Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,231cataloged exploits

35,420CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecent popular risk

22,266 exploits

Referência

CVE-2010-3603

CVE-2010-3603—

Cross-site request forgery (CSRF) vulnerability in the file manager service (Services/FileService.ashx) in mojoPortal 2.

23RISK

open ↗

Referência

CVE-2010-3603

CVE-2010-3603—

Cross-site request forgery (CSRF) vulnerability in the file manager service (Services/FileService.ashx) in mojoPortal 2.

23RISK

open ↗

Referência

CVE-2026-13500

CVE-2026-13500MEDIUM

antlr ANTLR4 Grammar Action Block OutputFile.java code injection

33RISK

open ↗

Referência

CVE-2018-14497

CVE-2018-14497—

Tenda D152 ADSL routers allow XSS via a crafted SSID.

23RISK

open ↗

Referência

CVE-2018-0901

CVE-2018-0901—

The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve

23RISK

open ↗

Referência✓ VexDay Proof

microssys CMS 1.5 - Remote File Inclusion

CVE-2008-2396—webappsphp

PHP remote file inclusion vulnerability in index.php in Wajox Software microSSys CMS 1.5 and earlier, when register_glob

23RISK

open ↗

Referência✓ VexDay Proof

L2J Statistik Script 0.09 - 'index.php' Local File Inclusion

CVE-2007-0173—webappsphp

Directory traversal vulnerability in index.php in L2J Statistik Script 0.09 and earlier, when register_globals is enable

23RISK

open ↗

Referência

CVE-2010-1725

CVE-2010-1725—

SQL injection vulnerability in offers_buy.php in Alibaba Clone Platinum allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2010-1725

CVE-2010-1725—

SQL injection vulnerability in offers_buy.php in Alibaba Clone Platinum allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2010-1726

CVE-2010-1726—

SQL injection vulnerability in offers_buy.php in EC21 Clone 3.0 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência

CVE-2009-4825

CVE-2009-4825—

8pixel.net Blog 4 stores sensitive information under the web root with insufficient access control, which allows remote

23RISK

open ↗

Referência

CVE-2009-4820

CVE-2009-4820—

Angelo-Emlak 1.0 stores sensitive information under the web root with insufficient access control, which allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

Bradabra 2.0.5 - '/include/includes.php' Remote File Inclusion

CVE-2007-0500—webappsphp

PHP remote file inclusion vulnerability in include/includes.php in Bradabra 2.0.5 and earlier allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

deeemm CMS (dmcms) 0.7.4 - Multiple Vulnerabilities

CVE-2008-3721—webappsphp

PHP remote file inclusion vulnerability in user_language.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to exec

23RISK

open ↗

Referência

CVE-2009-4056

CVE-2009-4056—

Directory traversal vulnerability in admin/popup.php in Betsy CMS 3.5 allows remote attackers to include and execute arb

23RISK

open ↗

Referência✓ VexDay Proof

wotw 5.0 - Local/Remote File Inclusion

CVE-2008-6223—webappsphp

PHP remote file inclusion vulnerability in visualizza.php in Way Of The Warrior (WOTW) 5.0 and earlier allows remote att

23RISK

open ↗

Referência

CVE-2009-4471

CVE-2009-4471—

Multiple PHP remote file inclusion vulnerabilities in FreeSchool 1.1.0 and earlier allow remote attackers to execute arb

23RISK

open ↗

Referência

CVE-2010-1726

CVE-2010-1726—

SQL injection vulnerability in offers_buy.php in EC21 Clone 3.0 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência

CVE-2010-1727

CVE-2010-1727—

SQL injection vulnerability in type.asp in JobPost 1.0 allows remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência

CVE-2010-1727

CVE-2010-1727—

SQL injection vulnerability in type.asp in JobPost 1.0 allows remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência✓ VexDay Proof

Destar 0.2.2-5 - Arbitrary Add New User

CVE-2008-6538—webappsphp

DeStar 0.2.2-5 allows remote attackers to add arbitrary users via a direct request to config/add/CfgOptUser.

23RISK

open ↗

Referência✓ VexDay Proof

GRBoard 1.8 - Multiple Remote File Inclusions

CVE-2009-0444—webappsphp

Multiple PHP remote file inclusion vulnerabilities in GRBoard 1.8, when register_globals is enabled and magic_quotes_gpc

23RISK

open ↗

Referência✓ VexDay Proof

acute control panel 1.0.0 - SQL Injection / Remote File Inclusion

CVE-2009-1248—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Acute Control Panel 1.0.0 allow remote attackers to execute arbitr

23RISK

open ↗

Referência

CVE-2010-1057

CVE-2010-1057—

Multiple directory traversal vulnerabilities in Phpkobo AdFreely (aka Ad Board Script) 1.01, when magic_quotes_gpc is di

23RISK

open ↗

Referência

CVE-2018-18417

CVE-2018-18417—

In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as d

23RISK

open ↗

Referência

CVE-2012-4254

CVE-2012-4254—

MySQLDumper 1.24.4 allows remote attackers to obtain sensitive information (Notices) via a direct request to (1) learn/c

23RISK

open ↗

Referência

CVE-2025-65008

CVE-2025-65008CRITICAL

OS Command Injection in WODESYS WD-R608U router

48RISK

open ↗

Referência✓ VexDay Proof

PHPMyphorum 1.5a - '/mep/frame.php' Remote File Inclusion

CVE-2007-0361—webappsphp

PHP remote file inclusion vulnerability in mep/frame.php in PHPMyphorum 1.5a allows remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

Drunken:Golem Portal 0.5.1 Alpha 2 - Remote File Inclusion

CVE-2007-0572—webappsphp

PHP remote file inclusion vulnerability in include/irc/phpIRC.php in Drunken:Golem Gaming Portal 0.5.1 Alpha 2 and earli

23RISK

open ↗

Referência

CVE-2010-1739

CVE-2010-1739—

SQL injection vulnerability in the Newsfeeds (com_newsfeeds) component for Joomla! allows remote attackers to execute ar

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.