Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,559cataloged exploits
34,978CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,899GitHub PoC 13,960VulnCheck XDB 8,542Nuclei 4,243Metasploit 3,472✓ verified onlyrecentpopularrisk
21,899 exploits
Referência
CVE-2022-0020
CVE-2022-0020MEDIUM
Cortex XSOAR: Stored Cross-Site Scripting (XSS) Vulnerability in Web Interface
33RISK
open ↗
Referência
CVE-2012-5849
CVE-2012-5849—
Multiple SQL injection vulnerabilities in ClipBucket 2.6 Revision 738 and earlier allow remote attackers to execute arbi
23RISK
open ↗
Referência
CVE-2014-3136
CVE-2014-3136—
Cross-site request forgery (CSRF) vulnerability in D-Link DWR-113 (Rev. Ax) with firmware before 2.03b02 allows remote a
23RISK
open ↗
Referência✓ VexDay Proof
CyberBrau 0.9.4 - '/forum/track.php' Remote File Inclusion
CVE-2006-5400—webappsphp
PHP remote file inclusion vulnerability in forum/track.php in CyberBrau 0.9.4, when register_globals is enabled, allows
23RISK
open ↗
Referência
php-fusion 9.03.50 - Persistent Cross-Site Scripting
CVE-2020-12706—webappsphp
Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web scrip
23RISK
open ↗
Referência
CVE-2018-6940
CVE-2018-6940—
A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote
23RISK
open ↗
Referência
CVE-2018-6940
CVE-2018-6940—
A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote
23RISK
open ↗
Referência
CVE-2009-4475
CVE-2009-4475—
SQL injection vulnerability in the Joomlub (com_joomlub) component for Joomla! allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
MyCMS 0.9.8 - Remote Command Execution (1)
CVE-2007-3587—webappsphp
MyCMS 0.9.8 and earlier allows remote attackers to gain privileges via the admin cookie parameter, as demonstrated by a
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Stats 0.1.9.2 - Multiple Vulnerabilities
CVE-2007-5452—webappsphp
Multiple SQL injection vulnerabilities in php-stats.recjs.php in Php-Stats 0.1.9.2 allow remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
xeCMS 1.x - 'view.php' Remote File Disclosure
CVE-2007-6508—webappsphp
Directory traversal vulnerability in view.php in xeCMS 1.0 allows remote attackers to read arbitrary files via a ..%2F (
23RISK
open ↗
Referência✓ VexDay Proof
Bitweaver R2 CMS - Arbitrary File Upload / Disclosure
CVE-2007-6650—webappsphp
Unrestricted file upload vulnerability in fisheye/upload.php in Bitweaver R2 CMS allows remote attackers to upload arbit
23RISK
open ↗
Referência✓ VexDay Proof
Goople CMS 1.7 - Insecure Cookie Handling
CVE-2008-6118—webappsphp
win/content/upload.php in Goople CMS 1.7 allows remote attackers to bypass authentication and gain administrative access
23RISK
open ↗
Referência
CVE-2018-0745
CVE-2018-0745—
The Windows kernel in Windows 10 version 1703. Windows 10 version 1709, and Windows Server, version 1709 allows an infor
23RISK
open ↗
Referência
CVE-2018-0895
CVE-2018-0895—
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗
Referência
CVE-2017-0411
CVE-2017-0411—
An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbi
23RISK
open ↗
Referência
CVE-2023-28293
CVE-2023-28293HIGH
Windows Kernel Elevation of Privilege Vulnerability
41RISK
open ↗
Referência
CVE-2012-5905
CVE-2012-5905—
Buffer overflow in KnFTPd 1.0.0 allows remote authenticated users to cause a denial of service (crash) via a long string
23RISK
open ↗
Referência
CVE-2012-5905
CVE-2012-5905—
Buffer overflow in KnFTPd 1.0.0 allows remote authenticated users to cause a denial of service (crash) via a long string
23RISK
open ↗
Referência
CVE-2013-5099
CVE-2013-5099—
Cross-site scripting (XSS) vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote at
23RISK
open ↗
Referência
CVE-2019-1344
CVE-2019-1344—
An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memo
23RISK
open ↗
Referência✓ VexDay Proof
Falt4 CMS rc4 10.9.2007 - Multiple Vulnerabilities
CVE-2007-6311—webappsphp
SQL injection vulnerability in (1) index.php, and possibly (2) admin/index.php, in Falt4Extreme RC4 10.9.2007 allows rem
23RISK
open ↗
Referência✓ VexDay Proof
CPCommerce 1.1.0 - Cross-Site Scripting / Local File Inclusion
CVE-2008-1906—webappsphp
Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2026-15597
CVE-2026-15597MEDIUM
SourceCodester Class and Exam Timetabling System edit_exam2.php sql injection
33RISK
open ↗
Referência
CVE-2026-15559
CVE-2026-15559MEDIUM
CodeAstro Simple Online Leave Management System POST accept.php sql injection
33RISK
open ↗
Referência
CVE-2026-15558
CVE-2026-15558MEDIUM
CodeAstro Simple Online Leave Management System deletemp.php sql injection
33RISK
open ↗
Referência
CVE-2026-15476
CVE-2026-15476MEDIUM
QILING Disk Master Kernel Driver diskbckp.sys access control
33RISK
open ↗
Referência
CVE-2019-19781
CVE-2019-19781CRITICALunder attackransomware
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th
100RISK
open ↗
Referência
CVE-2010-1946
CVE-2010-1946—
Multiple PHP remote file inclusion vulnerabilities in openMairie Openregistrecil 1.02, when register_globals is enabled,
23RISK
open ↗
Referência
CVE-2026-15375
CVE-2026-15375MEDIUM
Eleveo Call Recording Software LDAP User users_ldap.jsp improper authorization
33RISK
open ↗
← previouspage 339 / 730next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.