Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,900cataloged exploits
35,840CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,600GitHub PoC 14,323VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
22,573 exploits
Referência
CVE-2021-33570
CVE-2021-33570—
Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can
23RISK
open ↗
Referência
CVE-2021-33570
CVE-2021-33570—
Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can
23RISK
open ↗
Referência
CVE-2010-1340
CVE-2010-1340—
Directory traversal vulnerability in jresearch.php in the J!Research (com_jresearch) component for Joomla! allows remote
43RISK
open ↗
Referência✓ VexDay Proof
PhpHostBot 1.06 - 'svr_rootscript' Remote File Inclusion
CVE-2007-4231—webappsphp
PHP remote file inclusion vulnerability in order/login.php in IDevSpot PhpHostBot 1.06 and earlier allows remote attacke
23RISK
open ↗
Referência
CVE-2018-18548
CVE-2018-18548—
ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in Fi
23RISK
open ↗
Referência
CVE-2018-18548
CVE-2018-18548—
ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in Fi
23RISK
open ↗
Referência
CVE-2010-2254
CVE-2010-2254—
SQL injection vulnerability in the Shape5 Bridge of Hope template for Joomla! allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2010-2254
CVE-2010-2254—
SQL injection vulnerability in the Shape5 Bridge of Hope template for Joomla! allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2006-0944
CVE-2006-0944—
Archangel Weblog 0.90.02 allows remote attackers to bypass authentication by setting the ba_admin cookie to 1.
23RISK
open ↗
Referência
CVE-2013-2760
CVE-2013-2760—
Buffer overflow in Groovy Media Player 3.2.0 allows remote attackers to execute arbitrary code via a long string in a .m
23RISK
open ↗
Referência
CVE-2014-4944
CVE-2014-4944—
Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress al
23RISK
open ↗
Referência✓ VexDay Proof
Creator CMS 5.0 - 'sideid' SQL Injection
CVE-2008-7001—webappsasp
Unrestricted file upload vulnerability in the file manager in Creative Mind Creator CMS 5.0 allows remote attackers to e
23RISK
open ↗
Referência✓ VexDay Proof
FrontAccounting 1.13 - Remote File Inclusion
CVE-2007-5117—webappsphp
Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.13, when register_globals is enabled, allow
23RISK
open ↗
Referência
CVE-2015-8261
CVE-2015-8261—
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized
23RISK
open ↗
Referência
CVE-2015-2094
CVE-2015-2094—
Stack-based buffer overflow in the WESPPlayback.WESPPlaybackCtrl.1 control in WebGate WinRDS allows remote attackers to
28RISK
open ↗
Referência✓ VexDay Proof
MailBee Objects 5.5 - 'MailBee.dll' Remote Insecure Method
CVE-2008-0631—remotewindows
Multiple ActiveX controls in MailBee.dll in MailBee Objects 5.5 allow remote attackers to (1) overwrite arbitrary files
23RISK
open ↗
Referência
CVE-2014-9522
CVE-2014-9522—
Multiple cross-site scripting (XSS) vulnerabilities in CMS Papoo Light 6.0.0 (Rev 4701) allow remote attackers to inject
23RISK
open ↗
Referência
CVE-2014-9522
CVE-2014-9522—
Multiple cross-site scripting (XSS) vulnerabilities in CMS Papoo Light 6.0.0 (Rev 4701) allow remote attackers to inject
23RISK
open ↗
Referência
CVE-2006-2226
CVE-2006-2226—
Buffer overflow in XM Easy Personal FTP Server 4.2 and 5.0.1 allows remote authenticated users to cause a denial of serv
23RISK
open ↗
Referência
CVE-2014-8653
CVE-2014-8653—
Cross-site scripting (XSS) vulnerability in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 wit
23RISK
open ↗
Referência
CVE-2014-8653
CVE-2014-8653—
Cross-site scripting (XSS) vulnerability in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 wit
23RISK
open ↗
Referência✓ VexDay Proof
phpCMS 1.2.2 - 'file' Remote File Disclosure
CVE-2008-0513—webappsphp
Directory traversal vulnerability in parser/include/class.cache_phpcms.php in phpCMS 1.2.2 allows remote attackers to re
23RISK
open ↗
Referência
CVE-2010-1349
CVE-2010-1349—
Integer overflow in Opera 10.10 through 10.50 allows remote attackers to execute arbitrary code via a large Content-Leng
28RISK
open ↗
Referência
CVE-2019-6263
CVE-2019-6263—
An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allo
23RISK
open ↗
Referência
CVE-2009-5087
CVE-2009-5087—
Directory traversal vulnerability in geohttpserver in Geovision Digital Video Surveillance System 8.2 allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component acctexp 0.12.x - Blind SQL Injection
CVE-2008-2632—webappsphp
SQL injection vulnerability in the acctexp (com_acctexp) component 0.12.x and earlier for Joomla! allows remote attacker
23RISK
open ↗
Referência
CVE-2026-9347
CVE-2026-9347MEDIUM
Edimax EW-7438RPn webs formWizSurvey os command injection
33RISK
open ↗
Referência
CVE-2014-10035
CVE-2014-10035—
Multiple cross-site scripting (XSS) vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrat
23RISK
open ↗
Referência
CVE-2014-10035
CVE-2014-10035—
Multiple cross-site scripting (XSS) vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrat
23RISK
open ↗
Referência
CVE-2018-7543
CVE-2018-7543—
Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for
23RISK
open ↗
← previouspage 634 / 753next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.