Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,150 exploits
Referência✓ VexDay Proof
Netartmedia Cars Portal 2.0 - SQL Injection
CVE-2008-5310—webappsphp
SQL injection vulnerability in image.php in NetArt Media Car Portal 2.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
ASP Download 1.03 - Arbitrary Change Administrator Account
CVE-2008-6739—webappsasp
Todd Woolums ASP Download management script 1.03 does not require authentication for setupdownload.asp, which allows rem
23RISK
open ↗
Referência✓ VexDay Proof
S-CMS 1.1 Stable - 'page' Local File Inclusion
CVE-2009-1502—webappsphp
Directory traversal vulnerability in plugin.php in S-Cms 1.1 Stable and 1.5.2 allows remote attackers to include and exe
23RISK
open ↗
Referência
CVE-2009-4670
CVE-2009-4670—
admin/delitem.php in RoomPHPlanning 1.6 does not require authentication, which allows remote attackers to (1) delete arb
23RISK
open ↗
Referência
CVE-2009-4801
CVE-2009-4801—
EZ-Blog Beta 1 does not require authentication, which allows remote attackers to create or delete arbitrary posts via re
23RISK
open ↗
Referência
CVE-2015-5119
CVE-2015-5119HIGHunder attack
Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.
100RISK
open ↗
Referência
CVE-2019-2721
CVE-2019-2721—
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions th
23RISK
open ↗
Referência
CVE-2018-25427
CVE-2018-25427CRITICAL
Arm Whois 3.11 Buffer Overflow via SEH Overwrite
48RISK
open ↗
Referência
CVE-2026-49952
CVE-2026-49952CRITICAL
Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle
63RISK
open ↗
Referência
CVE-2016-6600
CVE-2016-6600—
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remot
60RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke NukeAI Module 3b - 'util.php' Remote File Inclusion
CVE-2006-6255—webappsphp
Direct static code injection vulnerability in util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Program E is an
23RISK
open ↗
Referência✓ VexDay Proof
P-News 1.16/1.17 - 'user.dat' Remote Password Disclosure
CVE-2006-6888—webappsphp
P-News 1.16 and 1.17 store sensitive information under the web root with insufficient access control, which allows remot
23RISK
open ↗
Referência✓ VexDay Proof
Snaps! Gallery 1.4.4 - Remote User Pass Change
CVE-2007-2715—webappsphp
Admin/users.php in Snaps! Gallery 1.4.4 allows remote attackers to change arbitrary usernames and passwords via the (1)
28RISK
open ↗
Referência
CVE-2026-46243
CVE-2026-46243HIGH
smb: client: reject userspace cifs.spnego descriptions
41RISK
open ↗
Referência
CVE-2009-2602
CVE-2009-2602—
R2 Newsletter Lite, Pro, and Stats stores sensitive information under the web root with insufficient access control, whi
23RISK
open ↗
Referência✓ VexDay Proof
XPOZE Pro 3.06 - 'uid' SQL Injection
CVE-2008-3089—webappsphp
SQL injection vulnerability in user.html in Xpoze Pro 3.06 (aka Xpoze Pro CMS 2008) allows remote attackers to execute a
23RISK
open ↗
Referência
CVE-2009-4545
CVE-2009-4545—
Logoshows BBS 2.0 stores sensitive information under the web root with insufficient access control, which allows remote
23RISK
open ↗
Referência
CVE-2011-5218
CVE-2011-5218—
SQL injection vulnerability in DotA OpenStats 1.3.9 and earlier allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
Liberum Help Desk 0.97.3 - SQL Injection / File Disclosure
CVE-2008-6057—webappsphp
Doug Luxem Liberum Help Desk 0.97.3 stores db/helpdesk2000.mdb under the web root with insufficient access control, whic
23RISK
open ↗
Referência
CVE-2010-0725
CVE-2010-0725—
Cross-site scripting (XSS) vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2010-0725
CVE-2010-0725—
Cross-site scripting (XSS) vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2010-1468
CVE-2010-1468—
SQL injection vulnerability in the Multi-Venue Restaurant Menu Manager (aka MVRMM or com_mv_restaurantmenumanager) compo
23RISK
open ↗
Referência✓ VexDay Proof
ColdFusion Scripts Red_Reservations - Database Disclosure
CVE-2008-6580—webappsasp
The Red_Reservations script for ColdFusion stores sensitive information under the web root with insufficient access cont
23RISK
open ↗
Referência✓ VexDay Proof
Ocean12 FAQ Manager Pro - Database Disclosure
CVE-2008-7063—webappsphp
Ocean12 FAQ Manager Pro stores sensitive data under the web root with insufficient access control, which allows remote a
23RISK
open ↗
Referência
CVE-2009-2337
CVE-2009-2337—
SQL injection vulnerability in includes/module/book/index.inc.php in w3b|cms Gaestebuch Guestbook Module 3.0.0, when mag
23RISK
open ↗
Referência
CVE-2018-1202
CVE-2018-1202—
Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and version 7.1.1.11 is af
23RISK
open ↗
Referência
CVE-2015-8413
CVE-2015-8413—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and
35RISK
open ↗
Referência
CVE-2016-6853
CVE-2016-6853—
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can
23RISK
open ↗
Referência
CVE-2017-17629
CVE-2017-17629—
Secure E-commerce Script 2.0.1 has SQL Injection via the category.php searchmain or searchcat parameter, or the single_d
23RISK
open ↗
Referência✓ VexDay Proof
Advanced Guestbook 2.4.0 - 'phpBB' File Inclusion
CVE-2006-2152—webappsphp
PHP remote file inclusion vulnerability in admin/addentry.php in phpBB Advanced Guestbook 2.4.0 and earlier, when regist
23RISK
open ↗
← previouspage 256 / 872next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.