Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,390cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,992Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
26,070 exploits
Referência
CVE-2017-2362
CVE-2017-2362—
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS
23RISK
open ↗
Referência✓ VexDay Proof
Goople 1.8.2 - 'FrontPage.php' Blind SQL Injection
CVE-2009-0111—webappsphp
SQL injection vulnerability in frontpage.php in Goople CMS 1.8.2 and earlier allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2014-2341
CVE-2014-2341—
Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID
23RISK
open ↗
Referência
CVE-2017-13783
CVE-2017-13783—
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Referência
CVE-2018-10260
CVE-2018-10260—
A Local File Inclusion vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user.
23RISK
open ↗
Referência
CVE-2018-10757
CVE-2018-10757—
CSP MySQL User Manager 2.3.1 allows SQL injection, and resultant Authentication Bypass, via a crafted username during a
23RISK
open ↗
Referência
CVE-2015-2292
CVE-2015-2292—
Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin be
23RISK
open ↗
Referência
CVE-2010-2315
CVE-2010-2315—
PHP remote file inclusion vulnerability in picturelib.php in SmartISoft phpBazar 2.1.1 allows remote attackers to execut
23RISK
open ↗
Referência
CVE-2009-3541
CVE-2009-3541—
PHP remote file inclusion vulnerability in CoupleDB.php in PHPGenealogy 2.0 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2018-10757
CVE-2018-10757—
CSP MySQL User Manager 2.3.1 allows SQL injection, and resultant Authentication Bypass, via a crafted username during a
23RISK
open ↗
Referência
CVE-2026-96227
CVE-2026-96227HIGH
Piotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File Upload
41RISK
open ↗
Referência
CVE-2021-24275
CVE-2021-24275—
Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS)
43RISK
open ↗
Referência
CVE-2010-4365
CVE-2010-4365—
SQL injection vulnerability in JE Ajax Event Calendar (com_jeajaxeventcalendar) component for Joomla! allows remote atta
23RISK
open ↗
Referência
CVE-2017-13796
CVE-2017-13796—
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Referência
CVE-2026-89305
CVE-2026-89305MEDIUM
Paymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' Parameter
33RISK
open ↗
Referência
CVE-2018-10260
CVE-2018-10260—
A Local File Inclusion vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user.
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Internet Explorer 6 / Provideo Camimage - 'ISSCamControl.dll 1.0.1.5' Remote Buffer Overflow
CVE-2007-3111—remotewindows
Buffer overflow in the Provideo Camimage ActiveX control in ISSCamControl.dll 1.0.1.5, when Internet Explorer 6 is used
35RISK
open ↗
Referência
CVE-2010-4480
CVE-2010-4480—
error.php in PhpMyAdmin 3.3.8.1, and other versions before 3.4.0-beta1, allows remote attackers to conduct cross-site sc
23RISK
open ↗
Referência
CVE-2012-1297
CVE-2012-1297—
Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier
23RISK
open ↗
Referência✓ VexDay Proof
AsteriDex 3.0 - 'callboth.php' Remote Code Execution
CVE-2007-3621—webappsphp
Multiple CRLF injection vulnerabilities in callboth.php in AsteriDex 3.0 and earlier allow remote attackers to inject ar
23RISK
open ↗
Referência
CVE-2014-0620
CVE-2014-0620—
Multiple cross-site scripting (XSS) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote att
23RISK
open ↗
Referência
CVE-2017-13784
CVE-2017-13784—
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Referência
CVE-2026-108540
CVE-2026-108540CRITICAL
OpenSpug File Transfer transfer os command injection
48RISK
open ↗
Referência
CVE-2013-5692
CVE-2013-5692—
Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and
23RISK
open ↗
Referência
CVE-2014-4311
CVE-2014-4311—
Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allows attackers to obtain the (1) Database Connection and (2) E-mai
23RISK
open ↗
Referência
CVE-2022-26982
CVE-2022-26982—
SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting
23RISK
open ↗
Referência
CVE-2009-3338
CVE-2009-3338—
Stack-based buffer overflow in EffectMatrix (E.M.) Magic Morph 1.95b allows remote attackers to execute arbitrary code v
23RISK
open ↗
Referência✓ VexDay Proof
TUTOS 1.3 - 'cmd.php' Remote Command Execution
CVE-2008-0148—webappsphp
TUTOS 1.3 does not restrict access to php/admin/cmd.php, which allows remote attackers to execute arbitrary shell comman
23RISK
open ↗
Referência
CVE-2012-4751
CVE-2012-4751—
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x befor
23RISK
open ↗
Referência
CVE-2009-4964
CVE-2009-4964—
Stack-based buffer overflow in KSP 2006 FINAL allows remote attackers to execute arbitrary code via a long string in a .
23RISK
open ↗
← previouspage 197 / 869next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.