Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
26,190 exploits
Referência
CVE-2010-4924
CVE-2010-4924—
PHP remote file inclusion vulnerability in logic/controller.class.php in clearBudget 0.9.8 allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
Pixie CMS - Cross-Site Scripting / SQL Injection
CVE-2009-1066—webappsphp
SQL injection vulnerability in the referral function in admin/lib/lib_logs.php in Pixie CMS 1.01a allows remote attacker
23RISK
open ↗
Referência
CVE-2009-3542
CVE-2009-3542—
Directory traversal vulnerability in ls.php in LittleSite (aka LS or LittleSite.php) 0.1 allows remote attackers to incl
23RISK
open ↗
Referência
CVE-2010-2910
CVE-2010-2910—
SQL injection vulnerability in the Ozio Gallery (com_oziogallery) component for Joomla! allows remote attackers to execu
23RISK
open ↗
Referência
CVE-2012-2588
CVE-2012-2588—
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitr
23RISK
open ↗
Referência
CVE-2012-4262
CVE-2012-4262—
Multiple cross-site scripting (XSS) vulnerabilities in myCare2x allow remote attackers to inject arbitrary web script or
23RISK
open ↗
Referência
CVE-2013-5117
CVE-2013-5117—
SQL injection vulnerability in the RSS page (DNNArticleRSS.aspx) in the ZLDNN DNNArticle module before 10.1 for DotNetNu
23RISK
open ↗
Referência
CVE-2015-4064
CVE-2015-4064—
SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allo
23RISK
open ↗
Referência
CVE-2018-7465
CVE-2018-7465—
An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by
23RISK
open ↗
Referência
CVE-2013-5640
CVE-2013-5640—
Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (
23RISK
open ↗
Referência
CVE-2010-3480
CVE-2010-3480—
Directory traversal vulnerability in index.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allows re
23RISK
open ↗
Referência
CVE-2017-9650
CVE-2017-9650—
An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL
23RISK
open ↗
Referência
CVE-2026-12202
CVE-2026-12202MEDIUM
Intelliants Subrion CMS Blocks Endpoint cross site scripting
33RISK
open ↗
Referência
CVE-2026-85418
CVE-2026-85418MEDIUM
Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget
33RISK
open ↗
Referência
CVE-2015-4077
CVE-2015-4077—
The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient b
23RISK
open ↗
Referência✓ VexDay Proof
Mafia Scum Tools 2.0.0 - 'index.php?gen' Remote File Inclusion
CVE-2007-0501—webappsphp
PHP remote file inclusion vulnerability in index.php in Mafia Scum Tools 2.0.0 in Matthew Wardrop Advanced Random Genera
23RISK
open ↗
Referência
CVE-2012-10038
CVE-2012-10038CRITICAL
Auxilium RateMyPet Arbitrary File Upload RCE
63RISK
open ↗
Referência✓ VexDay Proof
PHP 4.4.6 - 'ibase_connect()' Local Buffer Overflow
CVE-2007-1475—localwindows
Multiple buffer overflows in the (1) ibase_connect and (2) ibase_pconnect functions in the interbase extension in PHP 4.
23RISK
open ↗
Referência
CVE-2011-5041
CVE-2011-5041—
Multiple cross-site scripting (XSS) vulnerabilities in Pulse Pro CMS 1.7.2 allow remote attackers to inject arbitrary we
23RISK
open ↗
Referência
CVE-2012-6557
CVE-2012-6557—
Multiple cross-site scripting (XSS) vulnerabilities in the AboutMe plugin 1.1.1 for Vanilla Forums allow remote attacker
23RISK
open ↗
Referência
CVE-2013-5640
CVE-2013-5640—
Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (
23RISK
open ↗
Referência
CVE-2015-4077
CVE-2015-4077—
The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient b
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin wordTube 1.43 - 'wpPATH' Remote File Inclusion
CVE-2007-2481—webappsphp
PHP remote file inclusion vulnerability in wordtube-button.php in the wordTube 1.43 and earlier plugin for WordPress, wh
35RISK
open ↗
Referência
CVE-2009-4465
CVE-2009-4465—
DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
Integramod Nederland 1.4.2 - Remote File Inclusion
CVE-2007-5140—webappsphp
PHP remote file inclusion vulnerability in includes/archive/archive_topic.php in IntegraMOD Nederland 1.4.2 allows remot
23RISK
open ↗
Referência✓ VexDay Proof
teatro 1.6 - 'basePath' Remote File Inclusion
CVE-2007-5780—webappsphp
PHP remote file inclusion vulnerability in pub/pub08_comments.php in teatro 1.6 allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
VHD Web Pack 2.0 - 'index.php' Local File Inclusion
CVE-2008-0609—webappsphp
Directory traversal vulnerability in index.php in DivideConcept VHD Web Pack 2.0 allows remote attackers to include and
23RISK
open ↗
Referência✓ VexDay Proof
LightBlog 9.6 - 'Username' Local File Inclusion
CVE-2008-0840—webappsphp
Directory traversal vulnerability in view_member.php in Public Warehouse LightBlog 9.6 allows remote attackers to includ
23RISK
open ↗
Referência✓ VexDay Proof
GNU/Gallery 1.1.1.0 - 'admin.php' Local File Inclusion
CVE-2008-2353—webappsphp
Directory traversal vulnerability in admin.php in GNU/Gallery 1.1.1.0 and earlier allows remote attackers to include and
23RISK
open ↗
Referência✓ VexDay Proof
MyBlog: PHP and MySQL Blog/CMS software - SQL Injection / Cross-Site Scripting
CVE-2008-2963—webappsphp
Multiple SQL injection vulnerabilities in MyBlog allow remote attackers to execute arbitrary SQL commands via the (1) vi
23RISK
open ↗
← previouspage 267 / 873next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.