Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,765cataloged exploits
35,760CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,523GitHub PoC 14,289VulnCheck XDB 8,703Nuclei 4,319Metasploit 3,476✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
Eudora Qualcomm WorldMail 3.0 - 'IMAPd' Remote Overflow
Buffer overflow in cram.dll in QUALCOMM Eudora WorldMail 3.0 allows remote attackers to execute arbitrary code via an IM
23RISK
open ↗Exploit-DB✓ VexDay Proof
AbleDesign D-Man 3.0 - 'Title' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php AbleDesign D-Man 3.x allows remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
Info-ZIP UnZip 5.x - File Name Buffer Overflow
Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename c
23RISK
open ↗Exploit-DB✓ VexDay Proof
ContentServ 3.0/3.1/4.0 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in ContentServ 3.1 and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
Miraserver 1.0 RC4 - 'index.php?page' SQL Injection
Multiple SQL injection vulnerabilities in Miraserver 1.0 RC4 and earlier allow remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
Libertas Enterprise CMS 3.0 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in search/index.php in Libertas Enterprise CMS 3.0 and earlier allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
Bitweaver 1.1.1 - 'message_box.php?sort_mode' Cross-Site Scripting
Multiple SQL injection vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to execute arbitrary SQL c
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft IIS - HTTP Request Denial of Service (2)
The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attacke
45RISK
open ↗Exploit-DB✓ VexDay Proof
Baseline CMS 1.95 - Multiple Input Validation Vulnerabilities
SQL injection vulnerability in Page.asp in Baseline CMS 1.95 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗Exploit-DB✓ VexDay Proof
allinta CMS 2.3.2 - 'search.asp?searchQuery' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Allinta 2.3.2 and earlier allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Lighthouse CMS 1.1 - Search Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Fidra Lighthouse CMS 1.1.0 and earlier allows remote attackers to inject arb
28RISK
open ↗Exploit-DB✓ VexDay Proof
Miraserver 1.0 RC4 - 'article.php?cat' SQL Injection
Multiple SQL injection vulnerabilities in Miraserver 1.0 RC4 and earlier allow remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
Bitweaver 1.1.1 - 'view.php?blog_id' Cross-Site Scripting
Multiple SQL injection vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to execute arbitrary SQL c
23RISK
open ↗Exploit-DB✓ VexDay Proof
Magnolia Search Module 2.1 - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in search.html in Magnolia Content Management Suite 2.1 allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
FLIP 0.9.0.1029 - 'forum.php?frame' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in FLIP 0.9.0.1029 allow remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
Bitweaver 1.1.1 Beta - 'list_galleries.php?sort_mode' Cross-Site Scripting
Multiple SQL injection vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to execute arbitrary SQL c
23RISK
open ↗Exploit-DB✓ VexDay Proof
Caravel CMS 3.0 Beta 1 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Caravel CMS 3.0 Beta 1 and earlier allow remote attackers to inje
23RISK
open ↗Exploit-DB✓ VexDay Proof
allinta CMS 2.3.2 - 'faq.asp?s' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Allinta 2.3.2 and earlier allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cofax 2.0 - search.htm Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in search.htm in Cofax 2.0 RC3 and earlier allows remote attackers to inject ar
38RISK
open ↗Exploit-DB✓ VexDay Proof
MailEnable Enterprise Edition 1.1 - 'EXAMINE' Remote Buffer Overflow
Buffer overflow in MailEnable Professional 1.71 and earlier, and Enterprise 1.1 and earlier, allows remote authenticated
23RISK
open ↗Exploit-DB✓ VexDay Proof
Liferay Portal Enterprise 3.6.1 - Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in downloads/portal_ent in Liferay Portal Enterprise 3.6.1 and earlier allows r
23RISK
open ↗Exploit-DB✓ VexDay Proof
Marwel 2.7 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in Marwel 2.7 and earlier allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Exploit-DB✓ VexDay Proof
Acidcat CMS 2.1.13 - 'acidcat.mdb' Remote Information Disclosure
Acidcat 2.1.13 and earlier stores the database under the web root with insufficient access control, which allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Miraserver 1.0 RC4 - 'newsitem.php?id' SQL Injection
Multiple SQL injection vulnerabilities in Miraserver 1.0 RC4 and earlier allow remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
Bitweaver 1.1.1 - 'my.php?sort_mode' Cross-Site Scripting
Multiple SQL injection vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to execute arbitrary SQL c
23RISK
open ↗Exploit-DB✓ VexDay Proof
FLIP 0.9.0.1029 - 'text.php?name' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in FLIP 0.9.0.1029 allow remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Fusion 6.0 - 'members.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion 6.00.200 through 6.00.300 allow remote attackers to in
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft IIS - HTTP Request Denial of Service (1)
The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attacke
45RISK
open ↗Exploit-DB✓ VexDay Proof
Direct News 4.9 - 'index.php' SQL Injection
Multiple SQL injection vulnerabilities in Direct News 4.9 allow remote attackers to execute arbitrary SQL commands via (
23RISK
open ↗Exploit-DB✓ VexDay Proof
Bitweaver 1.1.1 - 'view_post.php?post_id' Cross-Site Scripting
Multiple SQL injection vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to execute arbitrary SQL c
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.