Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,058cataloged exploits

35,300CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,175GitHub PoC 14,096VulnCheck XDB 8,607Nuclei 4,255Metasploit 3,474✓ verified onlyrecent popular risk

22,166 exploits

Referência

CVE-2009-4657

CVE-2009-4657—

The administrator package for Xerver 4.32 does not require authentication, which allows remote attackers to alter applic

23RISK

open ↗

Referência✓ VexDay Proof

MySpeach 2.1b - 'up.php' Remote File Inclusion

CVE-2007-0498—webappsphp

PHP remote file inclusion vulnerability in up.php in MySpeach 2.1 beta and possibly earlier allows remote attackers to e

23RISK

open ↗

Referência

CVE-2013-10038

CVE-2013-10038CRITICAL

FlashChat Arbitrary File Upload RCE

63RISK

open ↗

Referência

CVE-2016-7661

CVE-2016-7661—

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. The is

23RISK

open ↗

Referência

CVE-2017-15958

CVE-2017-15958—

D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.

23RISK

open ↗

Referência

CVE-2017-15958

CVE-2017-15958—

D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.

23RISK

open ↗

Referência✓ VexDay Proof

iziContents rc6 - Local/Remote File Inclusion

CVE-2007-5053—webappsphp

Multiple incomplete blacklist vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

Papoo CMS 3.x - 'pfadhier' Local File Inclusion

CVE-2009-0735—webappsphp

Directory traversal vulnerability in lib/classes/message_class.php in Papoo CMS 3.6, when register_globals is enabled an

23RISK

open ↗

Referência

CVE-2016-0400

CVE-2016-0400—

CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0

23RISK

open ↗

Referência

CVE-2009-4993

CVE-2009-4993—

PHP remote file inclusion vulnerability in home.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbit

23RISK

open ↗

Referência

CVE-2026-10063

CVE-2026-10063HIGH

TRENDnet TEW-432BRP formWPS stack-based overflow

41RISK

open ↗

Referência

CVE-2015-4118

CVE-2015-4118—

SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated user

23RISK

open ↗

Referência

CVE-2015-4118

CVE-2015-4118—

SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated user

23RISK

open ↗

Referência

CVE-2021-41556

CVE-2021-41556CRITICAL

sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that ca

48RISK

open ↗

Referência

CVE-2013-5039

CVE-2013-5039—

Cross-site request forgery (CSRF) vulnerability in goform/wlanBasicSecurity on the HOT HOTBOX router with software 2.1.1

23RISK

open ↗

Referência✓ VexDay Proof

MiniGal b13 - Remote Code Execution

CVE-2007-2145—webappsphp

The imagecomments function in classes.php in MiniGal b13 allows remote attackers to inject arbitrary PHP code into a fil

23RISK

open ↗

Referência✓ VexDay Proof

VWar 1.5.0 R15 - 'mvcw.php' Remote File Inclusion

CVE-2007-4605—webappsphp

PHP remote file inclusion vulnerability in convert/mvcw.php in Virtual War (VWar) 1.5.0 R15 and earlier allows remote at

23RISK

open ↗

Referência

CVE-2012-0899

CVE-2012-0899—

Cross-site scripting (XSS) vulnerability in referencement/sites_inscription.php in Annuaire PHP allows remote attackers

23RISK

open ↗

Referência

CVE-2010-2016

CVE-2010-2016—

SQL injection vulnerability in details.php in Iceberg CMS allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência

CVE-2010-2016

CVE-2010-2016—

SQL injection vulnerability in details.php in Iceberg CMS allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência

CVE-2010-2020

CVE-2010-2020—

sys/nfsclient/nfs_vfsops.c in the NFS client in the kernel in FreeBSD 7.2 through 8.1-PRERELEASE, when vfs.usermount is

23RISK

open ↗

Referência✓ VexDay Proof

PHPMyRing 4.2.0 - 'view_com.php' SQL Injection

CVE-2006-4114—webappsphp

SQL injection vulnerability in view_com.php in Nicolas Grandjean PHPMyRing 4.2.0 and earlier allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

phpBB Ajax Shoutbox 0.0.5 - Remote File Inclusion

CVE-2006-5312—webappsphp

PHP remote file inclusion vulnerability in shoutbox.php in the Ajax Shoutbox 0.0.5 and earlier module for phpBB allows r

23RISK

open ↗

Referência✓ VexDay Proof

Uebimiau Web-Mail 2.7.10/2.7.2 - Remote File Disclosure

CVE-2008-0210—webappsphp

Uebimiau Webmail 2.7.10 and 2.7.2 does not protect authentication state variables from being set through HTTP requests,

23RISK

open ↗

Referência✓ VexDay Proof

zFeeder 1.6 - 'admin.php' Admin Bypass

CVE-2009-0807—webappsphp

zFeeder 1.6 allows remote attackers to gain administrative access via a direct request to admin.php.

23RISK

open ↗

Referência

CVE-2009-2791

CVE-2009-2791—

PHP remote file inclusion vulnerability in pda_projects.php in WebDynamite ProjectButler 1.5.0 allows remote attackers t

23RISK

open ↗

Referência

CVE-2009-2378

CVE-2009-2378—

PHP remote file inclusion vulnerability in formmailer.admin.inc.php in Jax FormMailer 3.0.0 allows remote attackers to e

23RISK

open ↗

Referência

CVE-2009-4614

CVE-2009-4614—

Multiple PHP remote file inclusion vulnerabilities in Moa Gallery 1.2.0 and earlier allow remote attackers to execute ar

23RISK

open ↗

Referência

CVE-2009-4622

CVE-2009-4622—

PHP remote file inclusion vulnerability in admin/admin_news_bot.php in Drunken:Golem Gaming Portal 0.5.1 alpha 2 allows

23RISK

open ↗

Referência

CVE-2009-4789

CVE-2009-4789—

Multiple PHP remote file inclusion vulnerabilities in the MojoBlog component RC 0.15 for Joomla! allow remote attackers

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.