Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,186cataloged exploits

40,156CVEs with public exploitation

24,696lab-tested

All Referência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecent popular risk

26,041 exploits

Referência

CVE-2026-103324

CVE-2026-103324MEDIUM

Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret

33RISK

open ↗

Referência

CVE-2013-7204

CVE-2013-7204—

Cross-site request forgery (CSRF) vulnerability in set_users.cgi in Conceptronic CIPCAMPTIWL Camera 1.0 with firmware 21

28RISK

open ↗

Referência

CVE-2009-4826

CVE-2009-4826—

Cross-site request forgery (CSRF) vulnerability in hosting/admin_ac.php in ScriptsEz Mini Hosting Panel allows remote at

23RISK

open ↗

Referência

CVE-2016-2819

CVE-2016-2819—

Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to ex

28RISK

open ↗

Referência

CVE-2018-6223

CVE-2018-6223—

A missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allo

28RISK

open ↗

Referência✓ VexDay Proof

Fastpublish CMS 1.9999 - config[fsBase] Remote File Inclusion

CVE-2007-6325—webappsphp

PHP remote file inclusion vulnerability in adminbereich/designconfig.php in Fastpublish CMS 1.9999 allows remote attacke

28RISK

open ↗

Referência✓ VexDay Proof

jetAudio 7.0.5 - '.asx' Remote Stack Overflow (PoC)

CVE-2008-0747—doswindows

Stack-based buffer overflow in COWON America jetAudio 7.0.5 and earlier allows user-assisted remote attackers to execute

23RISK

open ↗

Referência

CVE-2010-2845

CVE-2010-2845—

SQL injection vulnerability in the QuickFAQ (com_quickfaq) component 1.0.3 for Joomla! allows remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

Ol BookMarks Manager 0.7.5 - Local File Inclusion

CVE-2008-6410—webappsphp

Directory traversal vulnerability in show.php in ol'bookmarks manager 0.7.5 and earlier allows remote attackers to inclu

23RISK

open ↗

Referência

CVE-2012-6499

CVE-2012-6499—

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows

43RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component NeoGallery 1.1 - SQL Injection

CVE-2008-0752—webappsphp

SQL injection vulnerability in index.php in the Neogallery (com_neogallery) 1.1 component for Joomla! allows remote atta

23RISK

open ↗

Referência

CVE-2015-5149

CVE-2015-5149—

Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to writ

28RISK

open ↗

Referência

CVE-2015-5149

CVE-2015-5149—

Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to writ

28RISK

open ↗

Referência

CVE-2017-15878

CVE-2017-15878—

A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-be

23RISK

open ↗

Referência

CVE-2017-15878

CVE-2017-15878—

A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-be

23RISK

open ↗

Referência

CVE-2018-15685

CVE-2018-15685—

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindow

28RISK

open ↗

Referência

CVE-2018-5430

CVE-2018-5430HIGHunder attack

TIBCO JasperReports Server Information Disclosure Vulnerability

83RISK

open ↗

Referência

CVE-2018-6220

CVE-2018-6220—

An arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arbi

23RISK

open ↗

Referência

CVE-2013-5576

CVE-2013-5576—

administrator/components/com_media/helpers/media.php in the media manager in Joomla! 2.5.x before 2.5.14 and 3.x before

50RISK

open ↗

Referência✓ VexDay Proof

BloofoxCMS 0.3.4 - 'lang' Local File Inclusion

CVE-2008-5748—webappsphp

Directory traversal vulnerability in plugins/spaw2/dialogs/dialog.php in BloofoxCMS 0.3.4 allows remote attackers to rea

28RISK

open ↗

Referência✓ VexDay Proof

ComicShout 2.8 - 'news_id' SQL Injection

CVE-2008-6425—webappsphp

SQL injection vulnerability in news.php in ComicShout 2.8 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

VUPlayer 2.49 - '.pls' Universal Buffer Overflow

CVE-2009-0182—localwindows

Buffer overflow in VUPlayer 2.49 and earlier allows user-assisted attackers to execute arbitrary code via a long URL in

50RISK

open ↗

Referência✓ VexDay Proof

AIMP 2.51 build 330 - ID3v1/ID3v2 Tag Remote Stack Buffer Overflow (PoC) (SEH)

CVE-2009-1944—doswindows

Stack-based buffer overflow in AIMP 2.51 build 330 allows remote attackers to execute arbitrary code via an MP3 file wit

28RISK

open ↗

Referência

CVE-2009-4663

CVE-2009-4663—

Heap-based buffer overflow in the Quiksoft EasyMail Objects 6 ActiveX control allows remote attackers to execute arbitra

28RISK

open ↗

Referência

CVE-2010-2623

CVE-2010-2623—

SQL injection vulnerability in pages.php in Internet DM Specialist Bed and Breakfast allows remote attackers to execute

23RISK

open ↗

Referência

CVE-2010-4151

CVE-2010-4151—

SQL injection vulnerability in misc.php in DeluxeBB 1.3, and possibly earlier, when magic_quotes_gpc is disabled, allows

23RISK

open ↗

Referência

CVE-2020-6857

CVE-2020-6857—

CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FT

23RISK

open ↗

Referência

CVE-2011-3981

CVE-2011-3981—

PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attac

28RISK

open ↗

Referência

CVE-2017-8770

CVE-2017-8770—

There is LFD (local file disclosure) on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesys

28RISK

open ↗

Referência✓ VexDay Proof

e107 Plugin BLOG Engine 2.2 - 'uid' SQL Injection

CVE-2008-6438—webappsphp

SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows re

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.