Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,813cataloged exploits
35,788CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,549GitHub PoC 14,290VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
NPDS 4.8 < 5.0 - 'powerpack_f.php?language' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Net Portal Dynamic System (NPDS) 5.0 allow remote attackers to in
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPMailer 1.7 - 'Data()' Remote Denial of Service
The Data function in class.smtp.php in PHPMailer 1.7.2 and earlier allows remote attackers to cause a denial of service
23RISK
open ↗Exploit-DB✓ VexDay Proof
Hosting Controller 6.1 - 'resellerresources.asp?jresourceid' SQL Injection
SQL injection vulnerability in resellerresources.asp in Hosting Controller 6.1 Hotfix 2.0 allows remote attackers to exe
23RISK
open ↗Exploit-DB✓ VexDay Proof
NPDS 4.8 < 5.0 - 'links.php?Query' SQL Injection
Multiple SQL injection vulnerabilities in Net Portal Dynamic System (NPDS) 5.0 allow remote attackers to execute arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
NPDS 4.8 < 5.0 - 'faq.php?categories' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Net Portal Dynamic System (NPDS) 5.0 allow remote attackers to in
23RISK
open ↗Exploit-DB✓ VexDay Proof
Invision Power Board 1.x - Unauthorized Access
Invision Power Board (IPB) 1.0 through 1.3 allows remote attackers to edit arbitrary forum posts via a direct request to
23RISK
open ↗Exploit-DB✓ VexDay Proof
NPDS 4.8 < 5.0 - 'reply.php?image_subject' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Net Portal Dynamic System (NPDS) 5.0 allow remote attackers to in
23RISK
open ↗Exploit-DB✓ VexDay Proof
NPDS 4.8 < 5.0 - 'sdv_infos.php?sitename' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Net Portal Dynamic System (NPDS) 5.0 allow remote attackers to in
23RISK
open ↗Exploit-DB✓ VexDay Proof
OS4E - 'login.asp' SQL Injection
SQL injection vulnerability in login.asp in an unknown product by Online Solutions for Educators (OS4E) allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
NPDS 4.8 < 5.0 Glossaire Module - 'terme' SQL Injection
Multiple SQL injection vulnerabilities in Net Portal Dynamic System (NPDS) 5.0 allow remote attackers to execute arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
Jaws Glossary 0.4/0.5 - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Jaws Glossary gadget 0.4 to 0.5.1 allows remote attackers to inject arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Invision Power Board 2.0.3 - 'login.php' SQL Injection (Tutorial)
SQL injection vulnerability in Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to execute arbitrary
28RISK
open ↗Exploit-DB✓ VexDay Proof
Hosting Controller 0.6.1 - User Registration (3)
Hosting Controller 6.1 HotFix 2.0 and earlier allows remote attackers to steal passwords and gain privileges via a modif
23RISK
open ↗Exploit-DB✓ VexDay Proof
BookReview 1.0 - 'search.htm?submit string' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
Gentoo Webapp-Config 1.10 - Insecure File Creation
The fn_show_postinst function in Gentoo webapp-config before 1.10-r14 allows local users to overwrite arbitrary files vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
BookReview 1.0 - 'add_contents.htm' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
Maxwebportal 1.36 - 'Password.asp' Change Password (3)
SQL injection vulnerability in password.asp in MaxWebPortal 1.35, 1.36, 2.0, and 20050418 Next allows remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
BookReview 1.0 - 'suggest_category.htm?node' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
BookReview 1.0 - 'add_review.htm' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
BookReview 1.0 - 'add_url.htm?node' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
BookReview 1.0 - 'suggest_review.htm?node' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
BookReview 1.0 - 'contact.htm?user' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
BookReview 1.0 - 'add_booklist.htm?node' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
Maxwebportal 1.36 - 'Password.asp' Change Password (1) (HTML)
SQL injection vulnerability in password.asp in MaxWebPortal 1.35, 1.36, 2.0, and 20050418 Next allows remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.x - Cryptoloop Information Disclosure
cryptoloop on Linux kernel 2.6.x, when used on certain file systems with a block size 1024 or greater, has certain "IV c
23RISK
open ↗Exploit-DB✓ VexDay Proof
Nokia 9500 - vCard Viewer Remote Denial of Service
The vCard viewer in Nokia 9500 allows attackers to cause a denial of service (crash) via a vCard with a long Name field,
23RISK
open ↗Exploit-DB✓ VexDay Proof
BookReview 1.0 - 'add_classification.htm?isbn' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
Maxwebportal 1.36 - 'Password.asp' Change Password (2)
SQL injection vulnerability in password.asp in MaxWebPortal 1.35, 1.36, 2.0, and 20050418 Next allows remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Exim 4.41 - 'dns_build_reverse' Local Read Emails
Multiple buffer overflows in Exim before 4.43 may allow attackers to execute arbitrary code via (1) an IPv6 address with
23RISK
open ↗Exploit-DB✓ VexDay Proof
Berlios GPSD 1.91-1 < 2.7-2 - Format String
Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1.9.0 through 2.7
50RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.