Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,378cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,752VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
26,070 exploits
Referência✓ VexDay Proof
Mambo Component CopperminePhotoGalery - Remote File Inclusion
CVE-2006-4321—webappsphp
PHP remote file inclusion vulnerability in cpg.php in the Coppermine Photo Gallery component (com_cpg) 1.0 and earlier f
23RISK
open ↗
Referência
CVE-2021-28417
CVE-2021-28417—
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and t
23RISK
open ↗
Referência
CVE-2021-43405
CVE-2021-43405—
An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained t
35RISK
open ↗
Referência✓ VexDay Proof
SFS Ez Forum - SQL Injection
CVE-2008-4754—webappsphp
SQL injection vulnerability in forum.php in Scripts for Sites (SFS) Ez Forum allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2010-4990
CVE-2010-4990—
SQL injection vulnerability in the Front-edit Address Book (com_addressbook) component for Joomla! allows remote attacke
23RISK
open ↗
Referência
CVE-2010-4993
CVE-2010-4993—
SQL injection vulnerability in the eventcal (com_eventcal) component 1.6.4 for Joomla! allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
PollHelper - Remote Configuration File Disclosure
CVE-2009-0827—webappsphp
PollHelper stores poll.inc under the web root with insufficient access control, which allows remote attackers to downloa
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Fusion Mod Members CV (job) 1.0 - SQL Injection
CVE-2009-0831—webappsphp
SQL injection vulnerability in members.php in the Members CV (job) module 1.0 for PHP-Fusion, when magic_quotes_gpc is d
23RISK
open ↗
Referência
CVE-2026-16066
CVE-2026-16066MEDIUM
Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name
33RISK
open ↗
Referência
CVE-2010-4993
CVE-2010-4993—
SQL injection vulnerability in the eventcal (com_eventcal) component 1.6.4 for Joomla! allows remote attackers to execut
23RISK
open ↗
Referência
CVE-2010-2154
CVE-2010-2154—
Cross-site scripting (XSS) vulnerability in the Search Site in CMScout 2.09, and possibly other versions, allows remote
23RISK
open ↗
Referência
CVE-2010-2313
CVE-2010-2313—
Directory traversal vulnerability in index.php in Anodyne Productions SIMM Management System (SMS) 2.6.10, when magic_qu
23RISK
open ↗
Referência
CVE-2010-4987
CVE-2010-4987—
SQL injection vulnerability in default.asp in KMSoft Guestbook (aka GBook) allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2013-0657
CVE-2013-0657—
Stack-based buffer overflow in Schneider Electric Interactive Graphical SCADA System (IGSS) 10 and earlier allows remote
28RISK
open ↗
Referência✓ VexDay Proof
Mercur IMAPD 5.00.14 (Windows x86) - Remote Denial of Service
CVE-2007-1578—doswindows_x86
Multiple integer signedness errors in the NTLM implementation in Atrium MERCUR IMAPD (mcrimap4.exe) 5.00.14, with SP4, a
28RISK
open ↗
Referência
CVE-2013-0662
CVE-2013-0662—
Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow
28RISK
open ↗
Referência
CVE-2013-0662
CVE-2013-0662—
Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow
28RISK
open ↗
Referência
CVE-2025-15697
CVE-2025-15697HIGH
Dictionary <= 1.0 - Reflected XSS via Multiple Parameters
41RISK
open ↗
Referência
CVE-2026-86216
CVE-2026-86216MEDIUM
code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-19955
CVE-2026-19955MEDIUM
TrailDB TOC Validation tdb.c tdb_open out-of-bounds
33RISK
open ↗
Referência
CVE-2026-19811
CVE-2026-19811HIGH
TOTOLINK A800R firewall.so cstecgi.cgi setIpQosRules stack-based overflow
41RISK
open ↗
Referência
CVE-2018-10257
CVE-2018-10257—
A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privile
23RISK
open ↗
Referência
CVE-2018-14327
CVE-2018-14327—
The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before
23RISK
open ↗
Referência
CVE-2026-92475
CVE-2026-92475MEDIUM
GPAC downloader.c wait_for_header_and_parse out-of-bounds
33RISK
open ↗
Referência
CVE-2021-28418
CVE-2021-28418—
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and
23RISK
open ↗
Referência
CVE-2017-2533
CVE-2017-2533—
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "DiskArbitra
23RISK
open ↗
Referência
CVE-2023-23163
CVE-2023-23163—
Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the editid parame
23RISK
open ↗
Referência
CVE-2018-14327
CVE-2018-14327—
The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before
23RISK
open ↗
Referência✓ VexDay Proof
S-CMS 1.1 Stable - Insecure Cookie Handling / Mass Page Delete
CVE-2009-0864—webappsphp
S-Cms 1.1 Stable allows remote attackers to bypass authentication and obtain administrative access via an OK value for t
23RISK
open ↗
Referência
CVE-2013-1408
CVE-2013-1408—
Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenti
23RISK
open ↗
← previouspage 181 / 869next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.