Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,647cataloged exploits
34,986CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,899GitHub PoC 14,014VulnCheck XDB 8,571Nuclei 4,248Metasploit 3,472✓ verified onlyrecentpopularrisk
21,899 exploits
Referência✓ VexDay Proof
ReVou Twitter Clone - Arbitrary File Upload
CVE-2008-6751—webappsphp
Unrestricted file upload vulnerability in index.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging allows
23RISK
open ↗
Referência
CVE-2014-2995
CVE-2014-2995—
Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allo
23RISK
open ↗
Referência
CVE-2009-3716
CVE-2009-3716—
Unrestricted file upload vulnerability in admin.php in MCshoutbox 1.1 allows remote authenticated users to execute arbit
23RISK
open ↗
Referência
CVE-2017-8840
CVE-2017-8840—
Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before f
23RISK
open ↗
Referência
CVE-2012-0699
CVE-2012-0699—
Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow re
23RISK
open ↗
Referência
CVE-2020-9038
CVE-2020-9038—
Joplin through 1.0.184 allows Arbitrary File Read via XSS.
23RISK
open ↗
Referência
CVE-2023-37759
CVE-2023-37759—
Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticat
23RISK
open ↗
Referência
CVE-2021-33570
CVE-2021-33570—
Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can
23RISK
open ↗
Referência
CVE-2021-33570
CVE-2021-33570—
Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can
23RISK
open ↗
Referência
CVE-2010-1340
CVE-2010-1340—
Directory traversal vulnerability in jresearch.php in the J!Research (com_jresearch) component for Joomla! allows remote
43RISK
open ↗
Referência✓ VexDay Proof
PhpHostBot 1.06 - 'svr_rootscript' Remote File Inclusion
CVE-2007-4231—webappsphp
PHP remote file inclusion vulnerability in order/login.php in IDevSpot PhpHostBot 1.06 and earlier allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
e107 module 123 flash chat 6.8.0 - Remote File Inclusion
CVE-2008-1989—webappsphp
PHP remote file inclusion vulnerability in 123flashchat.php in the 123 Flash Chat 6.8.0 module for e107, when register_g
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Jotloader 1.2.1.a - Blind SQL Injection
CVE-2008-2564—webappsphp
SQL injection vulnerability in the JotLoader (com_jotloader) component 1.2.1.a and earlier for Joomla! allows remote att
23RISK
open ↗
Referência
CVE-2008-2565
CVE-2008-2565—
Multiple SQL injection vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2022-30076
CVE-2022-30076MEDIUM
ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames
33RISK
open ↗
Referência✓ VexDay Proof
TemaTres 1.0.3 - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2009-1583—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in TemaTres 1.0.3 and 1.031 allow remote attackers to inject arbitra
23RISK
open ↗
Referência
CVE-2013-4948
CVE-2013-4948—
SQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2013-4948
CVE-2013-4948—
SQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2018-25114
CVE-2018-25114CRITICAL
osCommerce 2.3.4.1 Installer Unauthenticated Configuration File Injection PHP Code Execution
63RISK
open ↗
Referência
CVE-2018-25114
CVE-2018-25114CRITICAL
osCommerce 2.3.4.1 Installer Unauthenticated Configuration File Injection PHP Code Execution
63RISK
open ↗
Referência
CVE-2012-3838
CVE-2012-3838—
Gekko before 1.2.0 allows remote attackers to obtain the installation path via a direct request to (1) admin/templates/b
23RISK
open ↗
Referência
CVE-2008-3371
CVE-2008-3371—
Directory traversal vulnerability in install/help.php in TalkBack 2.3.5, and other versions before 2.3.6.2, allows remot
23RISK
open ↗
Referência
CVE-2008-3371
CVE-2008-3371—
Directory traversal vulnerability in install/help.php in TalkBack 2.3.5, and other versions before 2.3.6.2, allows remot
23RISK
open ↗
Referência
CVE-2010-1345
CVE-2010-1345—
Directory traversal vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote a
43RISK
open ↗
Referência
CVE-2020-22841
CVE-2020-22841—
Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code execution
23RISK
open ↗
Referência
CVE-2010-1345
CVE-2010-1345—
Directory traversal vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote a
43RISK
open ↗
Referência✓ VexDay Proof
TFT Gallery 0.10 - Password Disclosure
CVE-2006-1412—webappsphp
TFT Gallery 0.10 stores sensitive information under the web root with insufficient access control, which allows remote a
23RISK
open ↗
Referência✓ VexDay Proof
SezHoo 0.1 - Remote File Inclusion
CVE-2008-4704—webappsphp
PHP remote file inclusion vulnerability in SezHooTabsAndActions.php in SezHoo 0.1 allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
PHPMyDesk 1.0 Beta - 'viewticket.php' Local File Inclusion
CVE-2006-7132—webappsphp
Directory traversal vulnerability in pmd-config.php in PHPMyDesk 1.0beta allows remote attackers to include arbitrary lo
23RISK
open ↗
Referência
b2evolution 6.11.6 - 'plugin name' Stored XSS
CVE-2020-22841—webappsphp
Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code execution
23RISK
open ↗
← previouspage 357 / 730next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.