Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,020cataloged exploits
35,276CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,446Referência 22,166GitHub PoC 14,080VulnCheck XDB 8,604Nuclei 4,251Metasploit 3,473✓ verified onlyrecentpopularrisk
21,899 exploits
Referência
CVE-2014-8677
CVE-2014-8677—
The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and
23RISK
open ↗
Referência
CVE-2015-6945
CVE-2015-6945—
Cross-site scripting (XSS) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to inject arbitrary we
23RISK
open ↗
Referência
CVE-2017-7447
CVE-2017-7447—
HelpDEZk 1.1.1 has CSRF in admin/home#/logos/ with an impact of remote execution of arbitrary PHP code.
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin WP-Forum 1.7.4 - SQL Injection
CVE-2008-0388—webappsphp
SQL injection vulnerability in the WP-Forum 1.7.4 plugin for WordPress allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2010-1354
CVE-2010-1354—
Directory traversal vulnerability in the VJDEO (com_vjdeo) component 1.0 and 1.0.1 for Joomla! allows remote attackers t
43RISK
open ↗
Referência
CVE-2010-1360
CVE-2010-1360—
Multiple PHP remote file inclusion vulnerabilities in FAQEngine 4.24.00 allow remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência
CVE-2010-1360
CVE-2010-1360—
Multiple PHP remote file inclusion vulnerabilities in FAQEngine 4.24.00 allow remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência✓ VexDay Proof
I-Pos Internet Pay Online Store 1.3 Beta - SQL Injection
CVE-2008-2634—webappsasp
SQL injection vulnerability in index.asp in I-Pos Internet Pay Online Store 1.3 Beta and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Mini Web Calendar 1.2 - File Disclosure / Cross-Site Scripting
CVE-2008-5061—webappsphp
Cross-site scripting (XSS) vulnerability in php/cal_default.php in Mini Web Calendar (mwcal) 1.2 allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Konqueror 3.5.9 - 'load' Remote Crash
CVE-2008-5698—doslinux
HTMLTokenizer::scriptHandler in Konqueror in KDE 3.5.9 and 3.5.10 allows remote attackers to cause a denial of service (
23RISK
open ↗
Referência✓ VexDay Proof
MyKtools 2.4 - Arbitrary Database Backup
CVE-2008-6815—webappsphp
mykdownload.php in MyKtools 2.4 does not require administrative authentication, which allows remote attackers to read a
23RISK
open ↗
Referência✓ VexDay Proof
Rama CMS 0.9.8 - 'download.php' File Disclosure
CVE-2009-1768—webappsphp
Directory traversal vulnerability in download.php in Rama Zaiten CMS 0.9.8 and earlier allows remote attackers to read a
23RISK
open ↗
Referência
CVE-2009-4194
CVE-2009-4194—
Directory traversal vulnerability in Golden FTP Server 4.30 Free and Professional, 4.50, and possibly other versions all
23RISK
open ↗
Referência
CVE-2019-13658
CVE-2019-13658CRITICAL
CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to exec
48RISK
open ↗
Referência
CVE-2026-12723
CVE-2026-12723MEDIUM
Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library
33RISK
open ↗
Referência
CVE-2026-12592
CVE-2026-12592HIGH
SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header
41RISK
open ↗
Referência
CVE-2013-6164
CVE-2013-6164—
SQL injection vulnerability in view/objectDetail.php in Project'Or RIA 3.4.0 allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2013-6164
CVE-2013-6164—
SQL injection vulnerability in view/objectDetail.php in Project'Or RIA 3.4.0 allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2017-6528
CVE-2017-6528—
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is affected by plaintext password storage (the /home/dna/
23RISK
open ↗
Referência
CVE-2012-1199
CVE-2012-1199—
Multiple PHP remote file inclusion vulnerabilities in Basic Analysis and Security Engine (BASE) 1.4.5 allow remote attac
23RISK
open ↗
Referência
CVE-2026-16214
CVE-2026-16214MEDIUM
geex-arts django-jet Dashboard views.py authorization
33RISK
open ↗
Referência
CVE-2026-16212
CVE-2026-16212LOW
awesto django-shop Purchase Stock inventory.py race condition
28RISK
open ↗
Referência
CVE-2026-16211
CVE-2026-16211LOW
allegro Hostname Allocation assets.py AssetLastHostname.increment_hostname race condition
28RISK
open ↗
Referência
CVE-2026-16210
CVE-2026-16210MEDIUM
newpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authentication
33RISK
open ↗
Referência
CVE-2026-16209
CVE-2026-16209MEDIUM
Gerapy Project Upload Endpoint views.py missing authentication
33RISK
open ↗
Referência
CVE-2026-16204
CVE-2026-16204MEDIUM
zevorn rt-claw Telegram-to-AI Tool Execution Flow script.c tool_run_script_execute code injection
33RISK
open ↗
Referência✓ VexDay Proof
Telephone Directory 2008 - SQL Injection / Cross-Site Scripting
CVE-2008-2678—webappsphp
Multiple SQL injection vulnerabilities in Telephone Directory 2008, when magic_quotes_gpc is disabled, allow remote atta
23RISK
open ↗
Referência✓ VexDay Proof
realm CMS 2.3 - Multiple Vulnerabilities
CVE-2008-2679—webappsphp
SQL injection vulnerability in the KeyWordsList function in _includes/inc_routines.asp in Realm CMS 2.3 and earlier allo
23RISK
open ↗
Referência✓ VexDay Proof
realm CMS 2.3 - Multiple Vulnerabilities
CVE-2008-2680—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in _db/compact.asp in Realm CMS 2.3 and earlier allow remote attacke
23RISK
open ↗
Referência
CVE-2009-2383
CVE-2009-2383—
SQL injection vulnerability in BTE_RW_webajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers
23RISK
open ↗
← previouspage 379 / 730next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.