Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
26,041 exploits
Referência
CVE-2012-1010
CVE-2012-1010—
Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote
23RISK
open ↗
Referência
CVE-2026-105992
CVE-2026-105992MEDIUM
Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass
33RISK
open ↗
Referência
CVE-2020-9467
CVE-2020-9467—
Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
28RISK
open ↗
Referência✓ VexDay Proof
Simple PHP Blog 0.4.7.1 - Remote Command Execution
CVE-2006-1243—webappsphp
Directory traversal vulnerability in install05.php in Simple PHP Blog (SPB) 0.4.7.1 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
D-Link DWL-2000AP 2.11 - ARP Flood Remote Denial of Service
CVE-2006-6538—doshardware
D-LINK DWL-2000AP+ firmware 2.11 allows remote attackers to cause (1) a denial of service (device reset) via a flood of
23RISK
open ↗
Referência
CVE-2023-27179
CVE-2023-27179HIGH
GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename paramet
68RISK
open ↗
Referência✓ VexDay Proof
FretsWeb 1.2 - Multiple Local File Inclusions
CVE-2009-2109—webappsphp
Multiple directory traversal vulnerabilities in FretsWeb 1.2 allow remote attackers to read arbitrary files via director
23RISK
open ↗
Referência
CVE-2010-1722
CVE-2010-1722—
Directory traversal vulnerability in the Online Market (com_market) component 2.x for Joomla! allows remote attackers to
38RISK
open ↗
Referência
CVE-2026-103302
CVE-2026-103302MEDIUM
Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret
33RISK
open ↗
Referência
CVE-2010-1365
CVE-2010-1365—
SQL injection vulnerability in index.php in Uiga Fan Club, as downloaded on 20100310, allows remote attackers to execute
23RISK
open ↗
Referência
CVE-2016-10277
CVE-2016-10277—
An elevation of privilege vulnerability in the Motorola bootloader could enable a local malicious application to execute
23RISK
open ↗
Referência
CVE-2018-18793
CVE-2018-18793—
School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos.
23RISK
open ↗
Referência
CVE-2010-1722
CVE-2010-1722—
Directory traversal vulnerability in the Online Market (com_market) component 2.x for Joomla! allows remote attackers to
38RISK
open ↗
Referência
CVE-2017-7041
CVE-2017-7041—
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iClo
23RISK
open ↗
Referência
CVE-2010-1366
CVE-2010-1366—
Multiple SQL injection vulnerabilities in admin/admin_login.php in Uiga Fan Club 1.0 and earlier allow remote attackers
23RISK
open ↗
Referência
CVE-2010-3314
CVE-2010-3314—
Cross-site scripting (XSS) vulnerability in login.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versio
23RISK
open ↗
Referência
CVE-2026-102499
CVE-2026-102499HIGH
Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action
41RISK
open ↗
Referência
CVE-2010-4954
CVE-2010-4954—
SQL injection vulnerability in product_reviews_info.php in xt:Commerce Gambio 2008 allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2018-18793
CVE-2018-18793—
School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos.
23RISK
open ↗
Referência
CVE-2023-27179
CVE-2023-27179HIGH
GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename paramet
68RISK
open ↗
Referência
CVE-2026-100145
CVE-2026-100145MEDIUM
Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route
33RISK
open ↗
Referência✓ VexDay Proof
HSRS 1.0 - 'addcode.php' Remote File Inclusion
CVE-2006-6154—webappsphp
PHP remote file inclusion vulnerability in addcode.php in HIOX Star Rating System Script (HSRS) 1.0 and earlier allows r
23RISK
open ↗
Referência
CVE-2017-15965
CVE-2017-15965—
The NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in
23RISK
open ↗
Referência
CVE-2016-4309
CVE-2016-4309—
Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is disabled, allows remote attackers
28RISK
open ↗
Referência
CVE-2026-109526
CVE-2026-109526MEDIUM
HBAI-Ltd Toonflow-app exportData Endpoint information disclosure
33RISK
open ↗
Referência
CVE-2011-4715
CVE-2011-4715—
Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime
23RISK
open ↗
Referência
CVE-2017-6553
CVE-2017-6553—
Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows remote attackers to obtain full
50RISK
open ↗
Referência
CVE-2012-6050
CVE-2012-6050—
The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consu
23RISK
open ↗
Referência
CVE-2013-7280
CVE-2013-7280—
Buffer overflow in HansoTools Hanso Player 2.1.0, 2.5.0, and earlier allows remote attackers to cause a denial of servic
23RISK
open ↗
Referência
CVE-2009-2535
CVE-2009-2535—
Mozilla Firefox before 2.0.0.19 and 3.x before 3.0.5, SeaMonkey, and Thunderbird allow remote attackers to cause a denia
23RISK
open ↗
← previouspage 163 / 869next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.