Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,772cataloged exploits
35,760CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,523GitHub PoC 14,289VulnCheck XDB 8,710Nuclei 4,319Metasploit 3,476✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
OvBB 0.x - 'profile.php?userid' SQL Injection
Multiple SQL injection vulnerabilities in OvBB 0.08a allow remote attackers to execute arbitrary SQL commands via the (1
23RISK
open ↗Exploit-DB✓ VexDay Proof
Comdev Vote Caster 3.1 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in Comdev Vote Caster 3.1 and earlier allows remote attackers to execute arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
OvBB 0.x - 'thread.php?threadid' SQL Injection
Multiple SQL injection vulnerabilities in OvBB 0.08a allow remote attackers to execute arbitrary SQL commands via the (1
23RISK
open ↗Exploit-DB✓ VexDay Proof
freeFTPd 1.0.10 - 'PORT' Denial of Service
freeFTPd 1.0.10 allows remote authenticated users to cause a denial of service (null dereference and crash) via a PORT c
23RISK
open ↗Exploit-DB✓ VexDay Proof
SoftBiz Web Hosting Directory Script 1.1 - 'review.php?sbres_id' SQL Injection
Multiple SQL injection vulnerabilities in Softbiz Web Host Directory Script 1.1 and earlier allow remote attackers to ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
vTiger CRM 4.2 - SQL Injection
Multiple SQL injection vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to inject arbitrary SQL comm
23RISK
open ↗Exploit-DB✓ VexDay Proof
vTiger CRM 4.2 Leads Module - 'record' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to inject arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Orca Forum 4.3 - 'forum.php' SQL Injection
SQL injection vulnerability in forum.php in Orca Forum 4.3b and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
vTiger CRM 4.2 RSS Aggregation Module - Feed Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to inject arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
SoftBiz Web Hosting Directory Script 1.1 - 'search_result.php?cid' SQL Injection
Multiple SQL injection vulnerabilities in Softbiz Web Host Directory Script 1.1 and earlier allow remote attackers to ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
SoftBiz Web Hosting Directory Script 1.1 - 'email.php?h_id' SQL Injection
Multiple SQL injection vulnerabilities in Softbiz Web Host Directory Script 1.1 and earlier allow remote attackers to ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
SoftBiz Web Hosting Directory Script 1.1 - 'browsecats.php?cid' SQL Injection
Multiple SQL injection vulnerabilities in Softbiz Web Host Directory Script 1.1 and earlier allow remote attackers to ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
WSN Forum 1.21 - 'memberlist.php' SQL Injection
SQL injection vulnerability in memberlist.php in WSN Forum 1.21 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Exploit-DB✓ VexDay Proof
blogBuddies 0.3 - 'magpie_debug.php?url' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in MagpieRSS 7.1, as used in (a) blogBuddiesv 0.3, (b) Jaws 0.6.2, a
23RISK
open ↗Exploit-DB✓ VexDay Proof
blogBuddies 0.3 - 'magpie_slashbox.php?rss_url' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in MagpieRSS 7.1, as used in (a) blogBuddiesv 0.3, (b) Jaws 0.6.2, a
23RISK
open ↗Exploit-DB✓ VexDay Proof
AFFCommerce Shopping Cart 1.1.4 - 'ItemInfo.php?item_id' SQL Injection
Multiple SQL injection vulnerabilities in AFFcommerce 1.1.4 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
1-2-3 Music Store 1.0 - 'Process.php' SQL Injection
SQL injection vulnerability in process.php in 1-2-3 music store allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Exploit-DB✓ VexDay Proof
Tunez 1.21 - 'songinfo.php?song_id' SQL Injection
SQL injection vulnerability in songinfo.php in Tunez 1.21 and earlier allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Exploit-DB✓ VexDay Proof
blogBuddies 0.3 - 'index.php?u' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in blogBuddies 0.3 allows remote attackers to inject arbitrary web script or HT
23RISK
open ↗Exploit-DB✓ VexDay Proof
Tunez 1.21 - 'search.php?searchFor' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in search.php in Tunez 1.21 and earlier allows remote attackers to inject arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
AFFCommerce Shopping Cart 1.1.4 - 'subcategory.php?cl' SQL Injection
Multiple SQL injection vulnerabilities in AFFcommerce 1.1.4 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
MailEnable 1.1/1.7 - IMAP Rename Request Remote Denial of Service
IMAP service (meimaps.exe) of MailEnable Professional 1.7 and Enterprise 1.1 allows remote authenticated attackers to ca
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cisco PIX - Spoofed TCP SYN Packets Remote Denial of Service
Cisco PIX 6.3 and 7.0 allows remote attackers to cause a denial of service (blocked new connections) via spoofed TCP pac
28RISK
open ↗Exploit-DB✓ VexDay Proof
FreeForum 1.0/1.1 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in forum.php in freeForum 1.1 and earlier and earlier allow remote attackers to e
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ezyhelpdesk 1.0 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Ezyhelpdesk 1.0 allow remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Exploit-DB✓ VexDay Proof
AFFCommerce Shopping Cart 1.1.4 - 'ItemReview.php?item_id' SQL Injection
Multiple SQL injection vulnerabilities in AFFcommerce 1.1.4 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
OTRS 2.0 - Login Function 'User' SQL Injection
Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 th
23RISK
open ↗Exploit-DB✓ VexDay Proof
Virtual Hosting Control System 2.2/2.4 - Error Message Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in gui/errordocs/index.php in Virtual Hosting Control System (VHCS) 2.2.0 throu
23RISK
open ↗Exploit-DB✓ VexDay Proof
OTRS 2.0 - 'index.pl' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mambo 4.5.2 - Globals Overwrite / Remote Command Execution
globals.php in Mambo Site Server 4.0.14 and earlier, when register_globals is disabled, allows remote attackers to overw
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.