Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,949cataloged exploits

34,636CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,662GitHub PoC 13,734VulnCheck XDB 8,410Nuclei 4,233Metasploit 3,467✓ verified onlyrecent popular risk

21,624 exploits

Referência

CVE-2014-9412

CVE-2014-9412—

Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers

23RISK

open ↗

Referência

CVE-2021-47963

CVE-2021-47963MEDIUM

Anote 1.0 Persistent Cross-Site Scripting Leading to Code Execution

33RISK

open ↗

Referência✓ VexDay Proof

March Networks DVR 3204 - Logfile Information Disclosure

CVE-2007-6638—remotehardware

March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows r

28RISK

open ↗

Referência

CVE-2014-7200

CVE-2014-7200—

Cross-site scripting (XSS) vulnerability in pi1/class.tx_dmmjobcontrol_pi1.php in the JobControl (dmmjobcontrol) extensi

23RISK

open ↗

Referência

CVE-2012-6505

CVE-2012-6505—

Cross-site scripting (XSS) vulnerability in mods/hours/data/get_hours.php in PHP Volunteer Management 1.0.2 allows remot

23RISK

open ↗

Referência

CVE-2017-16951

CVE-2017-16951—

Winamp Pro 5.66 Build 3512 allows remote attackers to cause a denial of service via a crafted WAV, WMV, AU, ASF, AIFF, o

23RISK

open ↗

Referência

CVE-2017-3133

CVE-2017-3133—

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthor

43RISK

open ↗

Referência

CVE-2014-3974

CVE-2014-3974—

Cross-site scripting (XSS) vulnerability in filemanager.php in AuraCMS 3.0 and earlier allows remote attackers to inject

23RISK

open ↗

Referência

CVE-2014-3974

CVE-2014-3974—

Cross-site scripting (XSS) vulnerability in filemanager.php in AuraCMS 3.0 and earlier allows remote attackers to inject

23RISK

open ↗

Referência

CVE-2012-2584

CVE-2012-2584—

Multiple cross-site scripting (XSS) vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitr

23RISK

open ↗

Referência

CVE-2013-5693

CVE-2013-5693—

Cross-site scripting (XSS) vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web sc

23RISK

open ↗

Referência

CVE-2020-29395

CVE-2020-29395—

The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field.

43RISK

open ↗

Referência✓ VexDay Proof

Mambo Component com_videodb 0.3en - Remote File Inclusion

CVE-2006-3736—webappsphp

PHP remote file inclusion vulnerability in core/videodb.class.xml.php in the VideoDB component for Mambo 0.3 and earlier

23RISK

open ↗

Referência

CVE-2017-6506

CVE-2017-6506—

In Azure Data Expert Ultimate 2.2.16, the SMTP verification function suffers from a buffer overflow vulnerability, leadi

28RISK

open ↗

Referência

CVE-2009-4672

CVE-2009-4672—

Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to incl

23RISK

open ↗

Referência

CVE-2017-6506

CVE-2017-6506—

In Azure Data Expert Ultimate 2.2.16, the SMTP verification function suffers from a buffer overflow vulnerability, leadi

28RISK

open ↗

Referência✓ VexDay Proof

PHP-revista 1.1.2 - Remote File Inclusion / SQL Injection / Authentication Bypass / Cross-Site Scripting

CVE-2006-4608—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in Longino Jacome php-Revista 1.1.2 allow remote attackers to inject

23RISK

open ↗

Referência✓ VexDay Proof

CMSmelborp Beta - 'user_standard.php' Remote File Inclusion

CVE-2006-7185—webappsphp

PHP remote file inclusion vulnerability in includes/user_standard.php in CMSmelborp Beta allows remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

FlashGameScript 1.5.4 - 'index.php?func' Remote File Inclusion

CVE-2007-1078—webappsphp

PHP remote file inclusion vulnerability in index.php in FlashGameScript 1.5.4 allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

Integramod 1.4.x - Insecure Directory Download Database

CVE-2008-4183—webappsphp

IntegraMOD 1.4.x stores sensitive information under the web root with insufficient access control, which allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

Imera ImeraIEPlugin - ActiveX Control Remote Code Execution

CVE-2009-0813—remotewindows

Insecure method vulnerability in the ImeraIEPlugin ActiveX control (ImeraIEPlugin.dll 1.0.2.54) in Imera TeamLinks Clien

23RISK

open ↗

Referência

CVE-2025-14535

CVE-2025-14535CRITICAL

UTT 进取 512W formConfigFastDirectionW strcpy buffer overflow

48RISK

open ↗

Referência

CVE-2020-28413

CVE-2020-28413MEDIUM

In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the A

33RISK

open ↗

Referência

CVE-2022-31325

CVE-2022-31325—

There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.

23RISK

open ↗

Referência

CVE-2014-1841

CVE-2014-1841—

Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attacke

38RISK

open ↗

Referência

CVE-2010-1296

CVE-2010-1296—

Multiple buffer overflows in Adobe Photoshop CS4 before 11.0.2 allow user-assisted remote attackers to execute arbitrary

28RISK

open ↗

Referência

CVE-2013-3242

CVE-2013-3242—

plugins/system/remember/remember.php in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 does not properly handle an o

23RISK

open ↗

Referência

CVE-2010-2857

CVE-2010-2857—

Directory traversal vulnerability in the Music Manager component for Joomla! allows remote attackers to read arbitrary f

38RISK

open ↗

Referência

CVE-2010-2857

CVE-2010-2857—

Directory traversal vulnerability in the Music Manager component for Joomla! allows remote attackers to read arbitrary f

38RISK

open ↗

Referência

CVE-2010-2680

CVE-2010-2680—

Directory traversal vulnerability in the JExtensions JE Section/Property Finder (jesectionfinder) component for Joomla!

38RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.