Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,058cataloged exploits

35,300CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,175GitHub PoC 14,096VulnCheck XDB 8,607Nuclei 4,255Metasploit 3,474✓ verified onlyrecent popular risk

22,175 exploits

Referência

CVE-2018-5479

CVE-2018-5479—

FoxSash ImgHosting 1.5 (according to footer information) is vulnerable to XSS attacks. The affected function is its sear

23RISK

open ↗

Referência

CVE-2011-0503

CVE-2011-0503—

Cross-site request forgery (CSRF) vulnerability in VaM Shop 1.6, 1.6.1, and probably earlier versions allows remote atta

23RISK

open ↗

Referência

CVE-2010-4914

CVE-2010-4914—

PHP remote file inclusion vulnerability in tools/phpmailer/class.phpmailer.php in PHP Classifieds 7.3 allows remote atta

23RISK

open ↗

Referência

CVE-2010-1106

CVE-2010-1106—

PHP remote file inclusion vulnerability in cgi/index.php in AdvertisementManager 3.1.0 allows remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

Ad Manager Pro 2.6 - 'ipath' Remote File Inclusion

CVE-2006-3192—webappsphp

PHP remote file inclusion vulnerability in Ad Manager Pro 2.6 allows remote attackers to execute arbitrary PHP code via

23RISK

open ↗

Referência

CVE-2014-4943

CVE-2014-4943—

The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by

23RISK

open ↗

Referência

CVE-2026-4163

CVE-2026-4163CRITICAL

Wavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injection

48RISK

open ↗

Referência

CVE-2014-5082

CVE-2014-5082—

Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus al

23RISK

open ↗

Referência

CVE-2018-5410

CVE-2018-5410—

Dokan file system driver contains a stack-based buffer overflow

23RISK

open ↗

Referência✓ VexDay Proof

LulieBlog 1.0.1 - Remote Authentication Bypass

CVE-2008-0329—webappsphp

LulieBlog 1.0.1 and 1.0.2 does not restrict access to (1) article_suppr.php, (2) comment_accepter.php, and (3) comment_r

23RISK

open ↗

Referência

CVE-2014-9237

CVE-2014-9237—

SQL injection vulnerability in Proticaret E-Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via a

23RISK

open ↗

Referência✓ VexDay Proof

DesktopOnNet 3 Beta - Multiple Remote File Inclusions

CVE-2008-2649—webappsphp

Multiple PHP remote file inclusion vulnerabilities in DesktopOnNet 3 Beta allow remote attackers to execute arbitrary PH

23RISK

open ↗

Referência✓ VexDay Proof

Avlc Forum - 'vlc_forum.php' SQL Injection

CVE-2008-3200—webappsphp

SQL injection vulnerability in vlc_forum.php in Avlc Forum as of 20080715 allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência

CVE-2009-4156

CVE-2009-4156—

PHP remote file inclusion vulnerability in modules/pms/index.php in Ciamos CMS 0.9.5 and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

AuraCMS 2.2.2 - '/pages_data.php' Arbitrary Edit/Add/Delete

CVE-2008-3203—webappsphp

js/pages/pages_data.php in AuraCMS 2.2 through 2.2.2 does not perform authentication, which allows remote attackers to a

23RISK

open ↗

Referência✓ VexDay Proof

Million Pixels 3 - 'id_cat' SQL Injection

CVE-2008-3204—webappsphp

SQL injection vulnerability in tops_top.php in E-topbiz Million Pixels 3 allows remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência

CVE-2023-27350

CVE-2023-27350CRITICALunder attackransomware

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bui

100RISK

open ↗

Referência

CVE-2009-4977

CVE-2009-4977—

PHP remote file inclusion vulnerability in index.php in MyBackup 1.4.0 allows remote authenticated users to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

blogme 3.0 - Cross-Site Scripting / Authentication Bypass

CVE-2006-5975—webappsasp

Multiple cross-site scripting (XSS) vulnerabilities in comments.asp in BlogMe 3.0 allow remote attackers to inject arbit

23RISK

open ↗

Referência✓ VexDay Proof

FreeStyle Wiki 3.6.2 - 'user.dat' Password Disclosure

CVE-2006-6889—webappsphp

FreeStyle Wiki (fswiki) 3.6.2 and earlier stores sensitive information under the web root with insufficient access contr

23RISK

open ↗

Referência✓ VexDay Proof

Eudora 7.1.0.9 - IMAP FLAGS Remote Overwrite (SEH)

CVE-2007-3166—remotewindows

Buffer overflow in Qualcomm Eudora 7.1.0.9 allows user-assisted, remote IMAP servers to execute arbitrary code via a lon

23RISK

open ↗

Referência

CVE-2009-4666

CVE-2009-4666—

Multiple PHP remote file inclusion vulnerabilities in Webradev Download Protect 1.0 allow remote attackers to execute ar

23RISK

open ↗

Referência

CVE-2009-3174

CVE-2009-3174—

PHP remote file inclusion vulnerability in fonctions_racine.php in OBOphiX 2.7.0 and earlier allows remote attackers to

23RISK

open ↗

Referência

CVE-2009-2633

CVE-2009-2633—

PHP remote file inclusion vulnerability in toolbar_ext.php in the VehicleManager (com_vehiclemanager) component 1.0 Basi

23RISK

open ↗

Referência

CVE-2016-8855

CVE-2016-8855—

Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience

23RISK

open ↗

Referência

CVE-2016-8855

CVE-2016-8855—

Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience

23RISK

open ↗

Referência

CVE-2025-34055

CVE-2025-34055CRITICAL

AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution

48RISK

open ↗

Referência

CVE-2019-6979

CVE-2019-6979—

An issue was discovered in the User IP History Logs (aka IP_History_Logs) plugin 1.0.2 for MyBB. There is XSS via the ad

23RISK

open ↗

Referência

CVE-2009-4512

CVE-2009-4512—

Directory traversal vulnerability in index.php in Oscailt 3.3, when Use Friendly URL's is disabled, allows remote attack

23RISK

open ↗

Referência

CVE-2014-9145

CVE-2014-9145—

Multiple SQL injection vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.