Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
26,190 exploits
Referência
CVE-2026-101281
CVE-2026-101281MEDIUM
Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication
33RISK
open ↗
Referência✓ VexDay Proof
pl-PHP Beta 0.9 - Multiple Vulnerabilities
CVE-2007-2008—webappsphp
Directory traversal vulnerability in admin.php in pL-PHP beta 0.9 allows remote attackers to include and execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
SimpCMS 04.10.2007 - 'site' Remote File Inclusion
CVE-2007-2009—webappsphp
PHP remote file inclusion vulnerability in index.php in SimpCMS Light 04.10.2007 and earlier allows remote attackers to
23RISK
open ↗
Referência
CVE-2012-6044
CVE-2012-6044—
M-Player 0.4 allows remote attackers to cause a denial of service (crash) via a crafted MP3 file.
23RISK
open ↗
Referência
CVE-2013-0249
CVE-2013-0249—
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
28RISK
open ↗
Referência
CVE-2013-6936
CVE-2013-6936—
Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletin
23RISK
open ↗
Referência
CVE-2013-6936
CVE-2013-6936—
Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletin
23RISK
open ↗
Referência
CVE-2009-4927
CVE-2009-4927—
WB News 2.1.2 allows remote attackers to bypass authentication and gain administrative access via a modified WBNEWS cook
23RISK
open ↗
Referência
CVE-2015-3315
CVE-2015-3315—
Automatic Bug Reporting Tool (ABRT) allows local users to read, change the ownership of, or have other unspecified impac
38RISK
open ↗
Referência✓ VexDay Proof
mini-pub 0.3 - File Disclosure / Code Execution
CVE-2008-5581—webappsphp
PHP remote file inclusion vulnerability in mini-pub.php/front-end/img.php in mini-pub 0.3 allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
iGaming CMS 1.5 - Multiple SQL Injections
CVE-2008-5841—webappsphp
Multiple SQL injection vulnerabilities in iGaming 1.5 and earlier allow remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência
CVE-2026-102364
CVE-2026-102364MEDIUM
mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API
33RISK
open ↗
Referência
CVE-2018-14497
CVE-2018-14497—
Tenda D152 ADSL routers allow XSS via a crafted SSID.
23RISK
open ↗
Referência
CVE-2026-13500
CVE-2026-13500MEDIUM
antlr ANTLR4 Grammar Action Block OutputFile.java code injection
33RISK
open ↗
Referência
CVE-2015-6305
CVE-2015-6305—
Untrusted search path vulnerability in the CMainThread::launchDownloader function in vpndownloader.exe in Cisco AnyConne
23RISK
open ↗
Referência
CVE-2019-2000
CVE-2019-2000—
In several functions of binder.c, there is possible memory corruption due to a use after free. This could lead to local
23RISK
open ↗
Referência
CVE-2018-0901
CVE-2018-0901—
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗
Referência✓ VexDay Proof
microssys CMS 1.5 - Remote File Inclusion
CVE-2008-2396—webappsphp
PHP remote file inclusion vulnerability in index.php in Wajox Software microSSys CMS 1.5 and earlier, when register_glob
23RISK
open ↗
Referência✓ VexDay Proof
Yerba SACphp 6.3 - Multiple Vulnerabilities
CVE-2008-5873—webappsphp
Yerba SACphp 6.3 and earlier allows remote attackers to bypass authentication and gain administrative access via a galle
23RISK
open ↗
Referência✓ VexDay Proof
GRBoard 1.8 - Multiple Remote File Inclusions
CVE-2009-0444—webappsphp
Multiple PHP remote file inclusion vulnerabilities in GRBoard 1.8, when register_globals is enabled and magic_quotes_gpc
23RISK
open ↗
Referência✓ VexDay Proof
acute control panel 1.0.0 - SQL Injection / Remote File Inclusion
CVE-2009-1248—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Acute Control Panel 1.0.0 allow remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2009-4056
CVE-2009-4056—
Directory traversal vulnerability in admin/popup.php in Betsy CMS 3.5 allows remote attackers to include and execute arb
23RISK
open ↗
Referência
CVE-2009-4471
CVE-2009-4471—
Multiple PHP remote file inclusion vulnerabilities in FreeSchool 1.1.0 and earlier allow remote attackers to execute arb
23RISK
open ↗
Referência
CVE-2009-4820
CVE-2009-4820—
Angelo-Emlak 1.0 stores sensitive information under the web root with insufficient access control, which allows remote a
23RISK
open ↗
Referência
CVE-2010-1725
CVE-2010-1725—
SQL injection vulnerability in offers_buy.php in Alibaba Clone Platinum allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2010-1725
CVE-2010-1725—
SQL injection vulnerability in offers_buy.php in Alibaba Clone Platinum allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2010-3603
CVE-2010-3603—
Cross-site request forgery (CSRF) vulnerability in the file manager service (Services/FileService.ashx) in mojoPortal 2.
23RISK
open ↗
Referência
CVE-2010-3603
CVE-2010-3603—
Cross-site request forgery (CSRF) vulnerability in the file manager service (Services/FileService.ashx) in mojoPortal 2.
23RISK
open ↗
Referência
CVE-2015-6512
CVE-2015-6512—
SQL injection vulnerability in the get_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows
23RISK
open ↗
Referência
CVE-2004-1580
CVE-2004-1580—
SQL injection vulnerability in index.php in CubeCart 2.0.1 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
← previouspage 272 / 873next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.