Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,724cataloged exploits
35,724CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,492GitHub PoC 14,286VulnCheck XDB 8,703Nuclei 4,314Metasploit 3,474✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
Oi! Email Marketing System 3.0 - 'index.php' SQL Injection
Oi! Email Marketing System 3.0 (aka Oi! 3) stores the server's FTP password in cleartext on a Configuration web page, wh
23RISK
open ↗Exploit-DB✓ VexDay Proof
NOCC 1.0 - 'html_bottom_table.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in NOCC Webmail 1.0 allow remote attackers to inject arbitrary web s
23RISK
open ↗Exploit-DB✓ VexDay Proof
CubeCart 3.0.x - Arbitrary File Upload
CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.i
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dragonfly CMS 9.0.6.1 Downloads Module - 'c' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Dragonfly CMS before 9.0.6.1 allow remote attackers to inject arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dragonfly CMS 9.0.6.1 Stories_Archive Module - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Dragonfly CMS before 9.0.6.1 allow remote attackers to inject arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
Noah's Classifieds 1.0/1.3 - Local File Inclusion
Directory traversal vulnerability in include.php in Noah's Classifieds 1.3 allows remote attackers to include arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Noah's Classifieds 1.0/1.3 - Search Page SQL Injection
SQL injection vulnerability in the search tool in Noah's Classifieds 1.3 allows remote attackers to execute arbitrary SQ
23RISK
open ↗Exploit-DB✓ VexDay Proof
Noah's Classifieds 1.0/1.3 - 'index.php' Remote File Inclusion
Multiple PHP remote file include vulnerabilities in gorum/gorumlib.php in Noah's Classifieds 1.3, when register_globals
23RISK
open ↗Exploit-DB✓ VexDay Proof
RunCMS 1.x - 'Ratefile.php' Cross-Site Scripting
Cross-site scripting vulnerability in ratefile.php in RunCMS 1.3a5 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dragonfly CMS 9.0.6 1 News Module - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Dragonfly CMS before 9.0.6.1 allow remote attackers to inject arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ipswitch WhatsUp Professional 2006 - Remote Denial of Service
NmService.exe in Ipswitch WhatsUp Professional 2006 allows remote attackers to cause a denial of service (CPU consumptio
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Media Player - Plugin Overflow (MS06-006) (3)
Buffer overflow in the plug-in for Microsoft Windows Media Player (WMP) 9 and 10, when used in browsers other than Inter
35RISK
open ↗Exploit-DB✓ VexDay Proof
Dragonfly CMS 9.0.6 1 Your_Account Module - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Dragonfly CMS before 9.0.6.1 allow remote attackers to inject arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
myPHPNuke 1.8.8 - 'download.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in MyPHPNuke (MPN) 1.88 and earlier allow remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dragonfly CMS 9.0.6.1 Coppermine Module - 'album' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Dragonfly CMS before 9.0.6.1 allow remote attackers to inject arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dragonfly CMS 9.0.6.1 Web_Links Module - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Dragonfly CMS before 9.0.6.1 allow remote attackers to inject arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dragonfly CMS 9.0.6.1 Surveys Module - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Dragonfly CMS before 9.0.6.1 allow remote attackers to inject arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
myPHPNuke 1.8.8 - 'reviews.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in MyPHPNuke (MPN) 1.88 and earlier allow remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla (Multiple Products) - iFrame JavaScript Execution
The WYSIWYG rendering engine ("rich mail" editor) in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attacker
23RISK
open ↗Exploit-DB✓ VexDay Proof
Noah's Classifieds 1.0/1.3 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Noah's Classifieds 1.3 allow remote attackers to inj
23RISK
open ↗Exploit-DB✓ VexDay Proof
PostNuke 0.6x/0.7x NS-Languages Module - 'language' Cross-Site Scripting
Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting (XSS) atta
23RISK
open ↗Exploit-DB✓ VexDay Proof
PostNuke 0.6x/0.7x NS-Languages Module - 'language' SQL Injection
SQL injection vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is off, all
23RISK
open ↗Exploit-DB✓ VexDay Proof
CuteNews 1.4.1 - 'show_news.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in show_news.php in CuteNews 1.4.1 allows remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
PunBB 2.0.10 - Register Multiple Users Denial of Service
register.php in PunBB 1.2.10 allows remote attackers to cause an unspecified denial of service via a flood of new user r
23RISK
open ↗Exploit-DB✓ VexDay Proof
TTS Software Time Tracking Software 3.0 - 'edituser.php' Access Validation
edituser.php in TTS Time Tracking Software 3.0 does not verify that the name and password are correct, which allows remo
23RISK
open ↗Exploit-DB✓ VexDay Proof
PunBB 2.0.10 - Register Multiple Users Denial of Service
PunBB 1.2.10 and earlier allows remote attackers to cause a denial of service (resource consumption) by registering many
23RISK
open ↗Exploit-DB✓ VexDay Proof
Magic Calendar Lite 1.02 - 'index.php' SQL Injection
Multiple SQL injection vulnerabilities in cms/index.php in Magic Calendar Lite 1.02, with magic_quotes_gpc disabled, all
23RISK
open ↗Exploit-DB✓ VexDay Proof
MiniNuke 1.8.2b - 'pages.asp' SQL Injection
SQL injection vulnerability in pages.asp in Mini-Nuke CMS System 1.8.2 and earlier allows remote attackers to execute ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Nuke 7.x - CAPTCHA Bypass
The CAPTCHA functionality in php-Nuke 6.0 through 7.9 uses fixed challenge/response pairs that only vary once per day ba
23RISK
open ↗Exploit-DB✓ VexDay Proof
Webpagecity WPC easy - SQL Injection
Multiple SQL injection vulnerabilities in admin.asp in WPC.easy allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.