Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,900cataloged exploits
35,840CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,600GitHub PoC 14,323VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
22,600 exploits
Referência
CVE-2024-1783
CVE-2024-1783CRITICAL
Totolink LR1200GB Web Interface cstecgi.cgi loginAuth stack-based overflow
48RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component gigCalendar 1.0 - SQL Injection
CVE-2009-0726—webappsphp
SQL injection vulnerability in the GigCalendar (com_gigcal) component 1.0 for Mambo and Joomla! allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
wpQuiz 2.7 - Multiple SQL Injections
CVE-2007-6172—webappsphp
Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the id
23RISK
open ↗
Referência
CVE-2010-2040
CVE-2010-2040—
Cross-site scripting (XSS) vulnerability in search.php in V-EVA Shopzilla Affiliate Script PHP allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
123tkShop 0.9.1 - Remote Authentication Bypass
CVE-2007-6458—webappsphp
SQL injection vulnerability in shop/mainfile.php in 123tkShop 0.9.1 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2013-4659
CVE-2013-4659—
Buffer overflow in Broadcom ACSD allows remote attackers to execute arbitrary code via a long string to TCP port 5916. T
28RISK
open ↗
Referência
CVE-2015-5889
CVE-2015-5889—
rsh in the remote_cmds component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors inv
38RISK
open ↗
Referência✓ VexDay Proof
NetHoteles 3.0 - 'ficha.php' SQL Injection
CVE-2009-1346—webappsphp
SQL injection vulnerability in publico/ficha.php in NetHoteles 3.0 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência
CVE-2009-3333
CVE-2009-3333—
PHP remote file inclusion vulnerability in koesubmit.php in the koeSubmit (com_koesubmit) component 1.0 for Mambo allows
23RISK
open ↗
Referência
CVE-2009-3055
CVE-2009-3055—
PHP remote file inclusion vulnerability in engine/api/api.class.php in DataLife Engine (DLE) 8.2 allows remote attackers
23RISK
open ↗
Referência
CVE-2015-3141
CVE-2015-3141—
Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier
23RISK
open ↗
Referência
CVE-2022-31056
CVE-2022-31056CRITICAL
SQL injection with _actor parameter in GLPI
48RISK
open ↗
Referência✓ VexDay Proof
PHP Classifieds Script 05122008 - SQL Injection
CVE-2008-2453—webappsphp
Multiple SQL injection vulnerabilities in PHP Classifieds Script allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência
CVE-2026-18052
CVE-2026-18052HIGH
ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters
41RISK
open ↗
Referência
CVE-2009-3543
CVE-2009-3543—
SQL injection vulnerability in _phenotype/admin/login.php in Phenotype CMS before 2.9 allows remote attackers to execute
23RISK
open ↗
Referência
CVE-2026-16738
CVE-2026-16738MEDIUM
Conekta Payment Gateway < 6.2.2 - Unauthenticated Order Payment Completion via Webhook Forgery
33RISK
open ↗
Referência
CVE-2009-3718
CVE-2009-3718—
SQL injection vulnerability in admin/authenticate.asp in Battle Blog 1.25 and 1.30 build 2 allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2026-16612
CVE-2026-16612MEDIUM
FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure
33RISK
open ↗
Referência
CVE-2019-13493
CVE-2019-13493—
In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged u
23RISK
open ↗
Referência
CVE-2018-10365
CVE-2018-10365—
An XSS issue was discovered in the Threads to Link plugin 1.3 for MyBB. When editing a thread, the user is given the opt
23RISK
open ↗
Referência
CVE-2018-5263
CVE-2018-5263—
The StackIdeas EasyDiscuss (aka com_easydiscuss) extension before 4.0.21 for Joomla! allows XSS.
23RISK
open ↗
Referência
CVE-2010-3209
CVE-2010-3209—
Multiple PHP remote file inclusion vulnerabilities in Seagull 0.6.7 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗
Referência
CVE-2010-3209
CVE-2010-3209—
Multiple PHP remote file inclusion vulnerabilities in Seagull 0.6.7 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗
Referência
CVE-2016-6689
CVE-2016-6689—
Binder in the kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensitive information via
23RISK
open ↗
Referência
CVE-2015-6100
CVE-2015-6100—
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wi
23RISK
open ↗
Referência
CVE-2016-8742
CVE-2016-8742—
The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in t
23RISK
open ↗
Referência
CVE-2017-0091
CVE-2017-0091—
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers
28RISK
open ↗
Referência
CVE-2010-1874
CVE-2010-1874—
SQL injection vulnerability in the Real Estate Property (com_properties) component 3.1.22-03 for Joomla! allows remote a
23RISK
open ↗
Referência
CVE-2026-16260
CVE-2026-16260MEDIUM
Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field
33RISK
open ↗
Referência
Neo Billing 3.5 - Persistent Cross-Site Scripting
CVE-2020-23518—webappsphp
Cross Site Scripting (XSS) vulnerability in UltimateKode Neo Billing - Accounting, Invoicing And CRM Software up to vers
23RISK
open ↗
← previouspage 640 / 754next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.