Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,900cataloged exploits
35,840CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,600GitHub PoC 14,323VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
24,458 exploits
Exploit-DB✓ VexDay Proof
PHP-Nuke Error Manager Module 2.1 - 'error.php?language' Full Path Disclosure
error.php in Error Manager 2.1 for PHP-Nuke 6.0 allows remote attackers to obtain sensitive information via an invalid (
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Nuke Error Manager Module 2.1 - 'error.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in error.php in Gijza.net Error Manager 2.1 for PHP-Nuke 6.0 allow r
23RISK
open ↗Exploit-DB✓ VexDay Proof
Symantec Client Firewall Products 5 - 'SYMNDIS.SYS' Driver Remote Denial of Service
SYMNDIS.SYS in Symantec Norton Internet Security 2003 and 2004, Norton Personal Firewall 2003 and 2004, Client Firewall
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Lotus Domino 6/7 - HTTP webadmin.nsf Directory Traversal
Directory traversal vulnerability in webadmin.nsf in Lotus Domino R6 6.5.1 allows local users to create folders or deter
23RISK
open ↗Exploit-DB✓ VexDay Proof
AIX 4.3.3/5.x - Getlvcb Command Line Argument Buffer Overflow (2)
Multiple buffer overflows in LVM for AIX 5.1 and 5.2 allow local users to gain privileges via the (1) putlvcb or (2) get
23RISK
open ↗Exploit-DB✓ VexDay Proof
Belchior Foundry VCard 2.8 - Authentication Bypass
Vcard 2.9 and possibly other versions does not require authorization to run uninstall.php, which could allow remote atta
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlobalScape Secure FTP Server 2.0 Build 03.11.2004.2 - Site Command Remote Buffer Overflow
Buffer overflow in GlobalSCAPE Secure FTP Server 2.0 B03.11.2004.2 allows remote attackers to cause a denial of service
23RISK
open ↗Exploit-DB✓ VexDay Proof
WFTPD Server GUI 3.21 - Remote Denial of Service
The Control Panel applet in WFTPD and WFTPD Pro 3.21 R1 and R2 allows remote authenticated users to cause a denial of se
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Lotus Domino 6.5.1 - HTTP webadmin.nsf Quick Console Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in webadmin.nsf in Lotus Domino R6 6.5.1 allows remote attackers to inject arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
vBulletin 3.0 - 'showthread.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Jelsoft vBulletin 2.0 beta 3 through 3.0 can4 allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mambo Open Source 4.5 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
vBulletin 3.0 - 'forumdisplay.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Jelsoft vBulletin 2.0 beta 3 through 3.0 can4 allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Nuke 6.x/7.0/7.1 - Image Tag Admin Command Execution
Cross-site request forgery (CSRF) vulnerability in Php-Nuke 6.x through 7.1.0 allows remote attackers to gain administra
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mambo Open Source 4.5 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows remote attackers to ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
Phorum 3.x - 'register.php' HTTP_REFERER Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.1 through 5.0.3 beta allow remote attackers to inject ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Nuke 7.1 Recommend_Us Module - 'fname' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in modules.php in Php-Nuke 7.1.0 allows remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
WarpSpeed 4nAlbum Module 0.92 - 'displaycategory.php?basepath' Remote File Inclusion
PHP remote file inclusion vulnerability in displaycategory.php in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remot
23RISK
open ↗Exploit-DB✓ VexDay Proof
Phorum 3.x - 'profile.php?target' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.1 through 5.0.3 beta allow remote attackers to inject ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
VocalTec VGW4/8 Telephony Gateway - Remote Authentication Bypass
VocalTec VGW4/8 Gateway 8.0 allows remote attackers to bypass authentication via an HTTP request to home.asp with a trai
23RISK
open ↗Exploit-DB✓ VexDay Proof
Phorum 3.x - 'login.php' HTTP_REFERER Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.1 through 5.0.3 beta allow remote attackers to inject ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
WarpSpeed 4nAlbum Module 0.92 - 'modules.php?gid' SQL Injection
SQL injection vulnerability in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to gain privileges or p
23RISK
open ↗Exploit-DB✓ VexDay Proof
WarpSpeed 4nAlbum Module 0.92 - 'nmimage.php?z' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in nmimage.php in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
YABB SE 1.5.1 - Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in YaBB 1 Gold(SP1.3) and YaBB SE 1.5.1 Final allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
cPanel 5/6/7/8/9 - 'dir' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in cPanel 9.1.0 and possibly earlier allows remote attackers to inject arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Emumail EMU Webmail 5.2.7 - 'emumail.fcgi' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in EMU Webmail 5.2.7 allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
IP3 Networks IP3 NetAccess Appliance - SQL Injection
SQL injection vulnerability in IP3 Networks NetAccess Appliance before firmware 3.1.18b13 allows remote attackers to byp
23RISK
open ↗Exploit-DB✓ VexDay Proof
Emumail EMU Webmail 5.2.7 - nit.emu Information Disclosure
EMU Webmail 5.2.7 allows remote attackers to obtain sensitive path information (home directory) via an HTTP request for
23RISK
open ↗Exploit-DB✓ VexDay Proof
cPanel 5/6/7/8/9 - Login Script Remote Command Execution
The login page for cPanel 9.1.0, and possibly other versions, allows remote attackers to execute arbitrary code via shel
28RISK
open ↗Exploit-DB✓ VexDay Proof
cPanel 5/6/7/8/9 - Resetpass Remote Command Execution
The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x,
35RISK
open ↗Exploit-DB✓ VexDay Proof
Pegasi Web Server 0.2.2 - Error Page Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to inject arbitrary we
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.