Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,589cataloged exploits

34,508CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,554GitHub PoC 13,689VulnCheck XDB 8,216Nuclei 4,223Metasploit 3,464✓ verified onlyrecent popular risk

21,534 exploits

Referência

CVE-2017-2457

CVE-2017-2457—

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issu

23RISK

open ↗

Referência

CVE-2011-5006

CVE-2011-5006—

Stack-based buffer overflow in QQPlayer 3.2.845 allows remote attackers to execute arbitrary code via a crafted PnSize v

23RISK

open ↗

Referência✓ VexDay Proof

Coppermine Photo Gallery 1.4.18 - Local File Inclusion / Remote Code Execution

CVE-2008-3486—webappsphp

Directory traversal vulnerability in the user_get_profile function in include/functions.inc.php in Coppermine Photo Gall

23RISK

open ↗

Referência

CVE-2010-0763

CVE-2010-0763—

SQL injection vulnerability in index.php in CommodityRentals Vacation Rental Software allows remote attackers to execute

23RISK

open ↗

Referência

CVE-2020-25453

CVE-2020-25453—

An issue was discovered in BlackCat CMS before 1.4. There is a CSRF vulnerability (bypass csrf_token) that allows remote

23RISK

open ↗

Referência

CVE-2010-0764

CVE-2010-0764—

SQL injection vulnerability in index.php in KuwaitPHP eSmile allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência

CVE-2010-0765

CVE-2010-0765—

fipsForum 2.6 stores sensitive information under the web root with insufficient access control, which allows remote atta

23RISK

open ↗

Referência

CVE-2012-4865

CVE-2012-4865—

Buffer overflow in Oreans Themida 2.1.8.0 allows remote attackers to execute arbitrary code via a crafted .TMD file.

23RISK

open ↗

Referência

CVE-2012-4865

CVE-2012-4865—

Buffer overflow in Oreans Themida 2.1.8.0 allows remote attackers to execute arbitrary code via a crafted .TMD file.

23RISK

open ↗

Referência

CVE-2019-3859

CVE-2019-3859CRITICAL

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_req

48RISK

open ↗

Referência

CVE-2025-14558

CVE-2025-14558HIGH

Remote code execution via ND6 Router Advertisements

56RISK

open ↗

Referência

CVE-2018-10018

CVE-2018-10018—

The GDASPAMLib.AntiSpam ActiveX control ASK\GDASpam.dll in G DATA Total Security 25.4.0.3 has a buffer overflow via a lo

23RISK

open ↗

Referência

CVE-2014-10037

CVE-2014-10037—

Directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impact via a ..

43RISK

open ↗

Referência

CVE-2017-2470

CVE-2017-2470—

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS bef

23RISK

open ↗

Referência

CVE-2017-2469

CVE-2017-2469—

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS bef

23RISK

open ↗

Referência

CVE-2021-22911

CVE-2021-22911—

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti

60RISK

open ↗

Referência✓ VexDay Proof

ZZ FlashChat 3.1 - 'help.php' Local File Inclusion

CVE-2007-5620—webappsphp

Directory traversal vulnerability in admin/inc/help.php in ZZ:FlashChat 3.1 and earlier allows remote attackers to inclu

23RISK

open ↗

Referência✓ VexDay Proof

ActualAnalyzer Lite (free) 2.78 - Local File Inclusion

CVE-2008-2076—webappsphp

Directory traversal vulnerability in admin.php in ActualScripts ActualAnalyzer Lite 2.78 allows remote attackers to incl

23RISK

open ↗

Referência✓ VexDay Proof

QNX Neutrino 0.8.4 Atomic Edition - Remote Code Execution

CVE-2008-3150—webappsphp

Directory traversal vulnerability in index.php in Neutrino Atomic Edition 0.8.4 allows remote attackers to read and modi

23RISK

open ↗

Referência✓ VexDay Proof

Yoxel 1.23beta - 'itpm_estimate.php' Remote Code Execution

CVE-2008-5071—webappsphp

Multiple eval injection vulnerabilities in itpm_estimate.php in Yoxel 1.23beta and earlier allow remote authenticated us

23RISK

open ↗

Referência✓ VexDay Proof

LightNEasy 1.2 - no database Remote Hash Retrieve

CVE-2008-6537—webappsphp

LightNEasy/lightneasy.php in LightNEasy No database version 1.2 allows remote attackers to obtain the hash of the admini

23RISK

open ↗

Referência✓ VexDay Proof

phosheezy 2.0 - Remote Command Execution

CVE-2009-0250—webappsphp

Ryneezy phoSheezy 0.2 stores sensitive information under the web root with insufficient access control, which allows rem

23RISK

open ↗

Referência✓ VexDay Proof

Jaws 0.8.8 - Multiple Local File Inclusions

CVE-2009-0645—webappsphp

Directory traversal vulnerability in index.php in Jaws 0.8.8 allows remote authenticated users to read arbitrary files v

23RISK

open ↗

Referência

CVE-2009-4451

CVE-2009-4451—

Unrestricted file upload vulnerability in upper.php in kandalf upper 0.1 allows remote attackers to execute arbitrary co

23RISK

open ↗

Referência

CVE-2009-4819

CVE-2009-4819—

Multiple unrestricted file upload vulnerabilities in upload.php in PHPhotoalbum allow remote attackers to execute arbitr

23RISK

open ↗

Referência

CVE-2023-4173

CVE-2023-4173LOW

mooSocial mooStore index cross site scripting

43RISK

open ↗

Referência

CVE-2010-5028

CVE-2010-5028—

SQL injection vulnerability in the JExtensions JE Job (com_jejob) component 1.0 for Joomla! allows remote attackers to e

38RISK

open ↗

Referência

CVE-2015-1480

CVE-2015-1480—

ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive tic

23RISK

open ↗

Referência

CVE-2015-1480

CVE-2015-1480—

ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive tic

23RISK

open ↗

Referência

CVE-2015-2824

CVE-2015-2824—

Multiple SQL injection vulnerabilities in the Simple Ads Manager plugin before 2.7.97 for WordPress allow remote attacke

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.