Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,620cataloged exploits
35,647CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,429GitHub PoC 14,270VulnCheck XDB 8,693Nuclei 4,299Metasploit 3,474✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
MySQL 4.1.18/5.0.20 - Local/Remote Information Leakage
The check_connection function in sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 al
35RISK
open ↗Exploit-DB✓ VexDay Proof
GeoBlog MOD_1.0 - 'viewcat.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in viewcat.php in geoBlog 1.0 allows remote attackers to inject arbitrary web s
23RISK
open ↗Exploit-DB✓ VexDay Proof
Albinator 2.0.8 - 'dlisting.php?cid' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Albinator 2.0.8 and earlier allow remote attackers to inject arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Albinator 2.0.8 - 'showpic.php?preloadSlideShow' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Albinator 2.0.8 and earlier allow remote attackers to inject arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
JSBoard 2.0.10/2.0.11 - 'login.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the parse_query_str function in include/print.php in JSBoard 2.0.10 and 2.0.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Pinnacle Cart 3.3 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Pinnacle Cart 3.33 and earlier allows remote attackers to injec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Collaborative Portal Server 3.4 - 'POS' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in popup_image in Collaborative Portal Server (CPS) 3.4.0 and earlier allows re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Invision Power Board 2.1.5 - 'from_contact' SQL Injection
SQL injection vulnerability in func_msg.php in Invision Power Board (IPB) 2.1.4 allows remote attackers to execute arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
DMCounter 0.9.2 -b - 'Kopf.php' Remote File Inclusion
PHP remote file inclusion vulnerability in kopf.php in DMCounter 0.9.2-b allows remote attackers to execute arbitrary PH
23RISK
open ↗Exploit-DB✓ VexDay Proof
OrbitHYIP 2.0 - 'members.php?id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in OrbitHYIP 2.0 and earlier allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
OrbitHYIP 2.0 - 'signup.php?referral' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in OrbitHYIP 2.0 and earlier allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Hogstorps Guestbook 2.0 - Unauthorized Access
admin/radera/tabort.asp in Hogstorps hogstorp guestbook 2.0 does not verify user credentials, which allows remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Xine 0.99.x - Filename Handling Remote Format String
Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.4 might allow attackers to cause a denial of s
23RISK
open ↗Exploit-DB✓ VexDay Proof
MaxTrade 1.0.1 - Multiple SQL Injections
SQL injection vulnerability in pocategories.php in MaxTrade 1.0.1 and earlier allows remote attackers to execute arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
SunShop Shopping Cart 3.5 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in SunShop 3.5 and earlier allow remote attackers to inject arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX 10.x - ImageIO OpenEXR Image File Remote Denial of Service
Multiple Apple Mac OS X 10.4 applications might allow context-dependent attackers to cause a denial of service (applicat
23RISK
open ↗Exploit-DB✓ VexDay Proof
PlanetGallery - 'Gallery_admin.php' Authentication Bypass
planetGallery allows remote attackers to gain administrator privileges via a direct request to admin/gallery_admin.php.
23RISK
open ↗Exploit-DB✓ VexDay Proof
4Images 1.7.1 - 'member.php?sessionid' SQL Injection
Multiple SQL injection vulnerabilities in 4images 1.7.1 and earlier allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗Exploit-DB✓ VexDay Proof
4Images 1.7.1 - 'top.php?sessionid' SQL Injection
Multiple SQL injection vulnerabilities in 4images 1.7.1 and earlier allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗Exploit-DB✓ VexDay Proof
W-Agora 4.2 - BBCode Script Injection
Cross-site scripting (XSS) vulnerability in w-Agora (aka Web-Agora) 4.2.0 allows remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
Blog 0.2.3/0.2.4 Mod - 'Weblog_posting.php' SQL Injection
SQL injection vulnerability in weblog_posting.php in Blog Mod 0.2.x allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Exploit-DB✓ VexDay Proof
TextFileBB 1.0.16 - Multiple Tag Script Injection Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in TextFileBB 1.0.16 allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
LibTiff 3.x - TIFFFetchData Integer Overflow
Integer overflow in the TIFFFetchData function in tif_dirread.c for libtiff before 3.8.1 allows context-dependent attack
28RISK
open ↗Exploit-DB✓ VexDay Proof
Artmedic Event - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in event/index.php in Artmedic Event allows remote attackers to execute arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
DUclassified - 'detail.asp' SQL Injection
SQL injection vulnerability in detail.asp in DUclassified allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.x - CIFS CHRoot Security Restriction Bypass
Directory traversal vulnerability in CIFS in Linux 2.6.16 and earlier allows local users to escape chroot restrictions f
23RISK
open ↗Exploit-DB✓ VexDay Proof
I-RATER Platinum - 'Config_settings.TPL.php' Remote File Inclusion
PHP remote file include vulnerability in admin/config_settings.tpl.php in I-RATER Platinum allows remote attackers to ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
poweriso 2.9 - Directory Traversal
Directory traversal vulnerability in PowerISO 2.9 allows remote attackers to write arbitrary files via a .. (dot dot) in
23RISK
open ↗Exploit-DB✓ VexDay Proof
CoolMenus 4.0 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in CoolMenus allows remote attackers to execute arbitrary code via
23RISK
open ↗Exploit-DB✓ VexDay Proof
winiso 5.3 - Directory Traversal
Directory traversal vulnerability in WinISO 5.3 allows remote attackers to write arbitrary files via a .. (dot dot) in a
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.