Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,186cataloged exploits

40,156CVEs with public exploitation

24,696lab-tested

All Referência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecent popular risk

26,041 exploits

Referência

CVE-2016-0862

CVE-2016-0862—

General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authentica

23RISK

open ↗

Referência

CVE-2010-1269

CVE-2010-1269—

SQL injection vulnerability in auktion.php in phpscripte24 Niedrig Gebote Pro Auktions System II allows remote attackers

23RISK

open ↗

Referência

CVE-2012-3448

CVE-2012-3448—

Unspecified vulnerability in Ganglia Web before 3.5.1 allows remote attackers to execute arbitrary PHP code via unknown

23RISK

open ↗

Referência

CVE-2017-17417

CVE-2017-17417—

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backu

23RISK

open ↗

Referência

CVE-2009-4958

CVE-2009-4958—

SQL injection vulnerability in video.php in EMO Breeder Manager (aka EMO Breader Manager) allows remote attackers to exe

23RISK

open ↗

Referência

CVE-2018-17961

CVE-2018-17961—

Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving err

23RISK

open ↗

Referência

CVE-2010-1268

CVE-2010-1268—

Directory traversal vulnerability in index.php in justVisual CMS 2.0, when magic_quotes_gpc is disabled, allows remote a

23RISK

open ↗

Referência

CVE-2013-6283

CVE-2013-6283—

VideoLAN VLC Media Player 2.0.8 and earlier allows remote attackers to cause a denial of service (crash) and possibly ex

23RISK

open ↗

Referência

CVE-2014-5109

CVE-2014-5109—

SQL injection vulnerability in maint/modules/endpointcfg/endpoint_generic.php in Fonality trixbox allows remote attacker

23RISK

open ↗

Referência

CVE-2016-0862

CVE-2016-0862—

General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authentica

23RISK

open ↗

Referência

CVE-2018-11523

CVE-2018-11523—

upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files.

23RISK

open ↗

Referência

Vtiger CRM 7.1.0 - Remote Code Execution

CVE-2019-5009—webappsphp

Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the upload

23RISK

open ↗

Referência

CVE-2021-34370

CVE-2021-34370—

Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. NOTE: the vendor states "there are

38RISK

open ↗

Referência

CVE-2026-86611

CVE-2026-86611MEDIUM

Download Manager (Free & Pro) - Privacy Settings Update via CSRF

33RISK

open ↗

Referência

CVE-2026-85642

CVE-2026-85642HIGH

Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS

41RISK

open ↗

Referência

CVE-2026-81813

CVE-2026-81813MEDIUM

Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass

33RISK

open ↗

Referência✓ VexDay Proof

Crea-Book 1.0 - Admin Access Bypass / Database Disclosure / Code Execution

CVE-2007-2000—webappsphp

Multiple SQL injection vulnerabilities in admin/admin.php in Crea-Book 1.0 and earlier allow remote attackers to execute

23RISK

open ↗

Referência

CVE-2026-111955

CVE-2026-111955MEDIUM

WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass

33RISK

open ↗

Referência✓ VexDay Proof

BosClassifieds - 'cat_id' SQL Injection

CVE-2008-6526—webappsphp

SQL injection vulnerability in index.php in BosDev BosClassifieds allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência

CVE-2013-10037

CVE-2013-10037CRITICAL

WebTester 5.x install2.php Unauthenticated Command Execution

68RISK

open ↗

Referência

CVE-2013-10037

CVE-2013-10037CRITICAL

WebTester 5.x install2.php Unauthenticated Command Execution

68RISK

open ↗

Referência

CVE-2019-11374

CVE-2019-11374—

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.

23RISK

open ↗

Referência

CVE-2011-4876

CVE-2011-4876—

Directory traversal vulnerability in HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008;

23RISK

open ↗

Referência

CVE-2013-6231

CVE-2013-6231—

SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script

23RISK

open ↗

Referência

CVE-2019-11932

CVE-2019-11932—

A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version

35RISK

open ↗

Referência

CVE-2009-2891

CVE-2009-2891—

SQL injection vulnerability in list.php in PHP Scripts Now Riddles allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência

CVE-2020-25538

CVE-2020-25538—

An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and r

23RISK

open ↗

Referência

CVE-2022-23626

CVE-2022-23626HIGH

Insufficient file checks in m1k1o/blog

41RISK

open ↗

Referência

CVE-2009-4623

CVE-2009-4623—

Multiple PHP remote file inclusion vulnerabilities in Advanced Comment System 1.0 allow remote attackers to execute arbi

23RISK

open ↗

Referência

CVE-2026-111949

CVE-2026-111949HIGH

miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding

41RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.