Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,902cataloged exploits
34,597CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,624GitHub PoC 13,727VulnCheck XDB 8,410Nuclei 4,231Metasploit 3,467✓ verified onlyrecentpopularrisk
21,624 exploits
Referência✓ VexDay Proof
e-Vision CMS 2.02 - SQL Injection / Remote Code Execution
CVE-2007-3251—webappsphp
Multiple directory traversal vulnerabilities in e-Vision CMS 2.02 and earlier allow remote attackers to (1) include and
23RISK
open ↗
Referência✓ VexDay Proof
TuMusika Evolution 1.7R5 - Remote File Disclosure
CVE-2007-6188—webappsphp
Multiple directory traversal vulnerabilities in TuMusika Evolution 1.7R5 allow remote attackers to include and execute a
23RISK
open ↗
Referência
CVE-2010-2034
CVE-2010-2034—
Directory traversal vulnerability in the Percha Image Attach (com_perchaimageattach) component 1.1 for Joomla! allows re
43RISK
open ↗
Referência
CVE-2020-13118
CVE-2020-13118—
An issue was discovered in Mikrotik-Router-Monitoring-System through 2018-10-22. SQL Injection exists in check_community
23RISK
open ↗
Referência
CVE-2010-2035
CVE-2010-2035—
Directory traversal vulnerability in the Percha Gallery (com_perchagallery) component 1.6 Beta for Joomla! allows remote
43RISK
open ↗
Referência
CVE-2014-8690
CVE-2014-8690—
Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, an
23RISK
open ↗
Referência
CVE-2014-8690
CVE-2014-8690—
Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, an
23RISK
open ↗
Referência
CVE-2010-2036
CVE-2010-2036—
Directory traversal vulnerability in the Percha Fields Attach (com_perchafieldsattach) component 1.x for Joomla! allows
43RISK
open ↗
Referência
CVE-2010-2037
CVE-2010-2037—
Directory traversal vulnerability in the Percha Downloads Attach (com_perchadownloadsattach) component 1.1 for Joomla! a
43RISK
open ↗
Referência✓ VexDay Proof
Quake 3 Engine 1.32b - 'R_RemapShader()' Remote Client Buffer Overflow
CVE-2006-2236—remotelinux
Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Castle Wolfenstein 1.41, and (3) Quake III
23RISK
open ↗
Referência
CVE-2016-1915
CVE-2016-1915—
Multiple cross-site scripting (XSS) vulnerabilities in BlackBerry Enterprise Server 12 (BES12) Self-Service before 12.4
23RISK
open ↗
Referência
CVE-2026-10551
CVE-2026-10551MEDIUM
Breeze Cache < 2.5.6 - Unauthenticated Stored XSS via Minify Library
33RISK
open ↗
Referência✓ VexDay Proof
phpBB User Viewed Posts Tracker 1.0 - Remote File Inclusion
CVE-2006-5223—webappsphp
PHP remote file inclusion vulnerability in includes/functions_user_viewed_posts.php in the Nivisec User Viewed Posts Tra
23RISK
open ↗
Referência✓ VexDay Proof
OpenEMR 2.8.1 - 'srcdir' Multiple Remote File Inclusions
CVE-2006-5811—webappsphp
PHP remote file inclusion vulnerability in library/translation.inc.php in OpenEMR 2.8.1, with register_globals enabled,
23RISK
open ↗
Referência✓ VexDay Proof
MiniBB 2.0.5 - 'Language' Local File Inclusion
CVE-2007-3272—webappsphp
Directory traversal vulnerability in index.php in MiniBB 2.0.5 allows remote attackers to read arbitrary files via a ..
23RISK
open ↗
Referência
CVE-2017-15957
CVE-2017-15957—
my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.
23RISK
open ↗
Referência
CVE-2017-15957
CVE-2017-15957—
my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.
23RISK
open ↗
Referência✓ VexDay Proof
ScriptsFeed (SF) Real Estate Classifieds Software - Arbitrary File Upload
CVE-2008-6942—webappsphp
Unrestricted file upload vulnerability in ScriptsFeed Realtor Classifieds System (aka Real Estate Classifieds) allows re
23RISK
open ↗
Referência✓ VexDay Proof
X-Forum 0.6.2 - Remote Command Execution
CVE-2009-1512—webappsphp
Static code injection vulnerability in X-Forum 0.6.2 allows remote authenticated administrators to inject arbitrary PHP
23RISK
open ↗
Referência
CVE-2017-8479
CVE-2017-8479—
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,
23RISK
open ↗
Referência
CVE-2017-8481
CVE-2017-8481—
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,
23RISK
open ↗
Referência
CVE-2010-2044
CVE-2010-2044—
SQL injection vulnerability in the Konsultasi (com_konsultasi) component 1.0.0 for Joomla! allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2006-1747
CVE-2006-1747—
PHP remote file inclusion vulnerability in Virtual War (VWar) 1.5.0 allows remote attackers to execute arbitrary PHP cod
23RISK
open ↗
Referência
CVE-2010-2044
CVE-2010-2044—
SQL injection vulnerability in the Konsultasi (com_konsultasi) component 1.0.0 for Joomla! allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2010-2051
CVE-2010-2051—
SQL injection vulnerability in article.php in Debliteck DBCart allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2010-2051
CVE-2010-2051—
SQL injection vulnerability in article.php in Debliteck DBCart allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2005-4696
CVE-2005-4696—
The Microsoft Wireless Zero Configuration system (WZCS) stores WEP keys and pair-wise Master Keys (PMK) of the WPA pre-s
23RISK
open ↗
Referência
CVE-2018-10310
CVE-2018-10310—
A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Conse
23RISK
open ↗
Referência
CVE-2018-10310
CVE-2018-10310—
A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Conse
23RISK
open ↗
Referência
CVE-2014-9311
CVE-2014-9311—
Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remo
23RISK
open ↗
← previouspage 265 / 721next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.