Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,620cataloged exploits
35,647CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,429GitHub PoC 14,270VulnCheck XDB 8,693Nuclei 4,299Metasploit 3,474✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
Enigma Haber 4.2 - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in hava.asp in Enigma Haber 4.2 allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ovidentia 5.6.x/5.8 - 'options.php?babInstallPath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrar
28RISK
open ↗Exploit-DB✓ VexDay Proof
Ovidentia 5.6.x/5.8 - 'approb.php?babInstallPath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrar
28RISK
open ↗Exploit-DB✓ VexDay Proof
phpBB 2.0.x - 'template.php' Remote File Inclusion
PHP remote file inclusion vulnerability in template.php in phpBB 2 allows remote attackers to execute arbitrary PHP code
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ovidentia 5.6.x/5.8 - 'search.php?babInstallPath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrar
28RISK
open ↗Exploit-DB✓ VexDay Proof
Ovidentia 5.6.x/5.8 - 'vacadm.php?babInstallPath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrar
28RISK
open ↗Exploit-DB✓ VexDay Proof
PHP ManualMaker 1.0 - Multiple Input Validation Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in PHP ManualMaker 1.0 allows remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ovidentia 5.6.x/5.8 - 'posts.php?babInstallPath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrar
28RISK
open ↗Exploit-DB✓ VexDay Proof
iShopCart - 'vGetPost()' Remote Buffer Overflow (CGI)
Multiple buffer overflows in the (1) vGetPost and (2) main functions in easy-scart.c through easy-scart6.c in iShopCart
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ovidentia 5.6.x/5.8 - 'vacadmb.php?babInstallPath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrar
28RISK
open ↗Exploit-DB✓ VexDay Proof
DELTAScripts PHP Pro Publish 2.0 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in DeltaScripts Pro Publish allow remote attackers to inject arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 1.5.0.4 - 'marquee' Denial of Service
Unspecified versions of Mozilla Firefox allow remote attackers to cause a denial of service (crash) via a web page that
23RISK
open ↗Exploit-DB✓ VexDay Proof
Squirrelmail 1.4.x - 'Redirect.php' Local File Inclusion
PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals i
50RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Nuke 7.9 Final - 'phpbb_root_path' Remote File Inclusions
Global variable overwrite vulnerability in PHP-Nuke allows remote attackers to conduct remote PHP file inclusion attacks
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ovidentia 5.6.x/5.8 - 'vacadma.php?babInstallPath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrar
28RISK
open ↗Exploit-DB✓ VexDay Proof
Ovidentia 5.6.x/5.8 - 'statart.php?babInstallPath' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrar
28RISK
open ↗Exploit-DB✓ VexDay Proof
SiteBuilder-FX - 'top.php' Remote File Inclusion
PHP remote file inclusion vulnerability in top.php in SiteBuilder-FX 3.5 allows remote attackers to execute arbitrary PH
23RISK
open ↗Exploit-DB✓ VexDay Proof
Abarcar Realty Portal 5.1.5 - 'content.php' SQL Injection
SQL injection vulnerability in content.php in abarcar Realty Portal 5.1.5 allows remote attackers to execute arbitrary S
23RISK
open ↗Exploit-DB✓ VexDay Proof
Tekno.Portal - 'Bolum.php' SQL Injection
SQL injection vulnerability in bolum.php in tekno.Portal allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Exploit-DB✓ VexDay Proof
pppBlog 0.3.8 - System Disclosure
Directory traversal vulnerability in randompic.php in pppBLOG 0.3.8 and earlier, when register_globals is enabled, allow
23RISK
open ↗Exploit-DB✓ VexDay Proof
Snort 2.4.x - URIContent Rules Detection Evasion
The HTTP Inspect preprocessor (http_inspect) in Snort 2.4.0 through 2.4.4 allows remote attackers to bypass "uricontent"
28RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.x - Proc dentry_unused Corruption Local Denial of Service
Race condition in Linux kernel 2.6.15 to 2.6.17, when running on SMP platforms, allows local users to cause a denial of
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPMyDesktop/Arcade 1.0 - 'index.php' Local File Inclusion
Directory traversal vulnerability in index.php in PhpMyDesktop|arcade 1.0 FINAL allows remote attackers to read arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows XP/2000/2003 - MHTML URI Buffer Overflow (PoC)
Buffer overflow in INETCOMM.DLL, as used in Microsoft Internet Explorer 6.0 through 6.0 SP2, Windows Explorer, Outlook E
35RISK
open ↗Exploit-DB✓ VexDay Proof
vBulletin 3.0.10 - 'Portal.php' SQL Injection
SQL injection vulnerability in VBulletin 3.0.10 allows remote attackers to execute arbitrary SQL commands via the featur
23RISK
open ↗Exploit-DB✓ VexDay Proof
EVA-Web 2.1.2 - 'rubrique.php3?date' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in EVA-Web 2.1.2 and earlier allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
D-Link Airspot DSA-3100 Gateway - 'Login_error.SHTML' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in login_error.shtml for D-Link DSA-3100 allows remote attackers to inject arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
EVA-Web 2.1.2 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in EVA-Web 2.1.2 and earlier allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
EVA-Web 2.1.2 - 'article-album.php3?debut_image' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in EVA-Web 2.1.2 and earlier allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Photoalbum B&W 1.3 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in superalbum/index.php in Photoalbum B&W 1.3 allows remote attackers to inject
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.