Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,020cataloged exploits

35,276CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,446Referência 22,166GitHub PoC 14,080VulnCheck XDB 8,604Nuclei 4,251Metasploit 3,473✓ verified onlyrecent popular risk

22,166 exploits

Referência

CVE-2016-20088

CVE-2016-20088HIGH

Comodo Chromodo Browser 52.15.25.664 Unquoted Service Path Privilege Escalation

41RISK

open ↗

Referência✓ VexDay Proof

My Simple Forum 3.0 - Local File Inclusion

CVE-2008-5604—webappsphp

Directory traversal vulnerability in index.php in My Simple Forum 3.0 and 4.1, when magic_quotes_gpc is disabled, allows

23RISK

open ↗

Referência

CVE-2010-5047

CVE-2010-5047—

SQL injection vulnerability in page.php in V-EVA Press Release Script allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2010-5047

CVE-2010-5047—

SQL injection vulnerability in page.php in V-EVA Press Release Script allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2022-24112

CVE-2022-24112CRITICALunder attack

apisix/batch-requests plugin allows overwriting the X-REAL-IP header

100RISK

open ↗

Referência

CVE-2010-1216

CVE-2010-1216—

PHP remote file inclusion vulnerability in templates/template.php in notsoPureEdit 1.4.1 and earlier, when register_glob

23RISK

open ↗

Referência

CVE-2026-5315

CVE-2026-5315MEDIUM

Nothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-bounds

33RISK

open ↗

Referência

CVE-2026-5314

CVE-2026-5314MEDIUM

Nothings stb TTF File stb_truetype.h stbtt_InitFont_internal out-of-bounds

33RISK

open ↗

Referência

CVE-2010-2915

CVE-2010-2915—

SQL injection vulnerability in welcome.php in AJ Square AJ HYIP PRIME allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2010-2915

CVE-2010-2915—

SQL injection vulnerability in welcome.php in AJ Square AJ HYIP PRIME allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2008-5336

CVE-2008-5336—

SQL injection vulnerability in index.php in WebStudio CMS allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência

CVE-2009-4625

CVE-2009-4625—

SQL injection vulnerability in the updateOnePage function in components/com_bfsurvey_pro/controller.php in BF Survey Pro

23RISK

open ↗

Referência✓ VexDay Proof

PHPIndexPage 1.0.1 - 'config.php' Remote File Inclusion

CVE-2007-0499—webappsphp

PHP remote file inclusion vulnerability in config.php in Sangwan Kim phpIndexPage 1.0.1 and earlier allows remote attack

23RISK

open ↗

Referência

CVE-2024-8673

CVE-2024-8673CRITICAL

Z-Downloads < 1.11.7 - Admin+ Stored XSS via SVG Upload

63RISK

open ↗

Referência

CVE-2012-4873

CVE-2012-4873—

Cross-site scripting (XSS) vulnerability in the file_download function in GNUBoard before 4.34.21 allows remote attacker

23RISK

open ↗

Referência

CVE-2010-1877

CVE-2010-1877—

SQL injection vulnerability in the JTM Reseller (com_jtm) component 1.9 Beta for Joomla! allows remote attackers to exec

23RISK

open ↗

Referência

CVE-2012-5330

CVE-2012-5330—

Multiple cross-site scripting (XSS) vulnerabilities in asaanCart 0.9 allow remote attackers to inject arbitrary web scri

23RISK

open ↗

Referência

CVE-2026-5312

CVE-2026-5312MEDIUM

D-Link DNS-1550-04 dsk_mgr.cgi Get_current_raidtype access control

33RISK

open ↗

Referência

CVE-2010-1878

CVE-2010-1878—

Directory traversal vulnerability in the OrgChart (com_orgchart) component 1.0.0 for Joomla! allows remote attackers to

43RISK

open ↗

Referência✓ VexDay Proof

WinPcap 4.0 - 'NPF.SYS' Local Privilege Escalation

CVE-2007-3681—localwindows

The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component SimpleFAQ 2.11 - SQL Injection

CVE-2007-4456—webappsphp

SQL injection vulnerability in index.php in the SimpleFAQ (com_simplefaq) 2.11 component for Mambo allows remote attacke

23RISK

open ↗

Referência✓ VexDay Proof

xKiosk 3.0.1i - 'xkurl.php?PEARPATH' Remote File Inclusion

CVE-2007-5314—webappsphp

PHP remote file inclusion vulnerability in system/funcs/xkurl.php in xKiosk WEB 3.0.1i, when register_globals is enabled

23RISK

open ↗

Referência✓ VexDay Proof

XZero Community Classifieds 4.95.11 - Local File Inclusion / SQL Injection

CVE-2007-6566—webappsphp

SQL injection vulnerability in post.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

newsmanager 2.0 - Remote File Inclusion / File Disclosure / SQL Injection

CVE-2008-2343—webappsphp

News Manager 2.0 allows remote attackers to bypass restrictions and obtain sensitive information via a direct request to

23RISK

open ↗

Referência✓ VexDay Proof

Fastpublish CMS 1.9999 - Local File Inclusion / SQL Injection

CVE-2008-4519—webappsphp

Multiple directory traversal vulnerabilities in Fastpublish CMS 1.9999 d allow remote attackers to include and execute a

23RISK

open ↗

Referência✓ VexDay Proof

Pre Simple CMS - Authentication Bypass

CVE-2008-5058—webappsphp

SQL injection vulnerability in siteadmin/loginsucess.php in Pre Simple CMS allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

WebStudio CMS - Blind SQL Injection

CVE-2008-5336—webappsphp

SQL injection vulnerability in index.php in WebStudio CMS allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

Ourspace 2.0.9 - 'uploadmedia.cgi' Arbitrary File Upload

CVE-2007-4647—webappscgi

newswire/uploadmedia.cgi in 2coolcode Our Space (Ourspace) 2.0.9 allows remote attackers to upload certain files via uns

23RISK

open ↗

Referência

CVE-2022-29296

CVE-2022-29296—

A reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attack

23RISK

open ↗

Referência✓ VexDay Proof

Lithium CMS 4.04c - '/classes/index.php' Local File Inclusion

CVE-2006-5731—webappsphp

Directory traversal vulnerability in classes/index.php in Lithium CMS 4.04c and earlier allows remote attackers to inclu

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.