Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,634cataloged exploits
40,286CVEs with public exploitation
24,696lab-tested
AllReferência 26,110Exploit-DB 24,488GitHub PoC 17,941VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,110 exploits
Referência✓ VexDay Proof
Camera Life 2.6.2b4 - Arbitrary File Upload
CVE-2008-4366—webappsphp
Unrestricted file upload vulnerability in the image upload component in Camera Life 2.6.2b4 allows remote authenticated
23RISK
open ↗
Referência✓ VexDay Proof
AvailScript Photo Album - 'pics.php' Multiple Vulnerabilities
CVE-2008-4369—webappsphp
SQL injection vulnerability in pics.php in Availscript Photo Album allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_Projectfork 2.0.10 - Local File Inclusion
CVE-2009-2100—webappsphp
Directory traversal vulnerability in the JoomlaPraise Projectfork (com_projectfork) component 2.0.10 for Joomla! allows
38RISK
open ↗
Referência
CVE-2010-1918
CVE-2010-1918—
SQL injection vulnerability in ask_chat.php in eFront 3.6.2 and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2015-6965
CVE-2015-6965—
Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for Wo
23RISK
open ↗
Referência
CVE-2017-5881
CVE-2017-5881—
GOM Player 2.3.10.5266 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspeci
23RISK
open ↗
Referência
CVE-2017-7398
CVE-2017-7398—
D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery (CSRF) vulnerability. This enables an attacke
23RISK
open ↗
Referência
CVE-2012-10046
CVE-2012-10046CRITICAL
E-Mail Security Virtual Appliance learn-msg.cgi Command Injection
63RISK
open ↗
Referência
CVE-2012-10046
CVE-2012-10046CRITICAL
E-Mail Security Virtual Appliance learn-msg.cgi Command Injection
63RISK
open ↗
Referência
CVE-2012-10046
CVE-2012-10046CRITICAL
E-Mail Security Virtual Appliance learn-msg.cgi Command Injection
63RISK
open ↗
Referência✓ VexDay Proof
Simplog 0.9.2 - 's' Remote Command Execution
CVE-2006-0147—webappsphp
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple
28RISK
open ↗
Referência
CVE-2021-3111
CVE-2021-3111—
The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.p
23RISK
open ↗
Referência
CVE-2021-3111
CVE-2021-3111—
The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.p
23RISK
open ↗
Referência
CVE-2009-4385
CVE-2009-4385—
Multiple cross-site request forgery (CSRF) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Anthologia 0.5.2 - 'index.php?ads_file' Remote File Inclusion
CVE-2007-2094—webappsphp
PHP remote file inclusion vulnerability in index.php in Anthologia 0.5.2 allows remote attackers to execute arbitrary PH
23RISK
open ↗
Referência✓ VexDay Proof
PHPMyInventory 2.8 - 'global.inc.php' Remote File Inclusion
CVE-2007-3270—webappsphp
PHP remote file inclusion vulnerability in Includes/global.inc.php in phpMyInventory 2.8 allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2010-1473
CVE-2010-1473—
Directory traversal vulnerability in the Advertising (com_advertising) component 0.25 for Joomla! allows remote attacker
38RISK
open ↗
Referência
CVE-2010-2858
CVE-2010-2858—
Multiple cross-site scripting (XSS) vulnerabilities in news.php in SimpNews 2.47.03 and earlier allow remote attackers t
23RISK
open ↗
Referência
CVE-2010-1473
CVE-2010-1473—
Directory traversal vulnerability in the Advertising (com_advertising) component 0.25 for Joomla! allows remote attacker
38RISK
open ↗
Referência
CVE-2012-0896
CVE-2012-0896—
Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remo
43RISK
open ↗
Referência
CVE-2017-14523
CVE-2017-14523—
WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NO
23RISK
open ↗
Referência
CVE-2008-4141
CVE-2008-4141—
Multiple PHP remote file inclusion vulnerabilities in x10Media x10 Automatic MP3 Script 1.5.5 allow remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Hot Links SQL-PHP 3 - 'report.php' Multiple Vulnerabilities
CVE-2008-4378—webappsphp
SQL injection vulnerability in report.php in Mr. CGI Guy Hot Links SQL-PHP 3.0 and earlier allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
UltraISO 9.3.3.2685 - CCD/IMG Universal Buffer Overflow
CVE-2009-1257—localwindows
Heap-based buffer overflow in Magic ISO Maker 5.5 build 0274 allows remote attackers to cause a denial of service (crash
28RISK
open ↗
Referência
CVE-2009-2325
CVE-2009-2325—
Directory traversal vulnerability in index.php in Clicknet CMS 2.1 allows remote attackers to read arbitrary files via a
23RISK
open ↗
Referência
CVE-2019-16197
CVE-2019-16197—
In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document
23RISK
open ↗
Referência✓ VexDay Proof
WebSVN 2.0 - Cross-Site Scripting / File Handling / Code Execution
CVE-2008-5920—webappsphp
The create_anchors function in utils.inc in WebSVN 1.x allows remote attackers to execute arbitrary PHP code via a craft
23RISK
open ↗
Referência
CVE-2009-4082
CVE-2009-4082—
PHP remote file inclusion vulnerability in forums/Forum_Include/index.php in Outreach Project Tool (OPT) 1.2.7 and earli
23RISK
open ↗
Referência
CVE-2026-114440
CVE-2026-114440MEDIUM
oretnom23 php-travel-agency-system delete.php sql injection
33RISK
open ↗
Referência
CVE-2021-4462
CVE-2021-4462CRITICAL
Employee Records System v1.0 Arbitrary File Upload RCE
63RISK
open ↗
← previouspage 242 / 871next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.