Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,634cataloged exploits
40,286CVEs with public exploitation
24,696lab-tested
AllReferência 26,110Exploit-DB 24,488GitHub PoC 17,941VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,110 exploits
Referência
CVE-2015-2803
CVE-2015-2803—
SQL injection vulnerability in mod1/index.php in the Akronymmanager (sb_akronymmanager) extension before 7.0.0 for TYPO3
23RISK
open ↗
Referência
CVE-2019-19726
CVE-2019-19726—
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be
38RISK
open ↗
Referência
CVE-2019-19726
CVE-2019-19726—
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be
38RISK
open ↗
Referência
CVE-2015-2803
CVE-2015-2803—
SQL injection vulnerability in mod1/index.php in the Akronymmanager (sb_akronymmanager) extension before 7.0.0 for TYPO3
23RISK
open ↗
Referência
CVE-2023-33383
CVE-2023-33383—
Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition t
23RISK
open ↗
Referência✓ VexDay Proof
XAMPP for Windows 1.6.0a - 'mssql_connect()' Remote Buffer Overflow
CVE-2007-2079—remotewindows
The ADONewConnection Connect function in adodb.php in XAMPP 1.6.0a and earlier for Windows uses untrusted input for the
23RISK
open ↗
Referência
CVE-2010-5055
CVE-2010-5055—
SQL injection vulnerability in index.php in Almnzm 2.1 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2012-1049
CVE-2012-1049—
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ADManager Plus 5.2 Build 5210 allow remote attackers
23RISK
open ↗
Referência
CVE-2026-102366
CVE-2026-102366LOW
mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints
28RISK
open ↗
Referência✓ VexDay Proof
OTManager CMS 24a - Local File Inclusion / Cross-Site Scripting
CVE-2008-5201—webappsphp
Directory traversal vulnerability in index.php in OTManager CMS 24a allows remote attackers to include and execute arbit
23RISK
open ↗
Referência
CVE-2013-6872
CVE-2013-6872—
SQL injection vulnerability in managetimetracker.php in Collabtive before 1.2 allows remote authenticated users to execu
23RISK
open ↗
Referência
CVE-2013-6872
CVE-2013-6872—
SQL injection vulnerability in managetimetracker.php in Collabtive before 1.2 allows remote authenticated users to execu
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_hbssearch 1.0 - Blind SQL Injection
CVE-2008-5865—webappsphp
SQL injection vulnerability in the com_hbssearch component 1.0 in the Hotel Booking Reservation System (aka HBS) 1.0.0 f
23RISK
open ↗
Referência
CVE-2009-0760
CVE-2009-0760—
Team Board 1.x and 2.x stores sensitive information under the web root with insufficient access control, which allows re
23RISK
open ↗
Referência
CVE-2010-5055
CVE-2010-5055—
SQL injection vulnerability in index.php in Almnzm 2.1 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2018-8903
CVE-2018-8903—
Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.
23RISK
open ↗
Referência
CVE-2016-2784
CVE-2016-2784—
CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduc
23RISK
open ↗
Referência
CVE-2018-10580
CVE-2018-10580—
The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displ
23RISK
open ↗
Referência
CVE-2018-10580
CVE-2018-10580—
The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displ
23RISK
open ↗
Referência
CVE-2012-10039
CVE-2012-10039CRITICAL
ZEN Load Balancer Filelog Command Execution
63RISK
open ↗
Referência
CVE-2012-10039
CVE-2012-10039CRITICAL
ZEN Load Balancer Filelog Command Execution
63RISK
open ↗
Referência
CVE-2012-10039
CVE-2012-10039CRITICAL
ZEN Load Balancer Filelog Command Execution
63RISK
open ↗
Referência✓ VexDay Proof
RantX 1.0 - Insecure Admin Authentication
CVE-2008-2297—webappsphp
The admin.php file in Rantx allows remote attackers to bypass authentication and gain privileges by setting the logininf
23RISK
open ↗
Referência✓ VexDay Proof
Zomplog 3.8 - 'force_download.php' Remote File Disclosure
CVE-2007-2157—webappsphp
Directory traversal vulnerability in upload/force_download.php in Zomplog 3.8 allows remote attackers to read arbitrary
23RISK
open ↗
Referência
CVE-2025-34049
CVE-2025-34049CRITICAL
OptiLink ONT1GEW GPON Remote Code Execution
48RISK
open ↗
Referência
CVE-2025-34049
CVE-2025-34049CRITICAL
OptiLink ONT1GEW GPON Remote Code Execution
48RISK
open ↗
Referência
CVE-2008-0135
CVE-2008-0135—
Snitz Forums 2000 3.4.06 and earlier stores sensitive information under the web root with insufficient access control, w
23RISK
open ↗
Referência
CVE-2008-4649
CVE-2008-4649—
Session fixation vulnerability in Elxis CMS 2008.1 revision 2204 allows remote attackers to hijack web sessions by setti
23RISK
open ↗
Referência✓ VexDay Proof
Click&Rank - SQL Injection / Cross-Site Scripting
CVE-2008-5888—webappsasp
Multiple SQL injection vulnerabilities in Click&Rank allow remote attackers to execute arbitrary SQL commands via the id
23RISK
open ↗
Referência✓ VexDay Proof
ADN Forum 1.0b - Insecure Cookie Handling
CVE-2008-6001—webappsphp
index.php in ADN Forum 1.0b and earlier allows remote attackers to bypass authentication and gain sysop access via a fpu
23RISK
open ↗
← previouspage 244 / 871next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.