Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,449cataloged exploits
35,552CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,367GitHub PoC 14,225VulnCheck XDB 8,649Nuclei 4,283Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
cPanel WebHost Manager 3.1 - 'addon_configsupport.cgi?supporturl' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated use
23RISK
open ↗Exploit-DB✓ VexDay Proof
cPanel WebHost Manager 3.1 - 'dofeaturemanager?feature' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated use
23RISK
open ↗Exploit-DB✓ VexDay Proof
cPanel WebHost Manager 3.1 - 'dochangeemail?email' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated use
23RISK
open ↗Exploit-DB✓ VexDay Proof
ASP ListPics 5.0 - 'Listpics.asp' SQL Injection
SQL injection vulnerability in listpics.asp in ASP ListPics 5.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Exploit-DB✓ VexDay Proof
Simple PHP Gallery 1.1 - 'System SP_Index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in sp_index.php in Simple PHP Gallery 1.1 allows remote attackers to inject arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fixit iDms Pro Image Gallery - 'filelist.asp' Multiple SQL Injections
Multiple SQL injection vulnerabilities in Fixit iDMS Pro Image Gallery allow remote attackers to execute arbitrary SQL c
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fixit iDms Pro Image Gallery - 'showfile.asp?fid' SQL Injection
Multiple SQL injection vulnerabilities in Fixit iDMS Pro Image Gallery allow remote attackers to execute arbitrary SQL c
23RISK
open ↗Exploit-DB✓ VexDay Proof
MidiCart ASP - 'Item_Show.asp?ID2006quant' SQL Injection
Multiple SQL injection vulnerabilities in MidiCart ASP Shopping Cart and ASP Plus Shopping Cart allow remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
MMGallery 1.55 - 'Thumbs.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in thumbs.php in mmgallery 1.55 allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cahier de texte 2.0 - Database Backup / Source Disclosure
administration/telecharger.php in Cahier de texte 2.0 allows remote attackers to obtain unparsed content (source code) o
23RISK
open ↗Exploit-DB✓ VexDay Proof
Site News - 'centre.php' Remote File Inclusion
PHP remote file inclusion vulnerability in centre.php in Site News (site_news) 2.00, and possibly earlier, allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Messagerie Locale - 'centre.php' Remote File Inclusion
PHP remote file inclusion vulnerability in centre.php in Messagerie Locale as of 20061127 allows remote attackers to exe
23RISK
open ↗Exploit-DB✓ VexDay Proof
Woltlab Burning Board Lite 1.0.2 - Blind SQL Injection
Woltlab Burning Board (wBB) Lite 1.0.2 does not properly unset variables when the input data includes a numeric paramete
23RISK
open ↗Exploit-DB✓ VexDay Proof
Business Objects Crystal Reports XI Professional - File Handling Buffer Overflow
Stack-based buffer overflow in Visual Studio Crystal Reports for Microsoft Visual Studio .NET 2002 and 2002 SP1, .NET 20
35RISK
open ↗Exploit-DB✓ VexDay Proof
Nvidia NView 3.5 - 'Keystone.exe' Local Denial of Service
keystone.exe in nVIDIA nView allows attackers to cause a denial of service via a long command line argument. NOTE: it i
23RISK
open ↗Exploit-DB✓ VexDay Proof
Netgear WG311v1 Wireless Driver 2.3.1.10 - SSID Heap Buffer Overflow
Heap-based buffer overflow in the wireless driver (WG311ND5.SYS) 2.3.1.10 for NetGear WG311v1 wireless adapter allows re
28RISK
open ↗Exploit-DB✓ VexDay Proof
PMOS Help Desk 2.3 - 'ticket.php?email' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in (a) PMOS Help Desk 2.4, formerly (b) InverseFlow Help Desk 2.31 a
23RISK
open ↗Exploit-DB✓ VexDay Proof
PMOS Help Desk 2.3 - 'ticketview.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in (a) PMOS Help Desk 2.4, formerly (b) InverseFlow Help Desk 2.31 a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Novell Client 4.91 - 'NWSPOOL.dll' Remote Buffer Overflow
Multiple buffer overflows in the Spooler service (nwspool.dll) in Novell Netware Client 4.91 through 4.91 SP2 allow remo
35RISK
open ↗Exploit-DB✓ VexDay Proof
CreaDirectory 1.2 - 'search.asp?search' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in CreaScripts Creadirectory allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
CreaDirectory 1.2 - 'search.asp?category' SQL Injection
SQL injection vulnerability in search.asp in CreaScripts Creadirectory allows remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
My Little Weblog 2006.11.21 - 'Weblog.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in weblog.php in my little weblog allows remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
JiRos Link Manager 1.0 - 'openlink.asp?LinkID' SQL Injection
Multiple SQL injection vulnerabilities in JiRos Links Manager allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Exploit-DB✓ VexDay Proof
XMPlay 3.3.0.4 - '.ASX' Filename Local Buffer Overflow
Stack-based buffer overflow in Un4seen XMPlay 3.3.0.5 and earlier allows remote attackers to execute arbitrary code via
50RISK
open ↗Exploit-DB✓ VexDay Proof
GNU Tar 1.1x - 'GNUTYPE_NAMES' Directory Traversal
GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a
28RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX 10.4.8 - UDTO Disk Image Remote Denial of Service
Unspecified vulnerability in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to cause a deni
23RISK
open ↗Exploit-DB✓ VexDay Proof
Seditio 1.10 - avatarselect id SQL Injection
SQL injection vulnerability in system/core/users/users.profile.inc.php in Neocrome Seditio 1.10 and earlier allows remot
23RISK
open ↗Exploit-DB✓ VexDay Proof
CreaDirectory 1.2 - 'addlisting.asp?cat' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in CreaScripts Creadirectory allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
JiRos Link Manager 1.0 - 'viewlinks.asp?categoryId' SQL Injection
Multiple SQL injection vulnerabilities in JiRos Links Manager allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Exploit-DB✓ VexDay Proof
LDU 8.x - avatarselect id SQL Injection
SQL injection vulnerability in polls.php in Neocrome Land Down Under (LDU) 8.x and earlier allows remote attackers to ex
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.