Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,772cataloged exploits
35,760CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,523GitHub PoC 14,289VulnCheck XDB 8,710Nuclei 4,319Metasploit 3,476✓ verified onlyrecentpopularrisk
22,523 exploits
Referência✓ VexDay Proof
SFS Ez Forum - SQL Injection
SQL injection vulnerability in forum.php in Scripts for Sites (SFS) Ez Forum allows remote attackers to execute arbitrar
23RISK
open ↗Referência
CVE-2017-2533
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "DiskArbitra
23RISK
open ↗Referência
CVE-2021-28418
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and
23RISK
open ↗Referência
CVE-2018-10257
A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privile
23RISK
open ↗Referência
CVE-2018-10257
A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privile
23RISK
open ↗Referência
CVE-2021-28419
The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads
28RISK
open ↗Referência
CVE-2018-14327
The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before
23RISK
open ↗Referência
CVE-2018-14327
The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before
23RISK
open ↗Referência✓ VexDay Proof
Trawler Web CMS 1.8.1 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Trawler Web CMS 1.8.1 and earlier allow remote attackers to execut
23RISK
open ↗Referência
CVE-2023-23163
Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the editid parame
23RISK
open ↗Referência✓ VexDay Proof
ID Automation Linear Barcode - ActiveX Denial of Service
Unspecified vulnerability in the ID Automation Linear Barcode 1.6.0.5 ActiveX control in IDAutomationLinear6.dll allows
23RISK
open ↗Referência✓ VexDay Proof
Spice Classifieds - 'cat_path' SQL Injection
SQL injection vulnerability in index.php in Spice Classifieds allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência
CVE-2018-11564
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature.
23RISK
open ↗Referência
CVE-2018-11564
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature.
23RISK
open ↗Referência
CVE-2021-29447
WordPress Authenticated XXE attack when installation is running PHP 8
63RISK
open ↗Referência
CVE-2021-29447
WordPress Authenticated XXE attack when installation is running PHP 8
63RISK
open ↗Referência
CVE-2011-4898
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error message
23RISK
open ↗Referência✓ VexDay Proof
Ocean FTP Server 1.00 - Denial of Service
Code Ocean FTP server 1.0 allows remote attackers to cause a denial of service via a large number of connections.
23RISK
open ↗Referência
CVE-2015-4071
The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users
23RISK
open ↗Referência
CVE-2015-4071
The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users
23RISK
open ↗Referência
CVE-2013-5945
Multiple SQL injection vulnerabilities in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.0
23RISK
open ↗Referência
CVE-2018-8814
Cross-site request forgery (CSRF) vulnerability in WolfCMS 0.8.3.1 allows remote attackers to hijack the authentication
23RISK
open ↗Referência
CVE-2012-1417
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow
23RISK
open ↗Referência
CVE-2012-1417
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow
23RISK
open ↗Referência✓ VexDay Proof
phpCC 4.2 Beta - 'base_dir' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Fabian Hainz phpCC Beta 4.2 allow remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
SIPS 0.3.1 - 'box.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in sipssys/code/box.inc.php in Haakon Nilsen simple, integrated publishing syste
23RISK
open ↗Referência✓ VexDay Proof
MyPHPcommander 2.0 - 'package.php' Remote File Inclusion
PHP remote file inclusion vulnerability in system/lib/package.php in MyPHPCommander 2.0 allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
FCRing 1.31 - 'fcring.php?s_fuss' Remote File Inclusion
PHP remote file inclusion vulnerability in fcring.php in FCRing 1.3 allows remote attackers to execute arbitrary PHP cod
23RISK
open ↗Referência✓ VexDay Proof
Versado CMS 1.07 - 'ajax_listado.php?urlModulo' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/ajax_listado.php in Versado CMS 1.07 allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
MG-SOFT Net Inspector 6.5.0.828 - Multiple Vulnerabilities
Format string vulnerability in the Net Inspector HTTP server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier fo
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.