Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,679cataloged exploits

40,329CVEs with public exploitation

24,696lab-tested

All Referência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecent popular risk

26,150 exploits

Referência

CVE-2015-2520

CVE-2015-2520—

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer a

28RISK

open ↗

Referência

CVE-2026-33829

CVE-2026-33829MEDIUM

Windows Snipping Tool Spoofing Vulnerability

33RISK

open ↗

Referência

CVE-2018-11443

CVE-2018-11443—

The parameter q is affected by Cross-site Scripting in jobcard-ongoing.php in EasyService Billing 1.0.

23RISK

open ↗

Referência✓ VexDay Proof

JShop 1.x < 2.x - 'xPage' Local File Inclusion

CVE-2008-1624—webappsphp

Directory traversal vulnerability in v2demo/page.php in Jshop Server 1.x through 2.x allows remote attackers to include

23RISK

open ↗

Referência

CVE-2017-6331

CVE-2017-6331—

Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a

23RISK

open ↗

Referência✓ VexDay Proof

Sisfo Kampus 2006 - 'dwoprn.php?f' Arbitrary File Download

CVE-2007-4895—webappsphp

Directory traversal vulnerability in dwoprn.php in Sisfo Kampus 2006 (Semarang 3) allows remote attackers to read arbitr

23RISK

open ↗

Referência

CVE-2019-10664

CVE-2019-10664—

Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.

23RISK

open ↗

Referência

CVE-2010-0967

CVE-2010-0967—

Multiple directory traversal vulnerabilities in Geekhelps ADMP 1.01, when magic_quotes_gpc is disabled, allow remote att

23RISK

open ↗

Referência✓ VexDay Proof

ModernBill 4.4.x - Cross-Site Scripting / Remote File Inclusion

CVE-2008-5060—webappsphp

Multiple PHP remote file inclusion vulnerabilities in ModernBill 4.4 and earlier allow remote attackers to execute arbit

23RISK

open ↗

Referência

CVE-2015-1517

CVE-2015-1517—

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to

23RISK

open ↗

Referência

CVE-2009-4748

CVE-2009-4748—

SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows

23RISK

open ↗

Referência

CVE-2009-4748

CVE-2009-4748—

SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows

23RISK

open ↗

Referência✓ VexDay Proof

Yaws < 1.80 - Multiple Headers Remote Denial of Service Vulnerabilities

CVE-2009-0751—dosmultiple

Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with

28RISK

open ↗

Referência

CVE-2009-3151

CVE-2009-3151—

Directory traversal vulnerability in actions/downloadFile.php in Ultrize TimeSheet 1.2.2 allows remote attackers to read

23RISK

open ↗

Referência

CVE-2014-3991

CVE-2014-3991—

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary

23RISK

open ↗

Referência

CVE-2026-16593

CVE-2026-16593MEDIUM

WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings

33RISK

open ↗

Referência

CVE-2014-9099

CVE-2014-9099—

Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attacker

23RISK

open ↗

Referência

CVE-2015-5465

CVE-2015-5465—

Silicon Integrated Systems WindowsXP Display Manager (aka VGA Driver Manager and VGA Display Manager) 6.14.10.3930 allow

23RISK

open ↗

Referência

CVE-2018-11715

CVE-2018-11715—

The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject.

23RISK

open ↗

Referência

CVE-2017-14842

CVE-2017-14842—

Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.

23RISK

open ↗

Referência

CVE-2019-11416

CVE-2019-11416—

A CSRF issue was discovered on Intelbras IWR 3000N 1.5.0 devices, leading to complete control of the router, as demonstr

23RISK

open ↗

Referência

CVE-2023-26692

CVE-2023-26692MEDIUM

ZCBS Zijper Collectie Beheer Systeem (ZCBS), Zijper Publication Management System (ZPBS), and Zijper Image Bank Manageme

33RISK

open ↗

Referência✓ VexDay Proof

V-Webmail 1.6.4 - 'pear_dir' Remote File Inclusion

CVE-2006-2666—webappsphp

PHP remote file inclusion vulnerability in includes/mailaccess/pop3.php in V-Webmail 1.5 through 1.6.4 allows remote att

23RISK

open ↗

Referência

CVE-2011-3645

CVE-2011-3645—

Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter

23RISK

open ↗

Referência✓ VexDay Proof

Project Based Calendaring System (PBCS) 0.7.1 - Multiple Vulnerabilities

CVE-2008-2215—webappsphp

Multiple directory traversal vulnerabilities in Project-Based Calendaring System (PBCS) 0.7.1-1 allow remote attackers t

23RISK

open ↗

Referência

CVE-2014-2088

CVE-2014-2088—

Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

Visagesoft eXPert PDF EditorX - 'VSPDFEditorX.ocx' Insecure Method

CVE-2008-6496—doswindows

Insecure method vulnerability in the VSPDFEditorX.VSPDFEdit ActiveX control in VSPDFEditorX.ocx 1.0.200.0 in VISAGESOFT

23RISK

open ↗

Referência✓ VexDay Proof

mrcgiguy the ticket system 2.0 PHP - Multiple Vulnerabilities

CVE-2009-2080—webappsphp

admin.php in MRCGIGUY The Ticket System 2.0 does not properly restrict access, which allows remote attackers to (1) obta

23RISK

open ↗

Referência

CVE-2010-2677

CVE-2010-2677—

PHP remote file inclusion vulnerability in mw_plugin.php in Open Web Analytics (OWA) 1.2.3, when magic_quotes_gpc is dis

23RISK

open ↗

Referência

CVE-2009-4798

CVE-2009-4798—

Multiple SQL injection vulnerabilities in Diskos CMS 6.x allow remote attackers to execute arbitrary SQL commands via th

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.