Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,020cataloged exploits
35,276CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,446Referência 22,166GitHub PoC 14,080VulnCheck XDB 8,604Nuclei 4,251Metasploit 3,473✓ verified onlyrecentpopularrisk
22,166 exploits
Referência
CVE-2026-11531
CVE-2026-11531MEDIUM
imvks786 student_management_system Administrator Login Endpoint admin_login.php sql injection
33RISK
open ↗
Referência
CVE-2009-4426
CVE-2009-4426—
Multiple directory traversal vulnerabilities in Ignition 1.2, when magic_quotes_gpc is disabled, allow remote attackers
23RISK
open ↗
Referência
CVE-2009-4426
CVE-2009-4426—
Multiple directory traversal vulnerabilities in Ignition 1.2, when magic_quotes_gpc is disabled, allow remote attackers
23RISK
open ↗
Referência
CVE-2018-11404
CVE-2018-11404—
DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter.
23RISK
open ↗
Referência
CVE-2016-5237
CVE-2016-5237—
Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to m
23RISK
open ↗
Referência
CVE-2014-9528
CVE-2014-9528—
SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListControlle
23RISK
open ↗
Referência
CVE-2014-9528
CVE-2014-9528—
SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListControlle
23RISK
open ↗
Referência✓ VexDay Proof
beLive 0.2.3 - 'arch.php?arch' Local File Inclusion
CVE-2009-1649—webappsphp
Directory traversal vulnerability in arch.php in beLive 0.2.3 allows remote attackers to read arbitrary files via a .. (
23RISK
open ↗
Referência
CVE-2026-5311
CVE-2026-5311MEDIUM
D-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control
33RISK
open ↗
Referência
CVE-2026-5310
CVE-2026-5310LOW
Enter Software Iperius Backup IperiusAccounts.ini hard-coded key
28RISK
open ↗
Referência
CVE-2010-1924
CVE-2010-1924—
SQL injection vulnerability in index.php in Hi Web Wiesbaden Live Shopping Multi Portal System allows remote attackers t
23RISK
open ↗
Referência
CVE-2010-5003
CVE-2010-5003—
SQL injection vulnerability in the AutarTimonial (com_autartimonial) component 1.0.8 for Joomla! allows remote attackers
23RISK
open ↗
Referência
CVE-2010-5003
CVE-2010-5003—
SQL injection vulnerability in the AutarTimonial (com_autartimonial) component 1.0.8 for Joomla! allows remote attackers
23RISK
open ↗
Referência
CVE-2023-5212
CVE-2023-5212CRITICAL
AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file
48RISK
open ↗
Referência
CVE-2016-5309
CVE-2016-5309—
The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP);
23RISK
open ↗
Referência
CVE-2010-1925
CVE-2010-1925—
SQL injection vulnerability in makale.php in tekno.Portal 0.1b allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2009-2792
CVE-2009-2792—
Directory traversal vulnerability in plugings/pagecontent.php in Really Simple CMS (RSCMS) 0.3a allows remote attackers
23RISK
open ↗
Referência
CVE-2009-3825
CVE-2009-3825—
Multiple directory traversal vulnerabilities in GenCMS 2006 allow remote attackers to include and execute arbitrary loca
23RISK
open ↗
Referência
CVE-2012-5685
CVE-2012-5685—
SQL injection vulnerability in ZPanel 10.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Referência✓ VexDay Proof
vm Watermark for Gallery 0.4.1 - Remote File Inclusion
CVE-2007-2575—webappsphp
PHP remote file inclusion vulnerability in watermark.php in the vm (aka Jean-Francois Laflamme) watermark 0.4.1 mod for
23RISK
open ↗
Referência
CVE-2010-1936
CVE-2010-1936—
Directory traversal vulnerability in scr/soustab.php in openMairie openComInterne 1.01, when register_globals is enabled
23RISK
open ↗
Referência
CVE-2009-3596
CVE-2009-3596—
JoxTechnology Ajox Poll does not properly restrict access to admin/managepoll.php, which allows remote attackers to bypa
23RISK
open ↗
Referência
CVE-2010-1936
CVE-2010-1936—
Directory traversal vulnerability in scr/soustab.php in openMairie openComInterne 1.01, when register_globals is enabled
23RISK
open ↗
Referência
CVE-2018-15845
CVE-2018-15845—
There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add.
23RISK
open ↗
Referência
CVE-2021-42751
CVE-2021-42751—
A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrat
23RISK
open ↗
Referência
CVE-2009-2330
CVE-2009-2330—
Cross-site scripting (XSS) vulnerability in admin/admin_menu.php in CMS Chainuk 1.2 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
AV Tutorial Script 1.0 - Remote User Pass Change
CVE-2007-3630—webappsphp
changePW.php in AV Tutorial Script (avtutorial) 1.0 does not require authentication or knowledge of an old password for
23RISK
open ↗
Referência✓ VexDay Proof
Sisfo Kampus 2006 - 'blanko.preview.php' Local File Disclosure
CVE-2007-4820—webappsphp
Absolute path traversal vulnerability in blanko.preview.php in Sisfo Kampus 2006 allows remote attackers to read arbitra
23RISK
open ↗
Referência
CVE-2021-42750
CVE-2021-42750—
A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrat
23RISK
open ↗
Referência
CVE-2015-5534
CVE-2015-5534—
Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall before 1.8 allow remote attackers to hijack the aut
23RISK
open ↗
← previouspage 387 / 739next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.