Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,724cataloged exploits
35,724CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,492GitHub PoC 14,286VulnCheck XDB 8,703Nuclei 4,314Metasploit 3,474✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
TFTPD32 2.81 - GET Format String Denial of Service (PoC)
Format string vulnerability in Tftpd32 2.81 allows remote attackers to cause a denial of service via format string speci
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebspotBlogging 3.0 - 'login.php' SQL Injection
SQL injection vulnerability in WebspotBlogging 3.0 allows remote attackers to execute arbitrary SQL commands and bypass
23RISK
open ↗Exploit-DB✓ VexDay Proof
EggBlog 2.0 - 'message' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in eggblog 2.0 allow remote attackers to inject arbitrary web script or HTML vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
SaralBlog 1.0 - Multiple Input Validation Vulnerabilities
Multiple SQL injection vulnerabilities in SaralBlog 1.0 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
EggBlog 2.0 - 'id' SQL Injection
SQL injection vulnerability in eggblog 2.0 allows remote attackers to execute arbitrary SQL commands via the id paramete
23RISK
open ↗Exploit-DB✓ VexDay Proof
MySQL 4.x - CREATE Temporary TABLE Symlink Privilege Escalation
MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, uses predictable file names when creating temporary tables, which allo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Computer Associates Unicenter 6.0 - Remote Control DM Primer Remote Denial of Service
The DM Primer (dmprimer.exe) in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup
28RISK
open ↗Exploit-DB✓ VexDay Proof
aoblogger 2.3 - URL BBcode Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in aoblogger 2.3 allows remote attackers to inject arbitrary Javascript via a j
23RISK
open ↗Exploit-DB✓ VexDay Proof
microBlog 2.0 - 'index.php' Multiple SQL Injections
SQL injection vulnerability in index.php in microBlog 2.0 RC-10 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Exploit-DB✓ VexDay Proof
PowerPortal 1.1/1.3 - 'index.php' Cross-Site Scripting
Multiple SQL injection vulnerabilities in PowerPortal, possibly 1.1 beta through 1.3, allow remote attackers to execute
23RISK
open ↗Exploit-DB✓ VexDay Proof
PowerPortal 1.1/1.3 - 'search.php' Cross-Site Scripting
Multiple SQL injection vulnerabilities in PowerPortal, possibly 1.1 beta through 1.3, allow remote attackers to execute
23RISK
open ↗Exploit-DB✓ VexDay Proof
aoblogger 2.3 - 'create.php' Entry Creation
create.php in aoblogger 2.3 allows remote attackers to bypass authentication and create new blog entries by setting the
23RISK
open ↗Exploit-DB✓ VexDay Proof
aoblogger 2.3 - 'login.php?Username' SQL Injection
SQL injection vulnerability in login.php in aoblogger 2.3 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
pcAnywhere 8.0/9.0/11.x - Authentication Denial of Service
Buffer overflow in Symantec pcAnywhere 11.0.1, 11.5.1, and all other 32-bit versions allows remote attackers to cause a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cerberus FTP Server 2.32 - Denial of Service
Grant Averett Cerberus FTP Server 2.32, and possibly earlier versions, allows remote attackers to cause an unspecified d
23RISK
open ↗Exploit-DB✓ VexDay Proof
SimpleBlog 2.1 - Multiple Input Validation Vulnerabilities
Multiple SQL injection vulnerabilities in Simple Blog 2.1 allow remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Veritas NetBackup 4/5 - Volume Manager Daemon Remote Buffer Overflow
Stack-based buffer overflow in a shared library as used by the Volume Manager daemon (vmd) in VERITAS NetBackup Enterpri
28RISK
open ↗Exploit-DB✓ VexDay Proof
White Album 2.5 - 'Pictures.php' SQL Injection
SQL injection vulnerability in WhiteAlbum 2.5 allows remote attackers to execute arbitrary SQL commands via the dir para
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache Tomcat / Geronimo 1.0 - 'Sample Script cal2.jsp?time' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary we
35RISK
open ↗Exploit-DB✓ VexDay Proof
BlogPHP 1.0 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in BlogPHP 1.0, when magic_quotes_gpc is disabled, allows remote attackers to e
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache Geronimo 1.0 - Error Page Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary we
35RISK
open ↗Exploit-DB✓ VexDay Proof
PHPXplorer 0.9.33 - 'Workspaces.php' Directory Traversal
Directory traversal vulnerability in workspaces.php in phpXplorer 0.9.33 allows remote attackers to include arbitrary fi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Bit 5 Blog 8.1 - 'index.php' SQL Injection
SQL injection vulnerability in admin/processlogin.php in Bit 5 Blog 8.01 allows remote attackers to execute arbitrary SQ
23RISK
open ↗Exploit-DB✓ VexDay Proof
GTP iCommerce - Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in index.php in GTP iCommerce allows remote attackers to inject arbitrary web s
23RISK
open ↗Exploit-DB✓ VexDay Proof
RedKernel Referrer Tracker 1.1.0-3 - 'Rkrt_stats.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in rkrt_stats.php in RedKernel Referrer Tracker 1.1.0-3 allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
EZDatabase 2.1.1 - 'index.php' Cross-Site Scripting
index.php in EZDatabase before 2.1.2 does not properly cleanse the p parameter before constructing and including a .php
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ultimate Auction 3.67 - ItemList.pl Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Ultimate Auction 3.67 allow remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Faq-O-Matic 2.711 - Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in fom.cgi in Faq-O-Matic 2.711 allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Bit 5 Blog 8.1 - 'addcomment.php' HTML Injection
Cross-site scripting (XSS) vulnerability in addcomment.php in Bit 5 Blog 8.01 allows remote attackers to inject arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
CounterPath eyeBeam 1.1 build 3010n - SIP Header Data Remote Buffer Overflow (2)
Buffer overflow in CounterPath eyeBeam SIP Softphone allows remote attackers to (1) cause a denial of service (device cr
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.