Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,900cataloged exploits

35,840CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,458Referência 22,600GitHub PoC 14,323VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecent popular risk

22,573 exploits

Referência✓ VexDay Proof

Pre Simple CMS - Authentication Bypass

CVE-2008-5058—webappsphp

SQL injection vulnerability in siteadmin/loginsucess.php in Pre Simple CMS allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2026-5312

CVE-2026-5312MEDIUM

D-Link DNS-1550-04 dsk_mgr.cgi Get_current_raidtype access control

33RISK

open ↗

Referência

CVE-2010-1878

CVE-2010-1878—

Directory traversal vulnerability in the OrgChart (com_orgchart) component 1.0.0 for Joomla! allows remote attackers to

43RISK

open ↗

Referência

CVE-2013-1466

CVE-2013-1466—

Multiple cross-site scripting (XSS) vulnerabilities in glFusion before 1.2.2.pl4 allow remote attackers to inject arbitr

23RISK

open ↗

Referência

CVE-2013-1466

CVE-2013-1466—

Multiple cross-site scripting (XSS) vulnerabilities in glFusion before 1.2.2.pl4 allow remote attackers to inject arbitr

23RISK

open ↗

Referência✓ VexDay Proof

PHPIndexPage 1.0.1 - 'config.php' Remote File Inclusion

CVE-2007-0499—webappsphp

PHP remote file inclusion vulnerability in config.php in Sangwan Kim phpIndexPage 1.0.1 and earlier allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

WinPcap 4.0 - 'NPF.SYS' Local Privilege Escalation

CVE-2007-3681—localwindows

The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component SimpleFAQ 2.11 - SQL Injection

CVE-2007-4456—webappsphp

SQL injection vulnerability in index.php in the SimpleFAQ (com_simplefaq) 2.11 component for Mambo allows remote attacke

23RISK

open ↗

Referência✓ VexDay Proof

xKiosk 3.0.1i - 'xkurl.php?PEARPATH' Remote File Inclusion

CVE-2007-5314—webappsphp

PHP remote file inclusion vulnerability in system/funcs/xkurl.php in xKiosk WEB 3.0.1i, when register_globals is enabled

23RISK

open ↗

Referência✓ VexDay Proof

XZero Community Classifieds 4.95.11 - Local File Inclusion / SQL Injection

CVE-2007-6566—webappsphp

SQL injection vulnerability in post.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to ex

23RISK

open ↗

Referência

CVE-2009-3823

CVE-2009-3823—

Directory traversal vulnerability in myhtml.php in Mobilelib GOLD 3.0, when magic_quotes_gpc is enabled, allows remote a

23RISK

open ↗

Referência

CVE-2009-4723

CVE-2009-4723—

Directory traversal vulnerability in confirm.php in Netpet CMS 1.9 allows remote attackers to include and execute arbitr

23RISK

open ↗

Referência

CVE-2012-5331

CVE-2012-5331—

Directory traversal vulnerability in asaanCart 0.9 allows remote attackers to include arbitrary local files via a .. (do

23RISK

open ↗

Referência

CVE-2009-3507

CVE-2009-3507—

Directory traversal vulnerability in modules.php in CMSphp 0.21 allows remote attackers to include and execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

GuestCal 2.1 - 'index.php?lang' Local File Inclusion

CVE-2009-1319—webappsphp

Directory traversal vulnerability in includes/ini.inc.php in GuestCal 2.1 allows remote attackers to include and execute

23RISK

open ↗

Referência

CVE-2026-11531

CVE-2026-11531MEDIUM

imvks786 student_management_system Administrator Login Endpoint admin_login.php sql injection

33RISK

open ↗

Referência

CVE-2009-4426

CVE-2009-4426—

Multiple directory traversal vulnerabilities in Ignition 1.2, when magic_quotes_gpc is disabled, allow remote attackers

23RISK

open ↗

Referência

CVE-2009-4426

CVE-2009-4426—

Multiple directory traversal vulnerabilities in Ignition 1.2, when magic_quotes_gpc is disabled, allow remote attackers

23RISK

open ↗

Referência

CVE-2018-11404

CVE-2018-11404—

DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter.

23RISK

open ↗

Referência

CVE-2016-5237

CVE-2016-5237—

Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to m

23RISK

open ↗

Referência

CVE-2014-9528

CVE-2014-9528—

SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListControlle

23RISK

open ↗

Referência

CVE-2014-9528

CVE-2014-9528—

SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListControlle

23RISK

open ↗

Referência✓ VexDay Proof

beLive 0.2.3 - 'arch.php?arch' Local File Inclusion

CVE-2009-1649—webappsphp

Directory traversal vulnerability in arch.php in beLive 0.2.3 allows remote attackers to read arbitrary files via a .. (

23RISK

open ↗

Referência

CVE-2026-5311

CVE-2026-5311MEDIUM

D-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control

33RISK

open ↗

Referência

CVE-2026-5310

CVE-2026-5310LOW

Enter Software Iperius Backup IperiusAccounts.ini hard-coded key

28RISK

open ↗

Referência

CVE-2010-1924

CVE-2010-1924—

SQL injection vulnerability in index.php in Hi Web Wiesbaden Live Shopping Multi Portal System allows remote attackers t

23RISK

open ↗

Referência

CVE-2010-5003

CVE-2010-5003—

SQL injection vulnerability in the AutarTimonial (com_autartimonial) component 1.0.8 for Joomla! allows remote attackers

23RISK

open ↗

Referência

CVE-2010-5003

CVE-2010-5003—

SQL injection vulnerability in the AutarTimonial (com_autartimonial) component 1.0.8 for Joomla! allows remote attackers

23RISK

open ↗

Referência

CVE-2023-5212

CVE-2023-5212CRITICAL

AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file

48RISK

open ↗

Referência

CVE-2016-5309

CVE-2016-5309—

The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP);

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.