Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,772cataloged exploits
35,760CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,523GitHub PoC 14,289VulnCheck XDB 8,710Nuclei 4,319Metasploit 3,476✓ verified onlyrecentpopularrisk
22,523 exploits
Referência
CVE-2014-2586
CVE-2014-2586—
Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote atta
23RISK
open ↗
Referência
CVE-2014-2586
CVE-2014-2586—
Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote atta
23RISK
open ↗
Referência
CVE-2011-3833
CVE-2011-3833—
Unrestricted file upload vulnerability in ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote
43RISK
open ↗
Referência
CVE-2006-6566
CVE-2006-6566—
PHP remote file inclusion vulnerability in includes/profilcp_constants.php in the Profile Control Panel (CPanel) module
23RISK
open ↗
Referência
CVE-2014-9580
CVE-2014-9580—
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2014-9580
CVE-2014-9580—
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2014-4710
CVE-2014-4710—
Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2014-4710
CVE-2014-4710—
Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2013-7368
CVE-2013-7368—
Multiple cross-site scripting (XSS) vulnerabilities in Gnew 2013.1 allow remote attackers to inject arbitrary web script
23RISK
open ↗
Referência
CVE-2013-5312
CVE-2013-5312—
Multiple cross-site scripting (XSS) vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2013-5312
CVE-2013-5312—
Multiple cross-site scripting (XSS) vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2013-4898
CVE-2013-4898—
Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine
23RISK
open ↗
Referência✓ VexDay Proof
OpenH323 Opal SIP Protocol - Remote Denial of Service
CVE-2007-4924—doswindows
The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remo
28RISK
open ↗
Referência
CVE-2018-17382
CVE-2018-17382—
SQL Injection exists in the Jobs Factory 2.0.4 component for Joomla! via the filter_letter parameter.
23RISK
open ↗
Referência
CVE-2018-17382
CVE-2018-17382—
SQL Injection exists in the Jobs Factory 2.0.4 component for Joomla! via the filter_letter parameter.
23RISK
open ↗
Referência
CVE-2026-15206
CVE-2026-15206HIGH
SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile
41RISK
open ↗
Referência
CVE-2026-15151
CVE-2026-15151HIGH
Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications
41RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component ionFiles 4.4.2 - File Disclosure
CVE-2008-6080—webappsphp
Directory traversal vulnerability in download.php in the ionFiles (com_ionfiles) 4.4.2 component for Joomla! allows remo
43RISK
open ↗
Referência
CVE-2023-39026
CVE-2023-39026—
Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker t
43RISK
open ↗
Referência
CVE-2020-6756
CVE-2020-6756CRITICAL
languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to re
53RISK
open ↗
Referência✓ VexDay Proof
Maian Recipe 1.2 - Insecure Cookie Handling
CVE-2008-3322—webappsphp
admin/index.php in Maian Recipe 1.2 and earlier allows remote attackers to bypass authentication and gain administrative
23RISK
open ↗
Referência✓ VexDay Proof
D-Bus Daemon < 1.2.4 - 'libdbus' Denial of Service
CVE-2008-3834—dosmultiple
The dbus_signature_validate function in the D-bus library (libdbus) before 1.2.4 allows remote attackers to cause a deni
23RISK
open ↗
Referência
CVE-2019-11537
CVE-2019-11537—
In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.ph
23RISK
open ↗
Referência✓ VexDay Proof
Cmaps v8.0 - SQL injection
CVE-2023-29809CRITICALwebappsphp
SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbit
53RISK
open ↗
Referência✓ VexDay Proof
Ads Pro - 'dhtml.pl' Remote Command Execution
CVE-2008-6826—webappscgi
dhtml.pl in MHF Media Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the page par
23RISK
open ↗
Referência
CVE-2018-18804
CVE-2018-18804—
Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb.
23RISK
open ↗
Referência
CVE-2018-18804
CVE-2018-18804—
Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb.
23RISK
open ↗
Referência
CVE-2018-13045
CVE-2018-13045—
SQL injection vulnerability in the "Bazar" page in Yeswiki Cercopitheque 2018-06-19-1 and earlier allows attackers to ex
23RISK
open ↗
Referência
CVE-2018-13045
CVE-2018-13045—
SQL injection vulnerability in the "Bazar" page in Yeswiki Cercopitheque 2018-06-19-1 and earlier allows attackers to ex
23RISK
open ↗
Referência
CVE-2014-9331
CVE-2014-9331—
Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote
23RISK
open ↗
← previouspage 580 / 751next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.