Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,634cataloged exploits
40,286CVEs with public exploitation
24,696lab-tested
AllReferência 26,110Exploit-DB 24,488GitHub PoC 17,941VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,110 exploits
Referência
CVE-2019-3999
CVE-2019-3999—
Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, u
38RISK
open ↗
Referência
CVE-2026-101105
CVE-2026-101105MEDIUM
code-projects Matrimonial System Profile Creation Endpoint create_profile processprofile_form sql injection
33RISK
open ↗
Referência
CVE-2026-81742
CVE-2026-81742HIGH
BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation
41RISK
open ↗
Referência✓ VexDay Proof
Cahier de texte 2.2 - Bypass General Access Protection
CVE-2006-6849—webappsphp
administration/index.php in Cahier de texte (CDT) 2.2 does not properly exit when authentication fails, which allows rem
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows - GDI+ '.ICO' File Remote Denial of Service
CVE-2007-2237—doswindows
Microsoft Windows Graphics Device Interface (GDI+, GdiPlus.dll) allows context-dependent attackers to cause a denial of
28RISK
open ↗
Referência✓ VexDay Proof
Flat PHP Board 1.2 - Multiple Vulnerabilities
CVE-2007-6396—webappsphp
Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inj
23RISK
open ↗
Referência
CVE-2015-1400
CVE-2015-1400—
SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
X7 Chat 2.0.5 - 'day' SQL Injection
CVE-2008-0278—webappsphp
SQL injection vulnerability in index.php in X7 Chat 2.0.5 and possibly earlier allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal (PoC)
CVE-2008-2938—remotemultiple
Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16,
60RISK
open ↗
Referência
CVE-2012-1027
CVE-2012-1027—
Cross-site scripting (XSS) vulnerability in account-closed.tcl in ]project-open[ (aka ]po[) 3.4.x, 3.5.0.1-2, and possib
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component JoomlaDate 1.2 - 'user' SQL Injection
CVE-2008-6068—webappsphp
SQL injection vulnerability in the JoomlaDate (com_joomladate) component 1.2 for Joomla! allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2015-4137
CVE-2015-4137—
SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2015-6827
CVE-2015-6827—
Cross-site request forgery (CSRF) vulnerability in Auto-Exchanger 5.1.0 allows remote attackers to hijack the authentica
23RISK
open ↗
Referência
CVE-2018-6563
CVE-2018-6563—
Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow
23RISK
open ↗
Referência
CVE-2018-6563
CVE-2018-6563—
Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow
23RISK
open ↗
Referência
CVE-2012-4871
CVE-2012-4871—
Cross-site scripting (XSS) vulnerability in service/graph_html.php in the administrator panel in LiteSpeed Web Server 4.
23RISK
open ↗
Referência
CVE-2014-9096
CVE-2014-9096—
Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute a
23RISK
open ↗
Referência
CVE-2015-1476
CVE-2015-1476—
Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência
CVE-2015-1476
CVE-2015-1476—
Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência
CVE-2015-2070
CVE-2015-2070—
SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2015-2070
CVE-2015-2070—
SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2017-11914
CVE-2017-11914—
ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain t
35RISK
open ↗
Referência
CVE-2015-6923
CVE-2015-6923—
The ndvbs module in VBox Communications Satellite Express Protocol 2.3.17.3 allows local users to write to arbitrary phy
23RISK
open ↗
Referência
CVE-2015-7084
CVE-2015-7084—
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to g
23RISK
open ↗
Referência✓ VexDay Proof
CreaDirectory 1.2 - 'error.asp?id' SQL Injection
CVE-2007-2342—webappsasp
SQL injection vulnerability in error.asp in CreaScripts CreaDirectory 1.2 allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
WebBiscuits Modules Controller 1.1 - Remote File Inclusion / Remote File Disclosure
CVE-2008-6138—webappsphp
PHP remote file inclusion vulnerability in adminhead.php in WebBiscuits Modules Controller 1.1 and earlier allows remote
23RISK
open ↗
Referência
CVE-2010-4918
CVE-2010-4918—
PHP remote file inclusion vulnerability in iJoomla Magazine (com_magazine) component 3.0.1 for Joomla! allows remote att
23RISK
open ↗
Referência
CVE-2010-4918
CVE-2010-4918—
PHP remote file inclusion vulnerability in iJoomla Magazine (com_magazine) component 3.0.1 for Joomla! allows remote att
23RISK
open ↗
Referência
CVE-2012-1912
CVE-2012-1912—
Cross-site scripting (XSS) vulnerability in preferences.php in PHP Address Book 7.0 and earlier allows remote attackers
23RISK
open ↗
Referência
CVE-2026-81431
CVE-2026-81431HIGH
Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id
41RISK
open ↗
← previouspage 243 / 871next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.