Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,724cataloged exploits
35,724CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,492GitHub PoC 14,286VulnCheck XDB 8,703Nuclei 4,314Metasploit 3,474✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
RedCMS 0.1 - 'register.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in register.php in RedCMS 0.1 allow remote attackers to inject arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Blank'N'Berg 0.2 - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Blank'N'Berg 0.2 allows remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
SoftBiz Image Gallery - 'mage_desc.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in Softbiz Image Gallery allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
DbbS 2.0 - 'Topics.php' SQL Injection
SQL injection vulnerability in topics.php in Dynamic Bulletin Board System (DbbS) 2.0-alpha and earlier allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
Zdaemon 1.8.1 - Multiple Vulnerabilities
The (1) ZD_MissingPlayer, (2) ZD_UseItem, and (3) ZD_LoadNewClientLevel functions in sv_main.cpp for (a) Zdaemon 1.08.01
23RISK
open ↗Exploit-DB✓ VexDay Proof
SoftBiz Image Gallery - 'suggest_image.php?cid' SQL Injection
Multiple SQL injection vulnerabilities in Softbiz Image Gallery allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
SoftBiz Image Gallery - 'template.php?provided' SQL Injection
Multiple SQL injection vulnerabilities in Softbiz Image Gallery allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
SoftBiz Image Gallery - 'images.php?cid' SQL Injection
Multiple SQL injection vulnerabilities in Softbiz Image Gallery allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
O2PHP Oxygen 1.0/1.1 - 'post.php' SQL Injection
SQL injection vulnerability in post.php in Oxygen 1.1.3 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Exploit-DB✓ VexDay Proof
VNews 1.2 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in vscripts (aka Kuba Kunkiewicz) VNews 1.2 allow remote attackers to execute arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
X-Changer 0.20 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in X-Changer 0.2 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
MediaSlash Gallery - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in MediaSlash Gallery allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
PhxContacts 0.93 - 'login.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in login.php in Phoetux.net PhxContacts 0.93.1 beta and earlier allows remote a
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 4.x/5.x - 'Html_Entity_Decode()' Information Disclosure
PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script
28RISK
open ↗Exploit-DB✓ VexDay Proof
PhxContacts 0.93 - 'carnet.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in Phoetux.net PhxContacts 0.93.1 beta and earlier allow remote attackers to exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
PhxContacts 0.93 - 'contact_view.php?id_contact' SQL Injection
Multiple SQL injection vulnerabilities in Phoetux.net PhxContacts 0.93.1 beta and earlier allow remote attackers to exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
phpMyFamily 1.4.1 - 'Track.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in track.php in phpmyfamily 1.4.1 allows remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
FusionZONE CouponZONE 4.2 - Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in local.cfm in fusionZONE couponZONE 4.2 allows remote attackers to inject arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
CONTROLzx Hms 3.3.4 - 'dedicated_order.php?dedicatedPlanID' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in CONTROLzx HMS (formerly DRZES) 3.3.4 and earlier allow remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
ClassifiedZONE 1.2 - 'Accountlogon.cfm' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in accountlogon.cfm in classifiedZONE 1.2 and earlier allows remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPCOIN 1.2 - 'mod.php?fs' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in phpCOIN 1.2.2 and earlier allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
OneOrZero 1.6.3 Helpdesk - 'index.php' SQL Injection
SQL injection vulnerability in index.php in OneOrZero 1.6.3.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPCOIN 1.2 - 'mod_print.php?fs' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in phpCOIN 1.2.2 and earlier allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
CONTROLzx Hms 3.3.4 - 'server_management.php?plan_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in CONTROLzx HMS (formerly DRZES) 3.3.4 and earlier allow remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
Connect Daily 3.2.8/3.2.9 - 'ViewSearch.html' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in MH Software Connect Daily Web Calendar Software 3.2.9 and earlier
23RISK
open ↗Exploit-DB✓ VexDay Proof
Arab Portal 2.0 - 'download.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Arab Portal 2.0 (aka Arab Dynamic Portal or ADP) stable allow rem
23RISK
open ↗Exploit-DB✓ VexDay Proof
Connect Daily 3.2.8/3.2.9 - 'ViewWeek.html?week' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in MH Software Connect Daily Web Calendar Software 3.2.9 and earlier
23RISK
open ↗Exploit-DB✓ VexDay Proof
Connect Daily 3.2.8/3.2.9 - 'ViewDay.html' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in MH Software Connect Daily Web Calendar Software 3.2.9 and earlier
23RISK
open ↗Exploit-DB✓ VexDay Proof
CONTROLzx Hms 3.3.4 - 'shared_order.php?sharedPlanID' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in CONTROLzx HMS (formerly DRZES) 3.3.4 and earlier allow remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
Arab Portal 2.0 - 'online.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Arab Portal 2.0 (aka Arab Dynamic Portal or ADP) stable allow rem
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.