Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,449cataloged exploits
35,552CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,367GitHub PoC 14,225VulnCheck XDB 8,649Nuclei 4,283Metasploit 3,474✓ verified onlyrecentpopularrisk
22,367 exploits
Referência
CVE-2012-2156
CVE-2012-2156—
Multiple cross-site scripting (XSS) vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbi
23RISK
open ↗
Referência
CVE-2009-2276
CVE-2009-2276—
SQL injection vulnerability in voteforus.php in the Vote For Us extension 1.0.1 and earlier for PunBB allows remote atta
23RISK
open ↗
Referência
CVE-2004-2466
CVE-2004-2466—
chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username
60RISK
open ↗
Referência
CVE-2004-2466
CVE-2004-2466—
chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username
60RISK
open ↗
Referência✓ VexDay Proof
aspwebalbum 3.2 - Multiple Vulnerabilities
CVE-2008-6978—webappsasp
Unrestricted file upload vulnerability in Full Revolution aspWebAlbum 3.2 allows remote attackers to execute arbitrary c
23RISK
open ↗
Referência✓ VexDay Proof
XAMPP for Windows 1.6.0a - 'mssql_connect()' Remote Buffer Overflow
CVE-2007-2080—remotewindows
Multiple SQL injection vulnerabilities in XAMPP 1.6.0a for Windows allow remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
aspwebalbum 3.2 - Arbitrary File Upload / SQL Injection / Cross-Site Scripting
CVE-2008-6978—webappsphp
Unrestricted file upload vulnerability in Full Revolution aspWebAlbum 3.2 allows remote attackers to execute arbitrary c
23RISK
open ↗
Referência
CVE-2016-1542
CVE-2016-1542—
The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and U
60RISK
open ↗
Referência
CVE-2016-1542
CVE-2016-1542—
The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and U
60RISK
open ↗
Referência
CVE-2016-1542
CVE-2016-1542—
The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and U
60RISK
open ↗
Referência✓ VexDay Proof
Joomla! / Mambo Component New Article 1.1 - Remote File Inclusion
CVE-2007-2089—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the Jx Development Article 1.1 and earlier component for Mambo and
23RISK
open ↗
Referência
CVE-2021-32305
CVE-2021-32305—
WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search paramet
60RISK
open ↗
Referência✓ VexDay Proof
BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery
CVE-2008-7058—webappsphp
Cross-site request forgery (CSRF) vulnerability in BandSite CMS 1.1.4 allows remote attackers to hijack the authenticati
23RISK
open ↗
Referência
CVE-2026-7113
CVE-2026-7113MEDIUM
NousResearch hermes-agent Webhooks Endpoint webhook.py missing authentication
33RISK
open ↗
Referência
CVE-2026-7112
CVE-2026-7112MEDIUM
NousResearch hermes-agent API_SERVER_KEY api_server.py _check_auth improper authentication
33RISK
open ↗
Referência
CVE-2026-7110
CVE-2026-7110MEDIUM
code-projects Invoice System in Laravel item cross site scripting
33RISK
open ↗
Referência
CVE-2026-7109
CVE-2026-7109MEDIUM
code-projects Invoice System in Laravel API Endpoint item improper authorization
33RISK
open ↗
Referência
CVE-2009-2326
CVE-2009-2326—
Multiple SQL injection vulnerabilities in KerviNet Forum 1.1 and earlier allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2018-1999002
CVE-2018-1999002—
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framewor
45RISK
open ↗
Referência
CVE-2020-10915
CVE-2020-10915CRITICAL
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.
85RISK
open ↗
Referência
CVE-2022-31814
CVE-2022-31814CRITICAL
pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metachar
85RISK
open ↗
Referência✓ VexDay Proof
k-rate - SQL Injection / Cross-Site Scripting
CVE-2008-7098—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Qsoft K-Rate Premium allow remote attackers to inject arbitrary w
23RISK
open ↗
Referência✓ VexDay Proof
k-rate - SQL Injection / Cross-Site Scripting
CVE-2008-7099—webappsphp
Unspecified vulnerability in the Manage Templates feature in Qsoft K-Rate Premium allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
zKup CMS 2.0 < 2.3 - Arbitrary File Upload
CVE-2008-7124—webappsphp
zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allo
23RISK
open ↗
Referência✓ VexDay Proof
zKup CMS 2.0 < 2.3 - Remote Add Admin
CVE-2008-7124—webappsphp
zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allo
23RISK
open ↗
Referência
CVE-2014-0322
CVE-2014-0322HIGHunder attack
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code v
100RISK
open ↗
Referência
CVE-2014-0322
CVE-2014-0322HIGHunder attack
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code v
100RISK
open ↗
Referência
CVE-2019-20361
CVE-2019-20361HIGH
There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to b
78RISK
open ↗
Referência
CVE-2009-2335
CVE-2009-2335—
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the u
60RISK
open ↗
Referência
CVE-2013-3906
CVE-2013-3906HIGHunder attack
GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compati
100RISK
open ↗
← previouspage 507 / 746next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.