Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,508cataloged exploits

40,258CVEs with public exploitation

24,696lab-tested

All Referência 26,095Exploit-DB 24,488GitHub PoC 17,831VulnCheck XDB 10,015Nuclei 4,547Metasploit 3,532✓ verified onlyrecent popular risk

26,095 exploits

Referência

CVE-2017-11914

CVE-2017-11914—

ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain t

35RISK

open ↗

Referência

CVE-2018-6563

CVE-2018-6563—

Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow

23RISK

open ↗

Referência

CVE-2018-6563

CVE-2018-6563—

Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow

23RISK

open ↗

Referência

CVE-2015-2070

CVE-2015-2070—

SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitra

23RISK

open ↗

Referência

CVE-2015-2070

CVE-2015-2070—

SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitra

23RISK

open ↗

Referência

CVE-2015-7084

CVE-2015-7084—

The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to g

23RISK

open ↗

Referência

CVE-2026-81431

CVE-2026-81431HIGH

Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

41RISK

open ↗

Referência✓ VexDay Proof

WebBiscuits Modules Controller 1.1 - Remote File Inclusion / Remote File Disclosure

CVE-2008-6138—webappsphp

PHP remote file inclusion vulnerability in adminhead.php in WebBiscuits Modules Controller 1.1 and earlier allows remote

23RISK

open ↗

Referência

CVE-2010-0966

CVE-2010-0966—

PHP remote file inclusion vulnerability in inc/config.php in deV!L`z Clanportal (DZCP) 1.5.2, when register_globals is e

23RISK

open ↗

Referência

CVE-2010-1066

CVE-2010-1066—

AR Web Content Manager (AWCM) 2.1 stores sensitive information under the web root with insufficient access control, whic

23RISK

open ↗

Referência

CVE-2010-4918

CVE-2010-4918—

PHP remote file inclusion vulnerability in iJoomla Magazine (com_magazine) component 3.0.1 for Joomla! allows remote att

23RISK

open ↗

Referência

CVE-2010-4918

CVE-2010-4918—

PHP remote file inclusion vulnerability in iJoomla Magazine (com_magazine) component 3.0.1 for Joomla! allows remote att

23RISK

open ↗

Referência✓ VexDay Proof

CreaDirectory 1.2 - 'error.asp?id' SQL Injection

CVE-2007-2342—webappsasp

SQL injection vulnerability in error.asp in CreaScripts CreaDirectory 1.2 allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência

CVE-2015-1467

CVE-2015-1467—

Multiple SQL injection vulnerabilities in Translations in Fork CMS before 3.8.6 allow remote authenticated users to exec

23RISK

open ↗

Referência

CVE-2015-6805

CVE-2015-6805—

Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticat

23RISK

open ↗

Referência✓ VexDay Proof

MODx CMS 0.9.6.2 - Remote File Inclusion / Cross-Site Scripting

CVE-2008-5938—webappsphp

PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier,

23RISK

open ↗

Referência

CVE-2015-7258

CVE-2015-7258—

ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain

28RISK

open ↗

Referência✓ VexDay Proof

miniPortail 2.2 - Cross-Site Scripting / Local File Inclusion

CVE-2008-6167—webappsphp

Directory traversal vulnerability in search.php in miniPortail 2.2 and earlier allows remote attackers to include and ex

23RISK

open ↗

Referência

CVE-2017-6982

CVE-2017-6982—

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. The issue involves the "Notifications"

23RISK

open ↗

Referência

CVE-2017-9418

CVE-2017-9418—

SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute ar

23RISK

open ↗

Referência

CVE-2018-0821

CVE-2018-0821—

AppContainer in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows

23RISK

open ↗

Referência

CVE-2022-23046

CVE-2022-23046—

PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a su

28RISK

open ↗

Referência

CVE-2026-78361

CVE-2026-78361CRITICAL

zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion

48RISK

open ↗

Referência✓ VexDay Proof

AJSquare Free Polling Script - 'DB' Multiple Vulnerabilities

CVE-2008-7045—webappsphp

AJ Square Free Polling Script (AJPoll) Database version allows remote attackers to bypass authentication and reset poll

23RISK

open ↗

Referência✓ VexDay Proof

PHPortal 1.0 - Insecure Cookie Handling

CVE-2009-2117—webappsphp

uye_paneli.php in phPortal 1.0 allows remote attackers to bypass authentication and obtain administrative access by sett

23RISK

open ↗

Referência

CVE-2010-0983

CVE-2010-0983—

PHP remote file inclusion vulnerability in include/mail.inc.php in Rezervi 3.0.2 and earlier, when register_globals is e

23RISK

open ↗

Referência

CVE-2010-0983

CVE-2010-0983—

PHP remote file inclusion vulnerability in include/mail.inc.php in Rezervi 3.0.2 and earlier, when register_globals is e

23RISK

open ↗

Referência

CVE-2010-1066

CVE-2010-1066—

AR Web Content Manager (AWCM) 2.1 stores sensitive information under the web root with insufficient access control, whic

23RISK

open ↗

Referência

CVE-2010-2685

CVE-2010-2685—

siteadmin/adduser.php in Customer Paradigm PageDirector CMS does not properly restrict access, which allows remote attac

23RISK

open ↗

Referência

CVE-2010-2685

CVE-2010-2685—

siteadmin/adduser.php in Customer Paradigm PageDirector CMS does not properly restrict access, which allows remote attac

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.