Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,001cataloged exploits
40,084CVEs with public exploitation
24,696lab-tested
AllReferência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecentpopularrisk
25,989 exploits
Referência✓ VexDay Proof
FretsWeb 1.2 - Multiple Local File Inclusions
CVE-2009-2109—webappsphp
Multiple directory traversal vulnerabilities in FretsWeb 1.2 allow remote attackers to read arbitrary files via director
23RISK
open ↗
Referência
CVE-2010-1722
CVE-2010-1722—
Directory traversal vulnerability in the Online Market (com_market) component 2.x for Joomla! allows remote attackers to
38RISK
open ↗
Referência
CVE-2010-1365
CVE-2010-1365—
SQL injection vulnerability in index.php in Uiga Fan Club, as downloaded on 20100310, allows remote attackers to execute
23RISK
open ↗
Referência
CVE-2016-10277
CVE-2016-10277—
An elevation of privilege vulnerability in the Motorola bootloader could enable a local malicious application to execute
23RISK
open ↗
Referência
CVE-2018-18793
CVE-2018-18793—
School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos.
23RISK
open ↗
Referência
CVE-2010-1722
CVE-2010-1722—
Directory traversal vulnerability in the Online Market (com_market) component 2.x for Joomla! allows remote attackers to
38RISK
open ↗
Referência
CVE-2017-7041
CVE-2017-7041—
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iClo
23RISK
open ↗
Referência
CVE-2010-1366
CVE-2010-1366—
Multiple SQL injection vulnerabilities in admin/admin_login.php in Uiga Fan Club 1.0 and earlier allow remote attackers
23RISK
open ↗
Referência
CVE-2010-3314
CVE-2010-3314—
Cross-site scripting (XSS) vulnerability in login.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versio
23RISK
open ↗
Referência
CVE-2010-4954
CVE-2010-4954—
SQL injection vulnerability in product_reviews_info.php in xt:Commerce Gambio 2008 allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2018-18793
CVE-2018-18793—
School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos.
23RISK
open ↗
Referência
CVE-2023-27179
CVE-2023-27179HIGH
GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename paramet
68RISK
open ↗
Referência
CVE-2026-102499
CVE-2026-102499HIGH
Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action
41RISK
open ↗
Referência
CVE-2026-100145
CVE-2026-100145MEDIUM
Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route
33RISK
open ↗
Referência✓ VexDay Proof
HSRS 1.0 - 'addcode.php' Remote File Inclusion
CVE-2006-6154—webappsphp
PHP remote file inclusion vulnerability in addcode.php in HIOX Star Rating System Script (HSRS) 1.0 and earlier allows r
23RISK
open ↗
Referência
CVE-2017-15965
CVE-2017-15965—
The NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in
23RISK
open ↗
Referência
CVE-2016-4309
CVE-2016-4309—
Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is disabled, allows remote attackers
28RISK
open ↗
Referência
CVE-2011-4715
CVE-2011-4715—
Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime
23RISK
open ↗
Referência
CVE-2017-6553
CVE-2017-6553—
Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows remote attackers to obtain full
50RISK
open ↗
Referência
CVE-2012-6050
CVE-2012-6050—
The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consu
23RISK
open ↗
Referência
CVE-2013-7280
CVE-2013-7280—
Buffer overflow in HansoTools Hanso Player 2.1.0, 2.5.0, and earlier allows remote attackers to cause a denial of servic
23RISK
open ↗
Referência
CVE-2009-2535
CVE-2009-2535—
Mozilla Firefox before 2.0.0.19 and 3.x before 3.0.5, SeaMonkey, and Thunderbird allow remote attackers to cause a denia
23RISK
open ↗
Referência
CVE-2009-3705
CVE-2009-3705—
PHP remote file inclusion vulnerability in debugger.php in Achievo before 1.4.0 allows remote attackers to execute arbit
23RISK
open ↗
Referência
CVE-2026-109526
CVE-2026-109526MEDIUM
HBAI-Ltd Toonflow-app exportData Endpoint information disclosure
33RISK
open ↗
Referência
CVE-2010-1471
CVE-2010-1471—
Directory traversal vulnerability in the AddressBook (com_addressbook) component 1.5.0 for Joomla! allows remote attacke
43RISK
open ↗
Referência
CVE-2010-3856
CVE-2010-3856—
ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use
43RISK
open ↗
Referência
CVE-2010-4984
CVE-2010-4984—
SQL injection vulnerability in notes.php in My Kazaam Notes Management System allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2010-4406
CVE-2010-4406—
Directory traversal vulnerability in gallery.php in Brunetton LittlePhpGallery 1.0.2, when magic_quotes_gpc is disabled,
23RISK
open ↗
Referência✓ VexDay Proof
WEBInsta CMS 0.3.1 - 'templates_dir' Remote File Inclusion
CVE-2006-4196—webappsphp
PHP remote file inclusion vulnerability in index.php in WEBInsta CMS 0.3.1 and possibly earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Linksys SPA941 - '\377' Character Remote Denial of Service
CVE-2007-2270—doshardware
The Linksys SPA941 VoIP Phone allows remote attackers to cause a denial of service (device reboot) via a 0377 (0xff) cha
23RISK
open ↗
← previouspage 135 / 867next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.