Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,150 exploits
Referência
CVE-2010-4145
Kisisel Radyo Script stores sensitive information under the web root with insufficient access control, which allows remo
23RISK
open ↗Referência
CVE-2012-5917
SnackAmp 3.1.3 allows remote attackers to cause a denial of service (application crash) via a long string in an aiff fil
23RISK
open ↗Referência✓ VexDay Proof
Mini Blog 1.0.1 - 'index.php' Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in index.php in Mini Blog 1.0.1 allow remote attackers to include and execu
23RISK
open ↗Referência✓ VexDay Proof
Konqueror 3.5.9 - 'color'/'bgcolor' Multiple Remote Crash Vulnerabilities
The HTML parser in KDE Konqueror 3.5.9 allows remote attackers to cause a denial of service (application crash) via (1)
23RISK
open ↗Referência
CVE-2009-4319
PHP remote file inclusion vulnerability in js/bbcodepress/bbcode-form.php in eoCMS 0.9.03 and earlier, when register_glo
23RISK
open ↗Referência
CVE-2026-14622
jairiidriss restaurant-website-php-mysql AJAX Endpoint ajax_files missing authentication
33RISK
open ↗Referência
CVE-2026-14619
itsourcecode Hospital Management System medicine.php sql injection
33RISK
open ↗Referência✓ VexDay Proof
AJ Auction - Authentication Bypass
AJ Square AJ Auction Pro Platinum Skin #1 sends a redirect but does not exit when it is called directly, which allows re
23RISK
open ↗Referência
CVE-2009-4118
The StartServiceCtrlDispatcher function in the cvpnd service (cvpnd.exe) in Cisco VPN client for Windows before 5.0.06.0
23RISK
open ↗Referência
CVE-2009-4626
Directory traversal vulnerability in menu.php in phpNagios 1.2.0 allows remote attackers to include and execute arbitrar
23RISK
open ↗Referência
CVE-2010-0763
SQL injection vulnerability in index.php in CommodityRentals Vacation Rental Software allows remote attackers to execute
23RISK
open ↗Referência
CVE-2026-102244
MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery
33RISK
open ↗Referência
CVE-2013-6128
The KCHARTXYLib.KChartXY ActiveX control in KChartXY.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 doe
23RISK
open ↗Referência
CVE-2010-4608
Habari 0.6.5 allows remote attackers to obtain sensitive information via a direct request to (1) header.php and (2) comm
23RISK
open ↗Referência
CVE-2011-5209
Cross-site scripting (XSS) vulnerability in search/ in GraphicsClone Script, possibly 1.11, allows remote attackers to i
23RISK
open ↗Referência
CVE-2016-5195
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISK
open ↗Referência
CVE-2024-6159
Push Notification for Post and BuddyPress <=1.93 - Multiple Unauthenticated SQLi
63RISK
open ↗Referência
CVE-2016-6079
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
23RISK
open ↗Referência
CVE-2017-1000432
Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access
23RISK
open ↗Referência✓ VexDay Proof
doop CMS 1.3.7 - Local File Inclusion
Directory traversal vulnerability in doop CMS 1.3.7 and earlier allows remote attackers to include and execute arbitrary
23RISK
open ↗Referência
CVE-2012-4266
Cross-site scripting (XSS) vulnerability in client_details.php in Proman Xpress 5.0.1 allows remote attackers to inject
23RISK
open ↗Referência✓ VexDay Proof
Connectix Boards 0.8.2 - 'template_path' Remote File Inclusion
PHP remote file inclusion vulnerability in templates/Official/part_userprofile.php in Connectix Boards 0.8.2 and earlier
23RISK
open ↗Referência✓ VexDay Proof
ProManager 0.73 - 'config.php' Local File Inclusion
Directory traversal vulnerability in inc/config.php in ProManager 0.73 allows remote attackers to include and execute ar
23RISK
open ↗Referência
CVE-2010-0971
Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.6.4 allow remote authenticated users, with Instructor pr
23RISK
open ↗Referência✓ VexDay Proof
jaxultrabb 2.0 - Local File Inclusion / Cross-Site Scripting
Directory traversal vulnerability in viewprofile.php in JaxUltraBB 2.0 and earlier allows remote attackers to read arbit
23RISK
open ↗Referência
CVE-2026-102243
MODSetter SurfSense MCP Connector Integration test command injection
33RISK
open ↗Referência✓ VexDay Proof
PHPWebGallery 1.3.4 - Cross-Site Scripting / Local File Inclusion
Multiple directory traversal vulnerabilities in PhpWebGallery 1.3.4 allow remote attackers to include and execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
WorkSimple 1.2.1 - Remote File Inclusion / Sensitive Data Disclosure
PHP remote file inclusion vulnerability in calendar.php in WorkSimple 1.2.1, when register_globals is enabled, allows re
35RISK
open ↗Referência
CVE-2009-2293
Optimum Web Design Tutorial Share 3.5.0 and earlier allows remote attackers to bypass authentication and obtain administ
23RISK
open ↗Referência
CVE-2010-4611
Html-edit CMS 3.1.8 allows remote attackers to obtain sensitive information via a direct request to (1) pages.php and (2
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.