Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,724cataloged exploits
35,724CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,492GitHub PoC 14,286VulnCheck XDB 8,703Nuclei 4,314Metasploit 3,474✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
DCP-Portal 3.7/4.x/5.x/6.x - 'mycontents.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 6.1.1 and earlier, with register_globals enabled, allo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Easy File Sharing Web Server 3.2 - Full Path Request Arbitrary File Upload
Absolute path traversal vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote registered users to execut
23RISK
open ↗Exploit-DB✓ VexDay Proof
sBlog 0.7.2 - 'comments_do.php' Multiple POST Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in sBlog 0.7.2 allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
JiRos Banner Experience 1.0 - Unauthorized Create Admin
JiRo's Banner System Experience and Professional 1.0 and earlier allows remote attackers to bypass access restrictions a
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyBloggie 2.1.2/2.1.3 - 'delcomment.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyBloggie 2.1.2/2.1.3 - 'addcat.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
d2kBlog 1.0.3 - 'memName' SQL Injection
SQL injection vulnerability in D2KBlog 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Easy File Sharing Web Server 3.2 - Format String Denial of Service
Format string vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote attackers to cause a denial of servi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Light Weight Calendar 1.x - 'date' Remote Code Execution
Eval injection vulnerability in Light Weight Calendar (LWC) 1.0 (20040909) and earlier allows remote attackers to execut
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyBloggie 2.1.2/2.1.3 - 'delcat.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyBloggie 2.1.2/2.1.3 - 'trackback_url' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyBloggie 2.1.2/2.1.3 - 'edituser.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
DCP-Portal 3.7/4.x/5.x/6.x - 'inbox.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 6.1.1 and earlier, with register_globals enabled, allo
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyBloggie 2.1.2/2.1.3 - 'upload.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
sBlog 0.7.2 - 'search.php?keyword' POST Method Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in sBlog 0.7.2 allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyBloggie 2.1.2/2.1.3 - 'deluser.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
DCP-Portal 3.7/4.x/5.x/6.x - 'forums.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 6.1.1 and earlier, with register_globals enabled, allo
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyBloggie 2.1.2/2.1.3 - 'del.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyBloggie 2.1.2/2.1.3 - 'editcat.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
ADP Forum 2.0.x - 'Subject' HTML Injection
Cross-site scripting (XSS) vulnerability in Vz Scripts ADP Forum 2.0.3 and earlier allows remote attackers to inject arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
DCP-Portal 3.7/4.x/5.x/6.x - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 6.1.1 and earlier, with register_globals enabled, allo
23RISK
open ↗Exploit-DB✓ VexDay Proof
DCP-Portal 3.7/4.x/5.x/6.x - 'lostpassword.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 6.1.1 and earlier, with register_globals enabled, allo
23RISK
open ↗Exploit-DB✓ VexDay Proof
UnrealIRCd 3.x - Remote Denial of Service
UnrealIRCd 3.2.3 allows remote attackers to cause an unspecified denial of service by causing a linked server to send ma
23RISK
open ↗Exploit-DB✓ VexDay Proof
DCP-Portal 3.7/4.x/5.x/6.x - 'calendar.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 6.1.1 and earlier, with register_globals enabled, allo
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyBloggie 2.1.2/2.1.3 - 'adduser.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
RedBLoG 0.5 - 'cat_id' SQL Injection
SQL injection vulnerability in rss.php in RedBLoG 0.5 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
PeerCast 0.1216 - Remote Stack Overflow (Metasploit)
Multiple stack-based buffer overflows in the procConnectArgs function in servmgr.cpp in PeerCast before 0.1217 allow rem
60RISK
open ↗Exploit-DB✓ VexDay Proof
TextFileBB 1.0 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in textfileBB 1.0 and earlier allow remote attackers to inject arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
LoudBlog 0.41 - 'index.php?template' Traversal Arbitrary File Access
Multiple directory traversal vulnerabilities in Loudblog before 0.42 allow remote attackers to read or include arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alien Arena 2006 Gold Edition 5.00 - Multiple Vulnerabilities
Format string vulnerability in the safe_cprintf function in acebot_cmds.c in Alien Arena 2006 Gold Edition 5.00 allows r
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.