Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,813cataloged exploits
35,788CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,549GitHub PoC 14,290VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_sponsor.php?id' SQL Injection
Multiple SQL injection vulnerabilities in JGS-XA JGS-Portal 3.0.2 and earlier allow remote attackers to execute arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
pserv 3.2 - Directory Traversal
Pico Server (pServ) 3.2 and earlier allows remote attackers to execute arbitrary commands via a URL with multiple leadin
28RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Suite And Firefox - DOM Property Overrides Code Execution
Firefox before 1.0.4 and Mozilla Suite before 1.7.8 do not properly limit privileges of Javascript eval and Script objec
23RISK
open ↗Exploit-DB✓ VexDay Proof
NPDS 4.8/5.0 - 'comments.php?thold' SQL Injection
Multiple SQL injection vulnerabilities in NPDS 4.8 and 5.0 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Skull-Splitter Guestbook 1.0/2.0/2.2 - Multiple HTML Injection Vulnerabilities
Cross-site scripting (XSS) vulnerability in Skull-Splitter Guestbook 1.0, 2.0 and 2.2 allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPHeaven PHPMyChat 0.14.5 - 'Style.CSS.php3' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in (1) start_page.css.php3 (aka start-page.css.php3) or (2) style.cs
23RISK
open ↗Exploit-DB✓ VexDay Proof
PhotoPost - Arbitrary Data Hash
SQL injection vulnerability in member.php for Photopost PHP Pro allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPHeaven PHPMyChat 0.14.5 - 'Start-Page.CSS.php3' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in (1) start_page.css.php3 (aka start-page.css.php3) or (2) style.cs
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ultimate PHP Board 1.8/1.9 - 'viewforum.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in viewforum.php in Ultimate PHP Board (UPB) 1.8 through 1.9.6 allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ultimate PHP Board 1.8/1.9 - 'viewforum.php' SQL Injection
viewforum.php in Ultimate PHP Board (UPB) 1.8 through 1.9.6 may allow remote attackers to read sensitive data via the po
23RISK
open ↗Exploit-DB✓ VexDay Proof
OpenBB 1.0.8 - 'member.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in member.php in Open Bulletin Board (OpenBB) 1.0.8 allows remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
OpenBB 1.0.8 - 'Read.php' SQL Injection
SQL injection vulnerability in read.php in Open Bulletin Board (OpenBB) 1.0.8 allows remote attackers to execute arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
Yahoo! Messenger 5.x/6.0 - URL Handler Remote Denial of Service
The YMSGR URL handler in Yahoo! Messenger 5.x through 6.0 allows remote attackers to cause a denial of service (disconne
23RISK
open ↗Exploit-DB✓ VexDay Proof
Maxwebportal 1.3x - 'post.asp' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in post.asp in MaxWebPortal 1.3.5 and earlier allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
Open Solution Quick.Cart 0.3 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php for Quick.cart 0.3.0 allows remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache 1.3.x - HTDigest Realm Command Line Argument Buffer Overflow (2)
Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. N
28RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.2.x/2.3.x/2.4.x/2.5.x/2.6.x - ELF Core Dump Local Buffer Overflow (PoC)
The elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.
23RISK
open ↗Exploit-DB✓ VexDay Proof
WowBB 1.6 - 'View_User.php' SQL Injection
Multiple SQL injection vulnerabilities in WowBB Forum 1.61 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
NukeET 3.0/3.1 - Base64 Codigo Variable Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in security.php for Tru-Zone NukeET 3.0 and 3.1 allows remote attackers to inje
23RISK
open ↗Exploit-DB✓ VexDay Proof
GeoVision Digital Surveillance System 6.0 4/6.1 - Unauthorized '.JPEG' Image Access
GeoVision Digital Video Surveillance System 6.04, 6.1 and 7.0, when set to create JPEG images, does not properly protect
23RISK
open ↗Exploit-DB✓ VexDay Proof
Easy Message Board - Remote Command Execution
easymsgb.pl in Easy Message Board allows remote attackers to execute arbitrary commands via shell metacharacters in the
23RISK
open ↗Exploit-DB✓ VexDay Proof
Positive Software H-Sphere Winbox 2.4 - Sensitive Logfile Content Disclosure
H-Sphere Winbox 2.4.2 and 2.4.3 RC1 stores sensitive information such as username and password in plaintext in world-rea
23RISK
open ↗Exploit-DB✓ VexDay Proof
Orenosv HTTP/FTP Server 0.8.1 - 'CGISSI.exe' Remote Buffer Overflow (PoC)
Multiple buffer overflows in Orenosv HTTP/FTP Server 0.8.1 allow remote authenticated users to cause a denial of service
23RISK
open ↗Exploit-DB✓ VexDay Proof
CodeThatShoppingCart 1.3.1 - 'catalog.php?id' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in catalog.php for CodeThat ShoppingCart 1.3.1 allows remote attackers to injec
23RISK
open ↗Exploit-DB✓ VexDay Proof
CodeThatShoppingCart 1.3.1 - 'catalog.php?id' SQL Injection
SQL injection vulnerability in catalog.php for CodeThat ShoppingCart 1.3.1 allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
AOL Instant Messenger 4.x/5.x - Smiley Icon Location Remote Denial of Service
AOL Instant Messenger 5.5.x and earlier allows remote attackers to cause a denial of service (client crash) via an inval
23RISK
open ↗Exploit-DB✓ VexDay Proof
Advanced Guestbook 2.3.1/2.4 - 'index.php?Entry' SQL Injection
SQL injection vulnerability in index.php in Advanced Guestbook 2.3.1 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Exploit-DB✓ VexDay Proof
phpBB 2.0.x - 'BBCode.php' URL Tag
The bbencode_second_pass and make_clickable functions in bbcode.php for phpBB before 2.0.15, as used in viewtopic.php, p
28RISK
open ↗Exploit-DB✓ VexDay Proof
Remote File Manager 1.0 - Denial of Service
NiteEnterprises Remote File Manager 1.0 allows remote attackers to cause a denial of service (crash) via a crafted strin
23RISK
open ↗Exploit-DB
Sun Solaris AnswerBook2 - Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in Solaris AnswerBook2 Documentation 1.4.4 and earlier allows remote attackers
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.