Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,020cataloged exploits
35,276CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,446Referência 22,166GitHub PoC 14,080VulnCheck XDB 8,604Nuclei 4,251Metasploit 3,473✓ verified onlyrecentpopularrisk
21,899 exploits
Referência
CVE-2013-6872
CVE-2013-6872—
SQL injection vulnerability in managetimetracker.php in Collabtive before 1.2 allows remote authenticated users to execu
23RISK
open ↗
Referência
CVE-2010-5055
CVE-2010-5055—
SQL injection vulnerability in index.php in Almnzm 2.1 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2010-5055
CVE-2010-5055—
SQL injection vulnerability in index.php in Almnzm 2.1 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência✓ VexDay Proof
BlueShoes Framework 4.6 - Remote File Inclusion
CVE-2006-2864—webappsphp
Multiple PHP remote file inclusion vulnerabilities in BlueShoes Framework 4.6 allow remote attackers to execute arbitrar
28RISK
open ↗
Referência✓ VexDay Proof
WebChamado 1.1 - 'tsk_id' SQL Injection
CVE-2008-2906—webappsphp
SQL injection vulnerability in lista_anexos.php in WebChamado 1.1 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
Dayfox Blog 4 - Multiple Local File Inclusions
CVE-2008-3564—webappsphp
Multiple directory traversal vulnerabilities in index.php in Dayfox Blog 4 allow remote attackers to include and execute
23RISK
open ↗
Referência✓ VexDay Proof
OTManager CMS 24a - Local File Inclusion / Cross-Site Scripting
CVE-2008-5201—webappsphp
Directory traversal vulnerability in index.php in OTManager CMS 24a allows remote attackers to include and execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
team 1.x - File Disclosure / Cross-Site Scripting
CVE-2009-0760—webappsasp
Team Board 1.x and 2.x stores sensitive information under the web root with insufficient access control, which allows re
23RISK
open ↗
Referência✓ VexDay Proof
Flyspeck CMS 6.8 - Local/Remote File Inclusion / Change Add Admin
CVE-2009-1771—webappsphp
index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which
23RISK
open ↗
Referência
CVE-2010-3603
CVE-2010-3603—
Cross-site request forgery (CSRF) vulnerability in the file manager service (Services/FileService.ashx) in mojoPortal 2.
23RISK
open ↗
Referência
CVE-2010-3603
CVE-2010-3603—
Cross-site request forgery (CSRF) vulnerability in the file manager service (Services/FileService.ashx) in mojoPortal 2.
23RISK
open ↗
Referência
CVE-2026-13500
CVE-2026-13500MEDIUM
antlr ANTLR4 Grammar Action Block OutputFile.java code injection
33RISK
open ↗
Referência
CVE-2018-14497
CVE-2018-14497—
Tenda D152 ADSL routers allow XSS via a crafted SSID.
23RISK
open ↗
Referência
CVE-2018-0901
CVE-2018-0901—
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗
Referência✓ VexDay Proof
microssys CMS 1.5 - Remote File Inclusion
CVE-2008-2396—webappsphp
PHP remote file inclusion vulnerability in index.php in Wajox Software microSSys CMS 1.5 and earlier, when register_glob
23RISK
open ↗
Referência✓ VexDay Proof
L2J Statistik Script 0.09 - 'index.php' Local File Inclusion
CVE-2007-0173—webappsphp
Directory traversal vulnerability in index.php in L2J Statistik Script 0.09 and earlier, when register_globals is enable
23RISK
open ↗
Referência
CVE-2010-1725
CVE-2010-1725—
SQL injection vulnerability in offers_buy.php in Alibaba Clone Platinum allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2010-1725
CVE-2010-1725—
SQL injection vulnerability in offers_buy.php in Alibaba Clone Platinum allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2010-1726
CVE-2010-1726—
SQL injection vulnerability in offers_buy.php in EC21 Clone 3.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência
CVE-2009-4825
CVE-2009-4825—
8pixel.net Blog 4 stores sensitive information under the web root with insufficient access control, which allows remote
23RISK
open ↗
Referência
CVE-2009-4820
CVE-2009-4820—
Angelo-Emlak 1.0 stores sensitive information under the web root with insufficient access control, which allows remote a
23RISK
open ↗
Referência✓ VexDay Proof
Bradabra 2.0.5 - '/include/includes.php' Remote File Inclusion
CVE-2007-0500—webappsphp
PHP remote file inclusion vulnerability in include/includes.php in Bradabra 2.0.5 and earlier allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
deeemm CMS (dmcms) 0.7.4 - Multiple Vulnerabilities
CVE-2008-3721—webappsphp
PHP remote file inclusion vulnerability in user_language.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2009-4056
CVE-2009-4056—
Directory traversal vulnerability in admin/popup.php in Betsy CMS 3.5 allows remote attackers to include and execute arb
23RISK
open ↗
Referência✓ VexDay Proof
wotw 5.0 - Local/Remote File Inclusion
CVE-2008-6223—webappsphp
PHP remote file inclusion vulnerability in visualizza.php in Way Of The Warrior (WOTW) 5.0 and earlier allows remote att
23RISK
open ↗
Referência
CVE-2009-4471
CVE-2009-4471—
Multiple PHP remote file inclusion vulnerabilities in FreeSchool 1.1.0 and earlier allow remote attackers to execute arb
23RISK
open ↗
Referência
CVE-2010-1726
CVE-2010-1726—
SQL injection vulnerability in offers_buy.php in EC21 Clone 3.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência
CVE-2010-1727
CVE-2010-1727—
SQL injection vulnerability in type.asp in JobPost 1.0 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2010-1727
CVE-2010-1727—
SQL injection vulnerability in type.asp in JobPost 1.0 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência✓ VexDay Proof
Destar 0.2.2-5 - Arbitrary Add New User
CVE-2008-6538—webappsphp
DeStar 0.2.2-5 allows remote attackers to add arbitrary users via a direct request to config/add/CfgOptUser.
23RISK
open ↗
← previouspage 375 / 730next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.