Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,866cataloged exploits
35,812CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,573GitHub PoC 14,316VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
22,549 exploits
Referência
CVE-2023-27290
CVE-2023-27290CRITICAL
IBM Observability with Instana missing authentication
48RISK
open ↗
Referência
CVE-2015-7715
CVE-2015-7715—
Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows
23RISK
open ↗
Referência
CVE-2015-7715
CVE-2015-7715—
Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows
23RISK
open ↗
Referência✓ VexDay Proof
OWLLib 1.0 - 'OWLMemoryProperty.php' Remote File Inclusion
CVE-2006-6150—webappsphp
PHP remote file inclusion vulnerability in memory/OWLMemoryProperty.php in OWLLib 1.0 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
BrowseDialog Class - 'ccrpbds6.dll' Multiple Denial of Service Vulnerabilities
CVE-2007-1162—doswindows
A certain ActiveX control in the Common Controls Replacement Project (CCRP) CCRP BrowseDialog Server (ccrpbds6.dll) allo
23RISK
open ↗
Referência
CVE-2026-66007
CVE-2026-66007MEDIUM
Datasets Path Traversal via Unsanitized file_name Metadata
33RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke - 'iframe.php' Remote File Inclusion
CVE-2007-1626—webappsphp
PHP remote file inclusion vulnerability in iframe.php in the iFrame Module for PHP-NUKE allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
Hot Links SQL-PHP 3 - 'report.php' Multiple Vulnerabilities
CVE-2008-4379—webappsphp
Cross-site scripting (XSS) vulnerability in report.php in Mr. CGI Guy Hot Links SQL-PHP 3.0 and earlier allows remote at
23RISK
open ↗
Referência
CVE-2013-4884
CVE-2013-4884—
Cross-site scripting (XSS) vulnerability in McAfee SuperScan 4.0 allows remote attackers to inject arbitrary web script
23RISK
open ↗
Referência
CVE-2010-1877
CVE-2010-1877—
SQL injection vulnerability in the JTM Reseller (com_jtm) component 1.9 Beta for Joomla! allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2015-1058
CVE-2015-1058—
Multiple cross-site scripting (XSS) vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web scr
23RISK
open ↗
Referência
CVE-2014-0868
CVE-2014-0868—
RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-
23RISK
open ↗
Referência
CVE-2010-4232
CVE-2010-4232—
The web-based administration interface on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera
23RISK
open ↗
Referência
CVE-2014-3740
CVE-2014-3740—
Cross-site scripting (XSS) vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbi
23RISK
open ↗
Referência
CVE-2017-2490
CVE-2017-2490—
An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS b
23RISK
open ↗
Referência
CVE-2015-5150
CVE-2015-5150—
Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authentica
23RISK
open ↗
Referência
CVE-2015-5150
CVE-2015-5150—
Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authentica
23RISK
open ↗
Referência
CVE-2022-35866
CVE-2022-35866CRITICAL
This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Reco
48RISK
open ↗
Referência
CVE-2017-17602
CVE-2017-17602—
Advance B2B Script 2.1.3 has SQL Injection via the tradeshow-list-detail.php show_id or view-product.php pid parameter.
23RISK
open ↗
Referência
CVE-2017-17602
CVE-2017-17602—
Advance B2B Script 2.1.3 has SQL Injection via the tradeshow-list-detail.php show_id or view-product.php pid parameter.
23RISK
open ↗
Referência✓ VexDay Proof
ftp Admin 0.1.0 - Local File Inclusion / Cross-Site Scripting / Authentication Bypass
CVE-2007-6234—webappsphp
index.php in FTP Admin 0.1.0 allows remote attackers to bypass authentication and obtain administrative access via a log
23RISK
open ↗
Referência✓ VexDay Proof
SineCMS 2.3.4 - Calendar SQL Injection
CVE-2007-6367—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in the guestbook in SineCMS 2.3.4 and earlier allow remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin Photo album - SQL Injection
CVE-2008-0939—webappsphp
Multiple SQL injection vulnerabilities in wppa.php in the WP Photo Album (WPPA) before 1.1 plugin for WordPress allow re
23RISK
open ↗
Referência✓ VexDay Proof
pPIM 1.0 - Upload/Change Password
CVE-2008-4428—webappsphp
Unrestricted file upload vulnerability in upload.php in Phlatline's Personal Information Manager (pPIM) 1.0 and earlier
23RISK
open ↗
Referência
CVE-2017-17607
CVE-2017-17607—
CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.
23RISK
open ↗
Referência
CVE-2017-17607
CVE-2017-17607—
CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.
23RISK
open ↗
Referência
CVE-2014-3792
CVE-2014-3792—
Cross-site request forgery (CSRF) vulnerability in Beetel 450TC2 Router with firmware TX6-0Q-005_retail allows remote at
23RISK
open ↗
Referência
CVE-2015-2805
CVE-2015-2805—
Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web int
23RISK
open ↗
Referência
CVE-2015-2805
CVE-2015-2805—
Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web int
23RISK
open ↗
Referência
CVE-2010-0605
CVE-2010-0605—
SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Sta
23RISK
open ↗
← previouspage 615 / 752next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.