Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,634cataloged exploits

40,286CVEs with public exploitation

24,696lab-tested

All Referência 26,110Exploit-DB 24,488GitHub PoC 17,941VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecent popular risk

26,110 exploits

Referência✓ VexDay Proof

Yerba SACphp 6.3 - Local File Inclusion

CVE-2008-4486—webappsphp

Directory traversal vulnerability in index.php in SAC.php (SACphp), as used in Yerba 6.3 and earlier, allows remote atta

23RISK

open ↗

Referência

CVE-2009-2229

CVE-2009-2229—

Directory traversal vulnerability in engine.php in Kasseler CMS 1.3.5 lite allows remote attackers to read arbitrary fil

23RISK

open ↗

Referência

CVE-2026-9433

CVE-2026-9433CRITICAL

Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection

48RISK

open ↗

Referência

CVE-2015-2183

CVE-2015-2183—

Multiple SQL injection vulnerabilities in the administrative backend in ZeusCart 4 allow remote administrators to execut

23RISK

open ↗

Referência

CVE-2013-3527

CVE-2013-3527—

Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2017-0125

CVE-2017-0125—

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers

28RISK

open ↗

Referência

CVE-2018-10110

CVE-2018-10110—

D-Link DIR-615 T1 devices allow XSS via the Add User feature.

23RISK

open ↗

Referência

CVE-2010-1346

CVE-2010-1346—

SQL injection vulnerability in admin/login.php in Mini CMS RibaFS 1.0, when magic_quotes_gpc is disabled, allows remote

23RISK

open ↗

Referência✓ VexDay Proof

InteliEditor 1.2.x - 'lib.editor.inc.php' Remote File Inclusion

CVE-2006-5527—webappsphp

PHP remote file inclusion vulnerability in lib.editor.inc.php in Intelimen InteliEditor 1.2.x allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

Aigaion 1.2.1 - 'DIR' Remote File Inclusion

CVE-2006-5930—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Aigaion Web based bibliography management system 1.2.1 and earlier

23RISK

open ↗

Referência

CVE-2012-5292

CVE-2012-5292—

Multiple SQL injection vulnerabilities in Atar2b CMS 4.0.1 allow remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência

CVE-2013-3527

CVE-2013-3527—

Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2015-2183

CVE-2015-2183—

Multiple SQL injection vulnerabilities in the administrative backend in ZeusCart 4 allow remote administrators to execut

23RISK

open ↗

Referência✓ VexDay Proof

Xt-Stats 2.4.0.b3 (server_base_dir) - Remote File Inclusion

CVE-2007-0576—webappsphp

PHP remote file inclusion vulnerability in xt_counter.php in Xt-Stats 2.3.x up to 2.4.0.b3 allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component equotes 0.9.4 - SQL Injection

CVE-2008-2628—webappsphp

SQL injection vulnerability in the eQuotes (com_equotes) component 0.9.4 for Joomla! allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

DFF PHP Framework API - 'Data Feed File' Remote File Inclusion

CVE-2008-4502—webappsphp

Multiple PHP remote file inclusion vulnerabilities in DataFeedFile (DFF) PHP Framework API allow remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

e-cart.biz Shopping Cart - Arbitrary File Upload

CVE-2009-1447—webappsphp

Unrestricted file upload vulnerability in admin/editor/image.php in e-cart.biz Free Shopping Cart allows remote attacker

23RISK

open ↗

Referência

CVE-2009-2238

CVE-2009-2238—

Unrestricted file upload vulnerability in includes/shared_scripts/wysiwyg_editor/assetmanager/assetmanager.asp in DMXRea

23RISK

open ↗

Referência

CVE-2017-7447

CVE-2017-7447—

HelpDEZk 1.1.1 has CSRF in admin/home#/logos/ with an impact of remote execution of arbitrary PHP code.

23RISK

open ↗

Referência

CVE-2017-0127

CVE-2017-0127—

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers

28RISK

open ↗

Referência✓ VexDay Proof

Censtore 7.3.x - 'censtore.cgi' Remote Command Execution

CVE-2006-1799—webappscgi

censtore.cgi in Censtore 7.3.002 and earlier allows remote attackers to execute arbitrary commands via shell metacharact

23RISK

open ↗

Referência

CVE-2018-9515

CVE-2018-9515—

In sdcardfs_create and sdcardfs_mkdir of inode.c, there is a possible memory corruption due to improper locking. This co

23RISK

open ↗

Referência✓ VexDay Proof

NoAh 0.9 pre 1.2 - 'filepath' Remote File Disclosure

CVE-2007-6187—webappsphp

Multiple directory traversal vulnerabilities in PHP Content Architect (aka NoAh) 0.9 pre 1.2 and earlier allow remote at

23RISK

open ↗

Referência✓ VexDay Proof

I-Pos Internet Pay Online Store 1.3 Beta - SQL Injection

CVE-2008-2634—webappsasp

SQL injection vulnerability in index.asp in I-Pos Internet Pay Online Store 1.3 Beta and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

asiCMS alpha 0.208 - Multiple Remote File Inclusions

CVE-2008-4529—webappsphp

Multiple PHP remote file inclusion vulnerabilities in asiCMS alpha 0.208 allow remote attackers to execute arbitrary PHP

23RISK

open ↗

Referência

CVE-2014-8677

CVE-2014-8677—

The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and

23RISK

open ↗

Referência

CVE-2014-8677

CVE-2014-8677—

The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and

23RISK

open ↗

Referência

CVE-2017-0128

CVE-2017-0128—

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers

28RISK

open ↗

Referência✓ VexDay Proof

MyKtools 2.4 - Arbitrary Database Backup

CVE-2008-6815—webappsphp

mykdownload.php in MyKtools 2.4 does not require administrative authentication, which allows remote attackers to read a

23RISK

open ↗

Referência✓ VexDay Proof

Rama CMS 0.9.8 - 'download.php' File Disclosure

CVE-2009-1768—webappsphp

Directory traversal vulnerability in download.php in Rama Zaiten CMS 0.9.8 and earlier allows remote attackers to read a

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.