Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,620cataloged exploits
35,647CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,429GitHub PoC 14,270VulnCheck XDB 8,693Nuclei 4,299Metasploit 3,474✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
Extcalendar 2.0 - 'Extcalendar.php' Remote File Inclusion
PHP remote file inclusion vulnerability in extcalendar.php in Mohamed Moujami ExtCalendar 2.0 allows remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kaillera 0.86 - Message Buffer Overflow
Stack-based buffer overflow in Kaillera Server 0.86 and earlier allows remote attackers to execute arbitrary code via a
23RISK
open ↗Exploit-DB✓ VexDay Proof
AdPlug 2.0 - Multiple Remote File Buffer Overflow Vulnerabilities
Multiple stack-based buffer overflows in Audacious AdPlug 2.0 and earlier allow remote user-assisted attackers to execut
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Excel 2000-2004 - Style Handling and Repair Remote Code Execution
Buffer overflow in certain Asian language versions of Microsoft Excel might allow user-assisted attackers to execute arb
28RISK
open ↗Exploit-DB✓ VexDay Proof
ATutor 1.5.x - '/admin/fix_content.php?submit' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 1.5.3 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
ATutor 1.5.x - '/users/browse.php?cat' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 1.5.3 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
Hosting Controller 6.1 Hotfix 3.1 - Privilege Escalation
Unspecified vulnerability in Hosting Controller before 6.1 (aka Hotfix 3.2) allows remote authenticated attackers to gai
23RISK
open ↗Exploit-DB✓ VexDay Proof
ATutor 1.5.x - '/documentation/admin/index.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 1.5.3 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 5.0.1/6.0 - Structured Graphics Control Denial of Service
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by declaring the sourceURL at
28RISK
open ↗Exploit-DB✓ VexDay Proof
ATutor 1.5.x - 'create_course.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 1.5.3 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
ATutor 1.5.x - 'password_reminder.php?forgot' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 1.5.3 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
Invision Power Board (IP.Board) 1.x/2.x - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.x and 2.x allow remote attackers to execute arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
LifeType 1.0.5 - 'index.php?Date' SQL Injection
SQL injection vulnerability in index.php in LifeType 1.0.5 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Safari Web Browser 2.0.4 - DHTML SetAttributeNode() Null Dereference Denial of Service
Apple Safari 2.0.4/419.3 allows remote attackers to cause a denial of service (application crash) via a DHTML setAttribu
23RISK
open ↗Exploit-DB✓ VexDay Proof
Randshop 0.9.3/1.2 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Randshop 1.2 and earlier, including 0.9.3, allows remote attacke
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6 - Href Title Denial of Service
Microsoft Internet Explorer 6.0 and 6.0 SP1 allows remote attackers to cause a denial of service via an HTML page with a
28RISK
open ↗Exploit-DB✓ VexDay Proof
ImgSvr 0.6.5 - POST Denial of Service
Patrice Freydiere ImgSvr (aka ADA Image Server) allows remote attackers to cause a denial of service (daemon crash) via
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPWebGallery 1.x - 'comments.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in comments.php in PhpWebGallery 1.5.2 and earlier, and possibly 1.6.0, allows
23RISK
open ↗Exploit-DB✓ VexDay Proof
free QBoard 1.1 - 'features.php?qb_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in free QBoard 1.1 allow remote attackers to execute arbitrary PHP co
23RISK
open ↗Exploit-DB✓ VexDay Proof
Glossaire 1.7 - Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in the Glossaire module 1.7 for Xoops allows remote attackers to ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
free QBoard 1.1 - 'delete.php?qb_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in free QBoard 1.1 allow remote attackers to execute arbitrary PHP co
23RISK
open ↗Exploit-DB✓ VexDay Proof
free QBoard 1.1 - 'history.php?qb_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in free QBoard 1.1 allow remote attackers to execute arbitrary PHP co
23RISK
open ↗Exploit-DB✓ VexDay Proof
free QBoard 1.1 - 'index.php?qb_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in free QBoard 1.1 allow remote attackers to execute arbitrary PHP co
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6 - ADODB.Recordset Filter Property Denial of Service
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the Filter propert
28RISK
open ↗Exploit-DB✓ VexDay Proof
Gentoo-Specific MPG123 - URI Remote Buffer Overflow
Heap-based buffer overflow in httpdget.c in mpg123 before 0.59s-rll allows remote attackers to execute arbitrary code vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Plume CMS 1.0.4 - 'search.php?_PX_config[manager_path]' Remote File Inclusion
PHP remote file inclusion vulnerabilities in plume cms 1.0.4 allow remote attackers to execute arbitrary PHP code via a
23RISK
open ↗Exploit-DB✓ VexDay Proof
free QBoard 1.1 - 'contact.php?qb_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in free QBoard 1.1 allow remote attackers to execute arbitrary PHP co
23RISK
open ↗Exploit-DB✓ VexDay Proof
free QBoard 1.1 - 'about.php?qb_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in free QBoard 1.1 allow remote attackers to execute arbitrary PHP co
23RISK
open ↗Exploit-DB✓ VexDay Proof
VirtuaStore 2.0 - 'Password' SQL Injection
SQL injection vulnerability in VirtuaStore 2.0 allows remote attackers to execute arbitrary SQL commands via the passwor
23RISK
open ↗Exploit-DB✓ VexDay Proof
free QBoard 1.1 - 'faq.php?qb_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in free QBoard 1.1 allow remote attackers to execute arbitrary PHP co
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.