Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,772cataloged exploits
35,760CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,523GitHub PoC 14,289VulnCheck XDB 8,710Nuclei 4,319Metasploit 3,476✓ verified onlyrecentpopularrisk
22,523 exploits
Referência
CVE-2018-13045
CVE-2018-13045—
SQL injection vulnerability in the "Bazar" page in Yeswiki Cercopitheque 2018-06-19-1 and earlier allows attackers to ex
23RISK
open ↗
Referência
CVE-2018-13045
CVE-2018-13045—
SQL injection vulnerability in the "Bazar" page in Yeswiki Cercopitheque 2018-06-19-1 and earlier allows attackers to ex
23RISK
open ↗
Referência
CVE-2014-9331
CVE-2014-9331—
Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote
23RISK
open ↗
Referência
CVE-2017-6552
CVE-2017-6552—
Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 devices have an insufficiently large default value for the maximum IPv6 routing
23RISK
open ↗
Referência
CVE-2014-5189
CVE-2014-5189—
SQL injection vulnerability in lib/optin/optin_page.php in the Lead Octopus plugin for WordPress allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Fuju News 1.0 - Authentication Bypass / SQL Injection
CVE-2006-1838—webappsphp
edit_kategorie.php in Fuju News 1.0 allows remote attackers to bypass authentication by setting the authorized cookie.
23RISK
open ↗
Referência✓ VexDay Proof
WFTPD Pro Server 3.23.1.1 - 'APPE' Remote Buffer Overflow (PoC)
CVE-2006-5826—doswindows
Buffer overflow in Texas Imperial Software WFTPD Pro Server 3.23.1.1 allows remote authenticated users to execute arbitr
28RISK
open ↗
Referência✓ VexDay Proof
meBiblio 0.4.5 - 'action' Remote File Inclusion
CVE-2007-6089—webappsphp
PHP remote file inclusion vulnerability in index.php in meBiblio 0.4.5 allows remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component mosDirectory 2.3.2 - 'catid' SQL Injection
CVE-2008-0690—webappsphp
SQL injection vulnerability in index.php in the mosDirectory (com_directory) 2.3.2 component for Joomla! allows remote a
23RISK
open ↗
Referência✓ VexDay Proof
GC Auction Platinum - 'cate_id' SQL Injection
CVE-2008-3413—webappsphp
SQL injection vulnerability in category.php in Greatclone GC Auction Platinum allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
phpMyRealty 2.0.0 - 'location' SQL Injection
CVE-2008-3445—webappsphp
SQL injection vulnerability in index.php in phpMyRealty (PMR) 2.0.0 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2019-19363
CVE-2019-19363—
An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attacker
38RISK
open ↗
Referência
CVE-2021-31950
CVE-2021-31950HIGH
Microsoft SharePoint Server Spoofing Vulnerability
41RISK
open ↗
Referência
CVE-2018-18324
CVE-2018-18324—
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter
23RISK
open ↗
Referência
CVE-2016-8016
CVE-2016-8016—
Information exposure in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote
23RISK
open ↗
Referência
CVE-2021-24169
CVE-2021-24169—
Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS)
43RISK
open ↗
Referência
CVE-2014-0683
CVE-2014-0683—
The web management interface on the Cisco RV110W firewall with firmware 1.2.0.9 and earlier, RV215W router with firmware
28RISK
open ↗
Referência
CVE-2014-7289
CVE-2014-7289—
SQL injection vulnerability in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and
23RISK
open ↗
Referência
CVE-2011-4812
CVE-2011-4812—
Cross-site scripting (XSS) vulnerability in nowosci.php in BestShopPro allows remote attackers to inject arbitrary web s
23RISK
open ↗
Referência
CVE-2026-13609
CVE-2026-13609HIGH
Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Form Field
41RISK
open ↗
Referência✓ VexDay Proof
E-topbiz Dating 3 PHP Script - 'mail_id' SQL Injection
CVE-2008-3490—webappsphp
SQL injection vulnerability in members/mail.php in E-topbiz Online Dating 3 1.0 allows remote authenticated users to exe
23RISK
open ↗
Referência
CVE-2000-1196
CVE-2000-1196—
PSCOErrPage.htm in Netscape PublishingXpert 2.5 before SP2 allows remote attackers to read arbitrary files by specifying
23RISK
open ↗
Referência
CVE-2021-27885
CVE-2021-27885—
usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.
23RISK
open ↗
Referência
CVE-2018-0749
CVE-2018-0749—
The Microsoft Server Message Block (SMB) Server in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2
23RISK
open ↗
Referência✓ VexDay Proof
WikkiTikkiTavi 1.11 - Arbitrary '.PHP' File Upload
CVE-2009-0602—webappsphp
Unrestricted file upload vulnerability in upload.php in WikkiTikkiTavi 1.11 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2013-10060
CVE-2013-10060CRITICAL
Netgear Routers pppoe.cgi RCE
63RISK
open ↗
Referência
CVE-2013-10060
CVE-2013-10060CRITICAL
Netgear Routers pppoe.cgi RCE
63RISK
open ↗
Referência
CVE-2013-10060
CVE-2013-10060CRITICAL
Netgear Routers pppoe.cgi RCE
63RISK
open ↗
Referência
CVE-2013-10060
CVE-2013-10060CRITICAL
Netgear Routers pppoe.cgi RCE
63RISK
open ↗
Referência
CVE-2020-8819
CVE-2020-8819—
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in
23RISK
open ↗
← previouspage 584 / 751next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.