Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,794cataloged exploits
36,057CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,459Referência 22,721GitHub PoC 14,946VulnCheck XDB 8,829Nuclei 4,350Metasploit 3,489✓ verified onlyrecentpopularrisk
22,721 exploits
Referência✓ VexDay Proof
Groupwise 7.0 - 'mailto: scheme' Buffer Overflow (PoC)
CVE-2008-2069—doswindows
Buffer overflow in Novell GroupWise 7 allows remote attackers to cause a denial of service or execute arbitrary code via
35RISK
open ↗
Referência
CVE-2018-1335
CVE-2018-1335—
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to
60RISK
open ↗
Referência
CVE-2018-1335
CVE-2018-1335—
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to
60RISK
open ↗
Referência
CVE-2016-1524
CVE-2016-1524—
Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote
60RISK
open ↗
Referência✓ VexDay Proof
Gallery MX 2.0.0 - Blind SQL Injection
CVE-2008-6379—webappsasp
SQL injection vulnerability in pics_pre.asp in Gallery MX 2.0.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência
CVE-2026-21643
CVE-2026-21643CRITICALunder attack
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiC
100RISK
open ↗
Referência
CVE-2024-48248
CVE-2024-48248HIGHunder attack
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /
100RISK
open ↗
Referência✓ VexDay Proof
Woltlab Burning Board 1.0.2/2.3.6 - 'search.php' SQL Injection (2)
CVE-2007-0388—webappsphp
SQL injection vulnerability in search.php in Woltlab Burning Board (wBB) 1.0.2 and earlier, and 2.3.6 and earlier in the
23RISK
open ↗
Referência✓ VexDay Proof
SimpleNews 1.0.0 FINAL - 'print.php?news_id' SQL Injection
CVE-2007-2598—webappsphp
SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
TutorialCMS 1.00 - 'search.php?search' SQL Injection
CVE-2007-2599—webappsphp
Multiple SQL injection vulnerabilities in TutorialCMS (aka Photoshop Tutorials) 1.00 and earlier allow remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
TutorialCMS 1.00 - 'search.php?search' SQL Injection
CVE-2007-2600—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in TutorialCMS (aka Photoshop Tutorials) 1.00 and earlier allow remo
23RISK
open ↗
Referência✓ VexDay Proof
LaVague 0.3 - 'printbar.php?views_path' Remote File Inclusion
CVE-2007-2607—webappsphp
PHP remote file inclusion vulnerability in views/print/printbar.php in LaVague 0.3 and earlier allows remote attackers t
45RISK
open ↗
Referência
CVE-2023-41892
CVE-2023-41892CRITICAL
Craft CMS Remote Code Execution vulnerability
85RISK
open ↗
Referência
CVE-2019-1663
CVE-2019-1663CRITICAL
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
85RISK
open ↗
Referência
CVE-2019-15976
CVE-2019-15976CRITICAL
Cisco Data Center Network Manager Authentication Bypass Vulnerabilities
70RISK
open ↗
Referência✓ VexDay Proof
Feedback and Rating Script 1.0 - 'detail.php' SQL Injection
CVE-2008-2277—webappsphp
SQL injection vulnerability in detail.php in Feedback and Rating Script 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Miplex2 - 'SmartyFU.class.php' Remote File Inclusion
CVE-2007-2608—webappsphp
PHP remote file inclusion vulnerability in lib/smarty/SmartyFU.class.php in Miplex2 Alpha 1 allows remote attackers to e
23RISK
open ↗
Referência
CVE-2012-1297
CVE-2012-1297—
Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier
23RISK
open ↗
Referência
CVE-2012-1297
CVE-2012-1297—
Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier
23RISK
open ↗
Referência
CVE-2019-1663
CVE-2019-1663CRITICAL
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
85RISK
open ↗
Referência✓ VexDay Proof
PHPLojaFacil 0.1.5 - 'path_local' Remote File Inclusion
CVE-2007-2615—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Crie seu PHPLojaFacil 0.1.5 allow remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
Original 0.11 - 'config.inc.php?x[1]' Remote File Inclusion
CVE-2007-2620—webappsphp
PHP remote file inclusion vulnerability in inc/config.inc.php in Jakub Steiner (aka jimmac) original 0.11 allows remote
23RISK
open ↗
Referência
CVE-2020-1350
CVE-2020-1350CRITICALunder attack
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle req
100RISK
open ↗
Referência✓ VexDay Proof
Microsoft Internet Explorer - Print Table of Links Cross-Zone Scripting
CVE-2008-2281—remotewindows
Cross-zone scripting vulnerability in the Print Table of Links feature in Internet Explorer 6.0, 7.0, and 8.0b allows us
28RISK
open ↗
Referência✓ VexDay Proof
Internet PhotoShow (Special Edition) - Insecure Cookie Handling
CVE-2008-2282—webappsphp
admin.php in Internet Photoshow and Internet Photoshow Special Edition (SE) allows remote attackers to bypass authentica
23RISK
open ↗
Referência✓ VexDay Proof
Hunkaray Duyuru Scripti - 'tr' SQL Injection
CVE-2007-0688—webappsasp
SQL injection vulnerability in oku.asp in Hunkaray Duyuru Scripti allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
Mantis Bug Tracker 1.1.1 - Code Execution / Cross-Site Scripting / Cross-Site Request Forgery
CVE-2008-3332—webappsphp
Eval injection vulnerability in adm_config_set.php in Mantis before 1.1.2 allows remote authenticated administrators to
23RISK
open ↗
Referência✓ VexDay Proof
newsmanager 2.0 - Remote File Inclusion / File Disclosure / SQL Injection
CVE-2008-2340—webappsphp
Multiple SQL injection vulnerabilities in News Manager 2.0 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2017-3066
CVE-2017-3066CRITICALunder attack
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier hav
100RISK
open ↗
Referência✓ VexDay Proof
newsmanager 2.0 - Remote File Inclusion / File Disclosure / SQL Injection
CVE-2008-2342—webappsphp
Directory traversal vulnerability in attachments.php in News Manager 2.0 allows remote attackers to read arbitrary files
23RISK
open ↗
← previouspage 5 / 758next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.