDay Proof
Horde Framework 3.1.3 - 'login.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in framework/NLS/NLS.php in Horde Framework before 3.1.4 RC1, when the login pa
23RISK
open ↗Exploit-DB✓ VexDay Proof
Viper Web Portal 0.1 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in ViperWeb Portal alpha 0.1 allows remote attackers to execute arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
Horde Framework and IMP 2.x/3.x - Cleanup Cron Script Arbitrary File Deletion
Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Fram
23RISK
open ↗Exploit-DB✓ VexDay Proof
Woltlab Burning Board 2.x - 'usergroups.php' SQL Injection
SQL injection vulnerability in usergroups.php in Woltlab Burning Board (wBB) 2.x allows remote attackers to execute arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Horde IMP Webmail 4.0.4 Client - Multiple Input Validation Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
WarFTP 1.65 (Windows 2000 SP4) - 'USER' Remote Buffer Overflow
Stack-based buffer overflow in War FTP Daemon 1.65, and possibly earlier, allows remote attackers to cause a denial of s
35RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.2.1 - 'session_regenerate_id()' Double-Free
Double free vulnerability in PHP before 4.4.7, and 5.x before 5.2.2, allows context-dependent attackers to execute arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache Tomcat 5.x/6.0.x - Directory Traversal
Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using c
45RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 7 - NavCancel.HTM Cross-Site Scripting
Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly
28RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.2.0/5.2.1 - Rejected Session ID Double-Free
Double free vulnerability in the session extension in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to execute
23RISK
open ↗Exploit-DB✓ VexDay Proof
Zomplog 3.7.6 (Windows x86) - Local File Inclusion
Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier allows remote attackers to include arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
aBitWhizzy - 'whizzylink.php?d' Traversal Arbitrary Directory Listing
Multiple directory traversal vulnerabilities in aBitWhizzy allow remote attackers to list arbitrary directories via a ..
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.