Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,058cataloged exploits
35,300CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,175GitHub PoC 14,096VulnCheck XDB 8,607Nuclei 4,255Metasploit 3,474✓ verified onlyrecentpopularrisk
22,175 exploits
Referência
CVE-2018-5370
CVE-2018-5370—
BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI.
23RISK
open ↗
Referência
CVE-2018-5370
CVE-2018-5370—
BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI.
23RISK
open ↗
Referência✓ VexDay Proof
Seditio CMS 121 - SQL Injection
CVE-2007-6202—webappsphp
SQL injection vulnerability in plugins/search/search.php in Neocrome Seditio CMS 121 and earlier allows remote attackers
23RISK
open ↗
Referência
CVE-2009-0611
CVE-2009-0611—
Multiple cross-site scripting (XSS) vulnerabilities in qfsearch/AdminServlet in QuickFinder Server in Novell Open Enterp
23RISK
open ↗
Referência
CVE-2018-6224
CVE-2018-6224—
A lack of cross-site request forgery (CSRF) protection vulnerability in Trend Micro Email Encryption Gateway 5.5 could a
23RISK
open ↗
Referência✓ VexDay Proof
PHPmotion 2.0 - 'update_profile.php' Arbitrary File Upload
CVE-2008-3118—webappsphp
SQL injection vulnerability in play.php in PHPmotion 2.0 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência
CVE-2021-43009
CVE-2021-43009—
A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the reque
23RISK
open ↗
Referência
CVE-2010-1999
CVE-2010-1999—
Directory traversal vulnerability in scr/soustab.php in OpenMairie Opencatalogue 1.024, when register_globals is enabled
23RISK
open ↗
Referência✓ VexDay Proof
cf shopkart 5.2.2 - SQL Injection / File Disclosure
CVE-2008-6321—webappsasp
CF Shopkart 5.2.2 stores cfshopkart52.mdb under the web root with insufficient access control, which allows remote attac
23RISK
open ↗
Referência
CVE-2012-4282
CVE-2012-4282—
SQL injection vulnerability in photo.php in Trombinoscope 3.5 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2011-5229
CVE-2011-5229—
SQL injection vulnerability in quickstart/profile/index.php in the Forum module in appRain CMF 0.1.5 allows remote attac
23RISK
open ↗
Referência
CVE-2012-1673
CVE-2012-1673—
SQL injection vulnerability in loginscript.php in e-ticketing allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2012-1672
CVE-2012-1672—
SQL injection vulnerability in getcity.php in Hotel Booking Portal 0.1 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2013-3537
CVE-2013-3537—
Multiple SQL injection vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2013-3531
CVE-2013-3531—
SQL injection vulnerability in meneger.php in RadioCMS 2.2 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2016-6601
CVE-2016-6601—
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows rem
60RISK
open ↗
Referência
CVE-2016-6601
CVE-2016-6601—
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows rem
60RISK
open ↗
Referência
CVE-2012-1018
CVE-2012-1018—
Cross-site scripting (XSS) vulnerability in includes/convert.php in D-Mack Media Currency Converter (mod_currencyconvert
23RISK
open ↗
Referência
CVE-2016-6603
CVE-2016-6603—
ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users v
45RISK
open ↗
Referência
CVE-2016-6603
CVE-2016-6603—
ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users v
45RISK
open ↗
Referência
CVE-2026-10249
CVE-2026-10249MEDIUM
itsourcecode Online Blood Bank Management System viewrequest.php sql injection
33RISK
open ↗
Referência
Opmon 9.11 - Cross-site Scripting
CVE-2021-43009—remotemultiple
A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the reque
23RISK
open ↗
Referência
CVE-2009-2588
CVE-2009-2588—
Multiple cross-site scripting (XSS) vulnerabilities in Hotscripts Type PHP Clone Script allow remote attackers to inject
23RISK
open ↗
Referência
CVE-2026-10239
CVE-2026-10239MEDIUM
JeecgBoot edit WordUtil.addImage server-side request forgery
33RISK
open ↗
Referência
CVE-2018-1202
CVE-2018-1202—
Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and version 7.1.1.11 is af
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module Lykos Reviews 1.00 - 'index.php' SQL Injection
CVE-2007-1817—webappsphp
SQL injection vulnerability in index.php in the Lykos Reviews (lykos_reviews) 1.00 module for Xoops allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
Zomplog 3.8 - 'mp3playlist.php' SQL Injection
CVE-2007-2773—webappsphp
SQL injection vulnerability in plugins/mp3playlist/mp3playlist.php in Zomplog 3.8 and earlier allows remote attackers to
23RISK
open ↗
Referência
CVE-2026-10234
CVE-2026-10234MEDIUM
Mettle sendportal Campaign webview cross site scripting
33RISK
open ↗
Referência
CVE-2010-3131
CVE-2010-3131—
Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 an
28RISK
open ↗
Referência
CVE-2017-17629
CVE-2017-17629—
Secure E-commerce Script 2.0.1 has SQL Injection via the category.php searchmain or searchcat parameter, or the single_d
23RISK
open ↗
← previouspage 404 / 740next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.