Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,813cataloged exploits
35,788CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,549GitHub PoC 14,290VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
22,549 exploits
Referência✓ VexDay Proof
yourplace 1.0.2 - Multiple Vulnerabilities / Remote Code Execution
CVE-2008-6771—webappsphp
YourPlace 1.0.2 and earlier allows remote attackers to obtain sensitive system information via a direct request via a di
23RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Affiliate - 'cat_id' SQL Injection
CVE-2008-6780—webappsphp
SQL injection vulnerability in directory.php in Scripts for Sites (SFS) SFS EZ Affiliate allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Gaming Directory - 'cat_id' SQL Injection
CVE-2008-6781—webappsphp
SQL injection vulnerability in directory.php in Sites for Scripts (SFS) Gaming Directory allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Gaming Directory - 'directory.php' SQL Injection
CVE-2008-6781—webappsphp
SQL injection vulnerability in directory.php in Sites for Scripts (SFS) Gaming Directory allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2012-5292
CVE-2012-5292—
Multiple SQL injection vulnerabilities in Atar2b CMS 4.0.1 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2012-5294
CVE-2012-5294—
SQL injection vulnerability in art_detalle.php in MyStore Xpress Tienda Virtual allows remote attackers to execute arbit
23RISK
open ↗
Referência
CVE-2008-6887
CVE-2008-6887—
SQL injection vulnerability in detailad.asp in Pre Classified Listings 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2008-6898
CVE-2008-6898—
Buffer overflow in the XHTTP Module 4.1.0.0 in the ActiveX control for SaschArt SasCam Webcam Server 2.6.5 allows remote
50RISK
open ↗
Referência
CVE-2026-57521
CVE-2026-57521MEDIUM
Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController
33RISK
open ↗
Referência✓ VexDay Proof
Getleft 1.2 - Remote Buffer Overflow (PoC)
CVE-2008-6897—dosmultiple
Multiple buffer overflows in Getleft.exe in Andres Garcia Getleft 1.2 allow remote attackers to cause a denial of servic
23RISK
open ↗
Referência✓ VexDay Proof
SasCam WebCam Server 2.6.5 - ActiveX Remote Buffer Overflow
CVE-2008-6898—remotewindows
Buffer overflow in the XHTTP Module 4.1.0.0 in the ActiveX control for SaschArt SasCam Webcam Server 2.6.5 allows remote
50RISK
open ↗
Referência✓ VexDay Proof
AvailScript Article Script - Arbitrary File Upload
CVE-2008-6900—webappsphp
Unrestricted file upload vulnerability in "Add Pen/Author Name" feature in addpen.php in AvailScript Article Script allo
23RISK
open ↗
Referência✓ VexDay Proof
2532/Gigs 1.2.2 Stable - Multiple Vulnerabilities
CVE-2008-6902—webappsphp
Unrestricted file upload vulnerability in upload_flyer.php in 2532designs 2532|Gigs 1.2.2 Stable allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
BabbleBoard 1.1.6 - Cross-Site Request Forgery/Cookie Grabber
CVE-2008-6905—webappsphp
Cross-site request forgery (CSRF) vulnerability in index.php in BabbleBoard 1.1.6 allows remote authenticated users to h
23RISK
open ↗
Referência
CVE-2009-4578
CVE-2009-4578—
Cross-site scripting (XSS) vulnerability in the Facileforms (com_facileforms) component for Joomla! and Mambo allows rem
23RISK
open ↗
Referência✓ VexDay Proof
ScriptsFeed (SF) Recipes Listing Portal - Arbitrary File Upload
CVE-2008-6943—webappsphp
Unrestricted file upload vulnerability in ScriptsFeed Recipes Listing Portal allows remote authenticated users to execut
23RISK
open ↗
Referência✓ VexDay Proof
ScriptsFeed (SF) Auto Classifieds Software - Arbitrary File Upload
CVE-2008-6944—webappsphp
Unrestricted file upload vulnerability in ScriptsFeed Auto Classifieds allows remote authenticated users to execute arbi
23RISK
open ↗
Referência
CVE-2012-5684
CVE-2012-5684—
Cross-site scripting (XSS) vulnerability in ZPanel 10.0.1 and earlier allows remote attackers to inject arbitrary web sc
23RISK
open ↗
Referência
CVE-2026-7850
CVE-2026-7850MEDIUM
WP Magnific Popup <= 1.0 - Author+ Stored XSS via href Attribute
33RISK
open ↗
Referência
CVE-2026-2604
CVE-2026-2604MEDIUM
Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling
33RISK
open ↗
Referência
CVE-2026-49954
CVE-2026-49954HIGH
Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin Directory
41RISK
open ↗
Referência
CVE-2026-49953
CVE-2026-49953MEDIUM
Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set
33RISK
open ↗
Referência
CVE-2016-20080
CVE-2016-20080MEDIUM
WordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.php
33RISK
open ↗
Referência
CVE-2016-20078
CVE-2016-20078MEDIUM
WordPress IMDb Profile Widget 1.0.8 Local File Inclusion via pic.php
33RISK
open ↗
Referência
CVE-2016-20077
CVE-2016-20077MEDIUM
WordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.php
33RISK
open ↗
Referência
CVE-2016-20076
CVE-2016-20076HIGH
WordPress Simple-Backup 2.7.11 Arbitrary File Deletion and Download
41RISK
open ↗
Referência✓ VexDay Proof
DD-WRT HTTPd Daemon/Service - Remote Command Execution
CVE-2008-6975—remotehardware
Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp2 allow remote attackers to hijac
23RISK
open ↗
Referência✓ VexDay Proof
aspwebalbum 3.2 - Arbitrary File Upload / SQL Injection / Cross-Site Scripting
CVE-2008-6977—webappsphp
Cross-site scripting (XSS) vulnerability in album.asp in Full Revolution aspWebAlbum 3.2 allows remote attackers to inje
23RISK
open ↗
Referência
CVE-2012-5701
CVE-2012-5701—
Multiple SQL injection vulnerabilities in dotProject before 2.1.7 allow remote authenticated administrators to execute a
23RISK
open ↗
Referência
CVE-2012-5863
CVE-2012-5863—
Sinapsi eSolar OS Command Injection
53RISK
open ↗
← previouspage 600 / 752next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.