Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,957cataloged exploits
32,195CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,003GitHub PoC 13,307VulnCheck XDB 8,182Nuclei 4,217Metasploit 3,462✓ verified onlyrecentpopularrisk
20,003 exploits
Referência
CVE-2018-7203
CVE-2018-7203—
Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2018-7203
CVE-2018-7203—
Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2012-5908
CVE-2012-5908—
Cross-site scripting (XSS) vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remo
23RISK
open ↗
Referência
CVE-2012-2914
CVE-2012-2914—
Cross-site scripting (XSS) vulnerability in captchademo.php in Unijimpe Captcha allows remote attackers to inject arbitr
23RISK
open ↗
Referência
CVE-2012-2941
CVE-2012-2941—
Cross-site scripting (XSS) vulnerability in search/ in Yandex.Server 2010 9.0 Enterprise allows remote attackers to inje
23RISK
open ↗
Referência
CVE-2023-37269
CVE-2023-37269LOW
Winter CMS vulnerable to stored XSS through privileged upload of SVG file
28RISK
open ↗
Referência
CVE-2017-16807
CVE-2017-16807—
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exist
23RISK
open ↗
Referência
CVE-2017-16807
CVE-2017-16807—
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exist
23RISK
open ↗
Referência
TaskTracker 1.5 - 'Customize.asp' Remote Add Administrator
CVE-2007-0049—
Geckovich TaskTracker Pro 1.5 and earlier allows remote attackers to add administrative or other accounts via an Add act
23RISK
open ↗
Referência
CVE-2009-2642
CVE-2009-2642—
index.php in Desi Short URL Script 1.0 allows remote attackers to bypass authentication by setting the logged cookie to
23RISK
open ↗
Referência
CVE-2012-5912
CVE-2012-5912—
Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2012-5912
CVE-2012-5912—
Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
GGCMS 1.1.0 RC1 - Remote Code Execution
CVE-2007-0804—
Directory traversal vulnerability in admin/subpages.php in GGCMS 1.1.0 RC1 and earlier allows remote attackers to inject
23RISK
open ↗
Referência
CVE-2026-5316
CVE-2026-5316MEDIUM
Nothings stb stb_vorbis.c setup_free allocation of resources
33RISK
open ↗
Referência
MPM Chat 2.5 - 'view.php?logi' Local File Inclusion
CVE-2007-1613—
Directory traversal vulnerability in view.php in MPM Chat 2.5 allows remote attackers to include and execute arbitrary l
23RISK
open ↗
Referência
CVE-2019-10847
CVE-2019-10847—
Computrols CBAS 18.0.0 allows Cross-Site Request Forgery.
23RISK
open ↗
Referência
CVE-2009-2558
CVE-2009-2558—
system/message.php in Admin News Tools 2.5 does not properly restrict access, which allows remote attackers to post news
23RISK
open ↗
Referência
CVE-2009-4106
CVE-2009-4106—
Unrestricted file upload vulnerability in admintools/editpage-2.php in Agoko CMS 0.4 and earlier allows remote attackers
23RISK
open ↗
Referência
iyzi Forum 1.0b3 - Database Disclosure
CVE-2008-5901—
iyzi Forum 1.0 beta 3 stores sensitive information under the web root with insufficient access control, which allows rem
23RISK
open ↗
Referência
CVE-2009-4674
CVE-2009-4674—
admin/admin.php in Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script allows remote attackers to cha
23RISK
open ↗
Referência
Rayzz Script 2.0 - Local/Remote File Inclusion
CVE-2007-6229—
PHP remote file inclusion vulnerability in common/classes/class_HeaderHandler.lib.php in Rayzz Script 2.0 allows remote
23RISK
open ↗
Referência
NoAh 0.9 pre 1.2 - 'mfa_theme.php' Remote File Inclusion
CVE-2007-2572—
PHP remote file inclusion vulnerability in modules/noevents/templates/mfa_theme.php in NoAh (aka PHP Content Architect,
23RISK
open ↗
Referência
Garennes 0.6.1 - 'repertoire_config' Remote File Inclusion
CVE-2007-2298—
Multiple PHP remote file inclusion vulnerabilities in Garennes 0.6.1 and earlier allow remote attackers to execute arbit
23RISK
open ↗
Referência
GoSamba 1.0.1 - 'INCLUDE_PATH' Multiple Remote File Inclusions
CVE-2007-5786—
Multiple PHP remote file inclusion vulnerabilities in GoSamba 1.0.1 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗
Referência
CVE-2010-3437
CVE-2010-3437—
Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2
23RISK
open ↗
Referência
CVE-2010-4980
CVE-2010-4980—
SQL injection vulnerability in packagedetails.php in iScripts ReserveLogic 1.0 allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2010-4980
CVE-2010-4980—
SQL injection vulnerability in packagedetails.php in iScripts ReserveLogic 1.0 allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2023-0913
CVE-2023-0913MEDIUM
SourceCodester Auto Dealer Management System sql injection
33RISK
open ↗
Referência
X7 Chat 2.0.5 - 'day' SQL Injection
CVE-2008-0278—
SQL injection vulnerability in index.php in X7 Chat 2.0.5 and possibly earlier allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2015-4137
CVE-2015-4137—
SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
← previouspage 134 / 667next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.