Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,647cataloged exploits

34,986CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,899GitHub PoC 14,014VulnCheck XDB 8,571Nuclei 4,248Metasploit 3,472✓ verified onlyrecent popular risk

21,899 exploits

Referência

CVE-2007-3703

CVE-2007-3703—

Stack-based buffer overflow in a certain ActiveX control in sasatl.dll 1.5.0.531 in Zenturi Program Checker (ProgramChec

23RISK

open ↗

Referência

CVE-2013-1803

CVE-2013-1803—

Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência

CVE-2018-0743

CVE-2018-0743—

Windows Subsystem for Linux in Windows 10 version 1703, Windows 10 version 1709, and Windows Server, version 1709 allows

23RISK

open ↗

Referência

CVE-2012-6522

CVE-2012-6522—

Directory traversal vulnerability in the getContent function in codes/wcms.php in w-CMS 2.01 allows remote attackers to

23RISK

open ↗

Referência

CVE-2012-6522

CVE-2012-6522—

Directory traversal vulnerability in the getContent function in codes/wcms.php in w-CMS 2.01 allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

zKup CMS 2.0 < 2.3 - Arbitrary File Upload

CVE-2008-7123—webappsphp

Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

WebCalendar 0.9.45 - 'includedir' Remote File Inclusion

CVE-2007-1483—webappsphp

Multiple PHP remote file inclusion vulnerabilities in WebCalendar 0.9.45 allow remote attackers to execute arbitrary PHP

23RISK

open ↗

Referência✓ VexDay Proof

MailEnable 3.13 SMTP Service - 'VRFY/EXPN' Denial of Service

CVE-2008-1275—doswindows

Multiple unspecified vulnerabilities in the SMTP service in MailEnable Standard Edition 1.x, Professional Edition 3.x an

23RISK

open ↗

Referência✓ VexDay Proof

PostNuke Module pnEncyclopedia 0.2.0 - SQL Injection

CVE-2008-2191—webappsphp

SQL injection vulnerability in the pnEncyclopedia module 0.2.0 and earlier for PostNuke allows remote attackers to execu

23RISK

open ↗

Referência

CVE-2015-2223

CVE-2015-2223—

Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks

23RISK

open ↗

Referência

CVE-2018-16061

CVE-2018-16061—

Mitsubishi Electric Europe B.V. SmartRTU devices allow XSS via the username parameter or PATH_INFO to login.php.

23RISK

open ↗

Referência✓ VexDay Proof

Jinzora 2.1 - 'media.php' Remote File Inclusion

CVE-2006-7130—webappsphp

PHP remote file inclusion vulnerability in backend/primitives/cache/media.php in Jinzora 2.1 and earlier allows remote a

23RISK

open ↗

Referência

CVE-2026-3301

CVE-2026-3301CRITICAL

Totolink N300RH Web Management cstecgi.cgi setWebWlanIdx os command injection

48RISK

open ↗

Referência

CVE-2017-15284

CVE-2017-15284—

Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG fil

23RISK

open ↗

Referência

CVE-2017-15284

CVE-2017-15284—

Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG fil

23RISK

open ↗

Referência

CVE-2019-11419

CVE-2019-11419—

vcodec2_hls_filter in libvoipCodec_v7a.so in the WeChat application through 7.0.3 for Android allows attackers to cause

23RISK

open ↗

Referência

CVE-2009-4834

CVE-2009-4834—

lib.php in Zeroboard 4.1 pl7 allows remote attackers to execute arbitrary PHP code via a crafted parameter name, possibl

23RISK

open ↗

Referência✓ VexDay Proof

PHP-Nuke Module PostGuestbook 0.6.1 - 'tpl_pgb_moddir' Remote File Inclusion

CVE-2007-1372—webappsphp

PHP remote file inclusion vulnerability in styles/internal/header.php in the PostGuestbook 0.6.1 module for PHP-Nuke all

23RISK

open ↗

Referência

CVE-2019-17220

CVE-2019-17220—

Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.

23RISK

open ↗

Referência✓ VexDay Proof

mxBB Module FAQ & RULES 2.0.0 - Remote File Inclusion

CVE-2007-2493—webappsphp

PHP remote file inclusion vulnerability in faq.php in the FAQ & RULES 2.0.0 and earlier module for mxBB allows remote at

23RISK

open ↗

Referência✓ VexDay Proof

DeluxeBB 1.2 - Multiple Vulnerabilities

CVE-2008-2194—webappsphp

SQL injection vulnerability in forums.php in DeluxeBB 1.2 and earlier allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

phpDatingClub 3.7 - 'website.php' Local File Inclusion

CVE-2008-3179—webappsphp

Directory traversal vulnerability in website.php in Web 2 Business (W2B) phpDatingClub (aka Dating Club) 3.7 allows remo

23RISK

open ↗

Referência✓ VexDay Proof

cPanel 11.x - Cross-Site Scripting / Local File Inclusion

CVE-2008-6926—webappsphp

Directory traversal vulnerability in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel al

23RISK

open ↗

Referência

WeChat for Android 7.0.4 - 'vcodec2_hls_filter' Denial of Service

CVE-2019-11419—dosandroid

vcodec2_hls_filter in libvoipCodec_v7a.so in the WeChat application through 7.0.3 for Android allows attackers to cause

23RISK

open ↗

Referência

CVE-2018-11339

CVE-2018-11339—

An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.

23RISK

open ↗

Referência

CVE-2017-6550

CVE-2017-6550—

Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitra

23RISK

open ↗

Referência

CVE-2017-6550

CVE-2017-6550—

Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitra

23RISK

open ↗

Referência

CVE-2017-9126

CVE-2017-9126—

The quicktime_read_dref_table function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a denial of serv

23RISK

open ↗

Referência

CVE-2010-4875

CVE-2010-4875—

Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery P

23RISK

open ↗

Referência

CVE-2017-9412

CVE-2017-9412—

The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of ser

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.