Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,902cataloged exploits
34,597CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,624GitHub PoC 13,727VulnCheck XDB 8,410Nuclei 4,231Metasploit 3,467✓ verified onlyrecentpopularrisk
21,624 exploits
Referência
CVE-2010-1737
CVE-2010-1737—
PHP remote file inclusion vulnerability in core/includes/gfw_smarty.php in Gallo 0.1.0, when magic_quotes_gpc is disable
23RISK
open ↗
Referência
CVE-2010-1737
CVE-2010-1737—
PHP remote file inclusion vulnerability in core/includes/gfw_smarty.php in Gallo 0.1.0, when magic_quotes_gpc is disable
23RISK
open ↗
Referência
CVE-2010-1739
CVE-2010-1739—
SQL injection vulnerability in the Newsfeeds (com_newsfeeds) component for Joomla! allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
OTSCMS 2.1.3 - Multiple Remote File Inclusions
CVE-2006-5546—webappsphp
PHP remote file inclusion vulnerability in OTSCMS/OTSCMS.php in Open Tibia Server Content Management System (OTSCMS) 1.3
23RISK
open ↗
Referência✓ VexDay Proof
PHPPeanuts 1.3 Beta - 'Inspect.php' Remote File Inclusion
CVE-2006-5948—webappsphp
PHP remote file inclusion vulnerability in pntUnit/Inspect.php in phpPeanuts 1.1 and earlier allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
EPNadmin 0.7 - 'constantes.inc.php' Remote File Inclusion
CVE-2006-5555—webappsphp
PHP remote file inclusion vulnerability in constantes.inc.php in EPNadmin 0.7 and 0.7.1 allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
pragmaMX Module Landkarten 2.1 (Windows) - Local File Inclusion
CVE-2007-1539—webappsphp
Directory traversal vulnerability in inc/map.func.php in pragmaMX Landkarten 2.1 module allows remote attackers to inclu
23RISK
open ↗
Referência
CVE-2013-5672
CVE-2013-5672—
Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow re
23RISK
open ↗
Referência
CVE-2013-5672
CVE-2013-5672—
Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow re
23RISK
open ↗
Referência
CVE-2013-5977
CVE-2013-5977—
Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordP
23RISK
open ↗
Referência
CVE-2021-47923
CVE-2021-47923CRITICAL
OpenCart 3.0.3.8 Session Fixation via OCSESSID Cookie
48RISK
open ↗
Referência
CVE-2023-2645
CVE-2023-2645CRITICAL
USR USR-G806 Web Management Page hard-coded password
48RISK
open ↗
Referência
CVE-2018-8208
CVE-2018-8208—
An elevation of privilege vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual regis
23RISK
open ↗
Referência
CVE-2021-47910
CVE-2021-47910MEDIUM
WordPress Plugin AccessPress Social Icons 1.8.2 Stored XSS
33RISK
open ↗
Referência
CVE-2017-15276
CVE-2017-15276—
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design ga
23RISK
open ↗
Referência✓ VexDay Proof
phpAddressBook 2.11 - Multiple Local File Inclusions
CVE-2008-1492—webappsphp
Multiple directory traversal vulnerabilities in CoronaMatrix phpAddressBook 2.11 allow remote attackers to include and e
23RISK
open ↗
Referência✓ VexDay Proof
Interact 2.4.1 - 'help.php' Local File Inclusion
CVE-2008-3384—webappsphp
Multiple directory traversal vulnerabilities in help/help.php in Interact Learning Community Environment Interact 2.4.1
23RISK
open ↗
Referência
CVE-2026-6113
CVE-2026-6113CRITICAL
Totolink A7100RU CGI cstecgi.cgi setTtyServiceCfg os command injection
48RISK
open ↗
Referência✓ VexDay Proof
Natterchat 1.1 - Remote Authentication Bypass
CVE-2008-7047—webappsphp
NatterChat 1.1 allows remote attackers to bypass authentication and gain administrator privileges to read or delete room
23RISK
open ↗
Referência
CVE-2026-6112
CVE-2026-6112CRITICAL
Totolink A7100RU CGI cstecgi.cgi setRadvdCfg os command injection
48RISK
open ↗
Referência
CVE-2019-14328
CVE-2019-14328—
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.
23RISK
open ↗
Referência
CVE-2010-0757
CVE-2010-0757—
Unrestricted file upload vulnerability in index.php/Attach in WikyBlog 1.7.3rc2 allows remote authenticated users to exe
23RISK
open ↗
Referência
CVE-2010-0757
CVE-2010-0757—
Unrestricted file upload vulnerability in index.php/Attach in WikyBlog 1.7.3rc2 allows remote authenticated users to exe
23RISK
open ↗
Referência
CVE-2015-7259
CVE-2015-7259—
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid
23RISK
open ↗
Referência
CVE-2014-1665
CVE-2014-1665—
Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary
23RISK
open ↗
Referência
CVE-2014-1665
CVE-2014-1665—
Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary
23RISK
open ↗
Referência
CVE-2010-3899
CVE-2010-3899—
IBM OmniFind Enterprise Edition 8.x and 9.x performs web crawls with an unlimited recursion depth, which allows remote w
23RISK
open ↗
Referência
CVE-2020-25270
CVE-2020-25270—
PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name, Guardian Relation, Guardian Contact no, Address, o
23RISK
open ↗
Referência
CVE-2010-1739
CVE-2010-1739—
SQL injection vulnerability in the Newsfeeds (com_newsfeeds) component for Joomla! allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component com_flyspray < 1.0.1 - Remote File Disclosure
CVE-2006-6203—webappsphp
Directory traversal vulnerability in startdown.php in the Flyspray ME 1.0.1 (com_flyspray) component for Mambo allows re
23RISK
open ↗
← previouspage 263 / 721next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.