Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,724cataloged exploits
35,724CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,492GitHub PoC 14,286VulnCheck XDB 8,703Nuclei 4,314Metasploit 3,474✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
LoudBlog 0.41 - 'backend_settings.php' Traversal Arbitrary File Access
Multiple directory traversal vulnerabilities in Loudblog before 0.42 allow remote attackers to read or include arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
LoudBlog 0.41 - 'index.php?template' Traversal Arbitrary File Access
Multiple directory traversal vulnerabilities in Loudblog before 0.42 allow remote attackers to read or include arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Limbo CMS 1.0.4.2 - 'itemID' Remote Code Execution (Metasploit)
The frontpage option in Limbo CMS 1.0.4.2 and 1.0.4.1 allows remote attackers to execute arbitrary PHP commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
RevilloC MailServer 1.21 - 'USER' Remote Buffer Overflow
Buffer overflow in RevilloC MailServer and Proxy 1.21 allows remote attackers to execute arbitrary code via a long USER
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alien Arena 2006 Gold Edition 5.00 - Multiple Vulnerabilities
The Com_sprintf function in q_shared.c in Alien Arena 2006 Gold Edition 5.00 does not properly NULL terminate certain lo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Link Bank - 'Iframe.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in iframe.php in daverave Link Bank allows remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
LoudBlog 0.41 - 'podcast.php' SQL Injection
SQL injection vulnerability in podcast.php in Loudblog before 0.42 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Exploit-DB✓ VexDay Proof
RunCMS 1.x - 'Bigshow.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in bigshow.php in Runcms 1.x allows remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
DVGuestbook 1.0/1.2.2 - 'dv_gbook.php?f' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in dv_gbook.php in DVguestbook 1.0 allows remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHORUM 3.x/5.x - 'Common.php' Remote File Inclusion
PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sauerbraten 2006_02_28 - Multiple Buffer Overflow / Crash
engine/server.cpp in Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cube 2005_08_29 - Multiple Buffer Overflow / Crash
The (1) sgetstr and (2) getint functions in Sauerbraten 2006_02_28, as derived from the Cube engine, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Bitweaver 1.1/1.2 - 'Title' HTML Injection
Cross-site scripting (XSS) vulnerability in read.php in bitweaver CMS 1.2.1 allows remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
HitHost 1.0 - 'deleteuser.php?user' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in HitHost 1.0.0 allows remote attackers to inject arbitrary web script or HTML
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeciv 2.0.7 - Jumbo Malloc Crash (Denial of Service)
packets.c in Freeciv 2.0 before 2.0.8 allows remote attackers to cause a denial of service (server crash) via crafted pa
23RISK
open ↗Exploit-DB✓ VexDay Proof
DVGuestbook 1.0/1.2.2 - 'index.php?page' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in DVguestbook 1.2.2 allows remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
Invision Power Board 2.1.5 - showtopic SQL Injection
SQL injection vulnerability in index.php, possibly during a showtopic operation, in Invision Power Board (IPB) 2.1.5 all
23RISK
open ↗Exploit-DB✓ VexDay Proof
Game-Panel 2.6 - 'login.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in login.php in Game-Panel 2.6.1 and earlier allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sauerbraten 2006_02_28 - Multiple Buffer Overflow / Crash
Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (client ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
Monopd 0.9.3 - Remote Denial of Service
server.cpp in Monopd 0.9.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a strin
23RISK
open ↗Exploit-DB✓ VexDay Proof
MPCS 0.2 - 'comment.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in comment.php in MPCS 0.2 allows remote attackers to inject arbitrary web scri
23RISK
open ↗Exploit-DB✓ VexDay Proof
HitHost 1.0 - 'viewuser.php?hits' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in HitHost 1.0.0 allows remote attackers to inject arbitrary web script or HTML
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sauerbraten 2006_02_28 - Multiple Buffer Overflow / Crash
The (1) sgetstr and (2) getint functions in Sauerbraten 2006_02_28, as derived from the Cube engine, allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sauerbraten 2006_02_28 - Multiple Buffer Overflow / Crash
Buffer overflow in the sgetstr function in shared/cube.h in Sauerbraten 2006_02_28 and earlier, as derived from the Cube
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Visual Studio 6.0 sp6 - '.dbp' Local Buffer Overflow
Stack-based buffer overflow in Microsoft Visual Studio 6.0 and Microsoft Visual InterDev 6.0 allows user-assisted attack
28RISK
open ↗Exploit-DB✓ VexDay Proof
LibTiff 3.7.1 - BitsPerSample Tag Local Buffer Overflow
Stack-based buffer overflow in libTIFF before 3.7.2 allows remote attackers to execute arbitrary code via a TIFF file wi
28RISK
open ↗Exploit-DB✓ VexDay Proof
TotalECommerce 1.0 - 'index.asp?id' SQL Injection
SQL injection vulnerability in index.asp in Total Ecommerce 1.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Exploit-DB✓ VexDay Proof
VBZooM Forum 1.11 - 'comment.php?UserID' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in vbzoom 1.11 allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
CutePHP CuteNews 1.4.1 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTM
23RISK
open ↗Exploit-DB✓ VexDay Proof
Easy Forum 2.5 - New User Image File HTML Injection
Cross-site scripting vulnerability in Easy Forum 2.5 allows remote attackers to inject arbitrary web script or HTML via
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.