Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,902cataloged exploits
34,597CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,624GitHub PoC 13,727VulnCheck XDB 8,410Nuclei 4,231Metasploit 3,467✓ verified onlyrecentpopularrisk
21,624 exploits
Referência
CVE-2025-8730
CVE-2025-8730CRITICAL
Belkin F9K1009/F9K1010 Web Interface hard-coded credentials
48RISK
open ↗
Referência
CVE-2009-4082
CVE-2009-4082—
PHP remote file inclusion vulnerability in forums/Forum_Include/index.php in Outreach Project Tool (OPT) 1.2.7 and earli
23RISK
open ↗
Referência
CVE-2009-4082
CVE-2009-4082—
PHP remote file inclusion vulnerability in forums/Forum_Include/index.php in Outreach Project Tool (OPT) 1.2.7 and earli
23RISK
open ↗
Referência
CVE-2010-1114
CVE-2010-1114—
Multiple PHP remote file inclusion vulnerabilities in Web Server Creator - Web Portal 0.1 allow remote attackers to exec
23RISK
open ↗
Referência
CVE-2019-16197
CVE-2019-16197—
In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document
23RISK
open ↗
Referência
CVE-2010-0975
CVE-2010-0975—
PHP remote file inclusion vulnerability in external.php in PHPCityPortal allows remote attackers to execute arbitrary PH
23RISK
open ↗
Referência
CVE-2010-0975
CVE-2010-0975—
PHP remote file inclusion vulnerability in external.php in PHPCityPortal allows remote attackers to execute arbitrary PH
23RISK
open ↗
Referência
CVE-2010-1703
CVE-2010-1703—
Multiple cross-site scripting (XSS) vulnerabilities in index_search.php in 2daybiz Polls (aka Advanced Poll) Script allo
23RISK
open ↗
Referência
CVE-2010-1703
CVE-2010-1703—
Multiple cross-site scripting (XSS) vulnerabilities in index_search.php in 2daybiz Polls (aka Advanced Poll) Script allo
23RISK
open ↗
Referência
CVE-2015-6541
CVE-2015-6541—
Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) be
23RISK
open ↗
Referência
CVE-2021-4462
CVE-2021-4462CRITICAL
Employee Records System v1.0 Arbitrary File Upload RCE
63RISK
open ↗
Referência
CVE-2010-1921
CVE-2010-1921—
Multiple PHP remote file inclusion vulnerabilities in OpenMairie openAnnuaire 2.00, when register_globals is enabled, al
23RISK
open ↗
Referência
CVE-2010-1921
CVE-2010-1921—
Multiple PHP remote file inclusion vulnerabilities in OpenMairie openAnnuaire 2.00, when register_globals is enabled, al
23RISK
open ↗
Referência✓ VexDay Proof
JulmaCMS 1.4 - 'file.php' Remote File Disclosure
CVE-2007-2324—webappsphp
Directory traversal vulnerability in file.php in JulmaCMS 1.4 allows remote attackers to read arbitrary files via a .. (
23RISK
open ↗
Referência✓ VexDay Proof
Crysis 1.1.1.5879 - Remote Format String Denial of Service (PoC)
CVE-2008-1127—doswindows
Format string vulnerability in the cryactio function in Crysis 1.1.1.5879 allows remote authenticated users to execute a
23RISK
open ↗
Referência✓ VexDay Proof
KISGB (tmp_theme) 5.1.1 - Local File Inclusion
CVE-2008-1635—webappsphp
Directory traversal vulnerability in view_private.php in Keep It Simple Guest Book (KISGB) 5.0.0 and earlier allows remo
23RISK
open ↗
Referência✓ VexDay Proof
Carbon Communities 2.4 - Multiple Vulnerabilities
CVE-2008-1896—webappsasp
Multiple cross-site scripting (XSS) vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to inje
23RISK
open ↗
Referência✓ VexDay Proof
WebSVN 2.0 - Cross-Site Scripting / File Handling / Code Execution
CVE-2008-5920—webappsphp
The create_anchors function in utils.inc in WebSVN 1.x allows remote attackers to execute arbitrary PHP code via a craft
23RISK
open ↗
Referência
CVE-2020-12504
CVE-2020-12504CRITICAL
Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
48RISK
open ↗
Referência
CVE-2020-12504
CVE-2020-12504CRITICAL
Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
48RISK
open ↗
Referência
CVE-2014-1401
CVE-2014-1401—
Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary
23RISK
open ↗
Referência
CVE-2014-1401
CVE-2014-1401—
Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary
23RISK
open ↗
Referência
CVE-2016-5845
CVE-2016-5845—
SAP SAPCAR does not check the return value of file operations when extracting files, which allows remote attackers to ca
23RISK
open ↗
Referência
CVE-2016-5845
CVE-2016-5845—
SAP SAPCAR does not check the return value of file operations when extracting files, which allows remote attackers to ca
23RISK
open ↗
Referência
YouPHPTube 7.2 - 'userCreate.json.php' SQL Injection
CVE-2019-14430—webappsphp
plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection.
23RISK
open ↗
Referência
CVE-2017-6411
CVE-2017-6411—
Cross Site Request Forgery (CSRF) on D-Link DSL-2730U C1 IN_1.00 devices allows remote attackers to change the DNS or fi
23RISK
open ↗
Referência
CVE-2019-6146
CVE-2019-6146—
It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host heade
23RISK
open ↗
Referência✓ VexDay Proof
neuron news 1.0 - 'index.php?q' Local File Inclusion
CVE-2007-5050—webappsphp
Directory traversal vulnerability in index.php in Neuron News 1.0 allows remote attackers to include and execute arbitra
23RISK
open ↗
Referência
CVE-2016-9018
CVE-2016-9018—
Improper handling of a repeating VRAT chunk in qcpfformat.dll allows attackers to cause a Null pointer dereference and c
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke addon Nuke Mobile Entartainment 1.0 - Local File Inclusion
CVE-2007-5069—webappsphp
Directory traversal vulnerability in data/compatible.php in the Nuke Mobile Entertainment 1 addon for PHP-Nuke allows re
23RISK
open ↗
← previouspage 233 / 721next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.