Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,190 exploits
Referência
CVE-2015-3325
CVE-2015-3325—
SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to
23RISK
open ↗
Referência
CVE-2012-2578
CVE-2012-2578—
Multiple cross-site scripting (XSS) vulnerabilities in SmarterMail 9.2 allow remote attackers to inject arbitrary web sc
23RISK
open ↗
Referência
CVE-2016-3053
CVE-2016-3053—
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
23RISK
open ↗
Referência
CVE-2017-14620
CVE-2017-14620—
SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQu
23RISK
open ↗
Referência
CVE-2019-13029
CVE-2019-13029—
Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9
23RISK
open ↗
Referência
CVE-2026-77005
CVE-2026-77005CRITICAL
Code Monkeys Proposals <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal
48RISK
open ↗
Referência
CVE-2021-32403
CVE-2021-32403—
Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of security mecha
23RISK
open ↗
Referência
CVE-2026-75800
CVE-2026-75800CRITICAL
Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse
48RISK
open ↗
Referência✓ VexDay Proof
RicarGBooK 1.2.1 - 'lang' Local File Inclusion
CVE-2007-2050—webappsphp
Multiple directory traversal vulnerabilities in header.php in RicarGBooK 1.2.1 allow remote attackers to include and exe
23RISK
open ↗
Referência✓ VexDay Proof
PHP Coupon Script 3.0 - 'bus' SQL Injection
CVE-2007-2672—webappsphp
SQL injection vulnerability in index.php in PHP Coupon Script 3.0 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência
CVE-2014-5100
CVE-2014-5100—
Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the au
23RISK
open ↗
Referência✓ VexDay Proof
xml2owl 0.1.1 - 'showcode.php' Remote Command Execution
CVE-2007-6632—webappsphp
showCode.php in xml2owl 0.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path
23RISK
open ↗
Referência
CVE-2010-0755
CVE-2010-0755—
PHP remote file inclusion vulnerability in include/WBmap.php in WikyBlog 1.7.3 rc2 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
PHPMyCart 1.3 - 'cat' SQL Injection
CVE-2008-2904—webappsphp
SQL injection vulnerability in shop.php in Conkurent PHPMyCart allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
myPHPscripts Login Session 2.0 - Cross-Site Scripting / Database Disclosure
CVE-2008-5855—webappsphp
myPHPscripts Login Session 2.0 stores sensitive information under the web root with insufficient access control, which a
23RISK
open ↗
Referência
CVE-2010-0755
CVE-2010-0755—
PHP remote file inclusion vulnerability in include/WBmap.php in WikyBlog 1.7.3 rc2 allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2012-2586
CVE-2012-2586—
Multiple cross-site scripting (XSS) vulnerabilities in Mailtraq 2.17.3.3150 allow remote attackers to inject arbitrary w
23RISK
open ↗
Referência
CVE-2018-8903
CVE-2018-8903—
Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.
23RISK
open ↗
Referência
CVE-2016-2784
CVE-2016-2784—
CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduc
23RISK
open ↗
Referência
CVE-2018-10580
CVE-2018-10580—
The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displ
23RISK
open ↗
Referência
CVE-2018-10580
CVE-2018-10580—
The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displ
23RISK
open ↗
Referência
CVE-2012-10039
CVE-2012-10039CRITICAL
ZEN Load Balancer Filelog Command Execution
63RISK
open ↗
Referência
CVE-2012-10039
CVE-2012-10039CRITICAL
ZEN Load Balancer Filelog Command Execution
63RISK
open ↗
Referência
CVE-2012-10039
CVE-2012-10039CRITICAL
ZEN Load Balancer Filelog Command Execution
63RISK
open ↗
Referência✓ VexDay Proof
RantX 1.0 - Insecure Admin Authentication
CVE-2008-2297—webappsphp
The admin.php file in Rantx allows remote attackers to bypass authentication and gain privileges by setting the logininf
23RISK
open ↗
Referência✓ VexDay Proof
Zomplog 3.8 - 'force_download.php' Remote File Disclosure
CVE-2007-2157—webappsphp
Directory traversal vulnerability in upload/force_download.php in Zomplog 3.8 allows remote attackers to read arbitrary
23RISK
open ↗
Referência
CVE-2025-34049
CVE-2025-34049CRITICAL
OptiLink ONT1GEW GPON Remote Code Execution
48RISK
open ↗
Referência
CVE-2025-34049
CVE-2025-34049CRITICAL
OptiLink ONT1GEW GPON Remote Code Execution
48RISK
open ↗
Referência
CVE-2008-0135
CVE-2008-0135—
Snitz Forums 2000 3.4.06 and earlier stores sensitive information under the web root with insufficient access control, w
23RISK
open ↗
Referência
CVE-2008-4649
CVE-2008-4649—
Session fixation vulnerability in Elxis CMS 2008.1 revision 2204 allows remote attackers to hijack web sessions by setti
23RISK
open ↗
← previouspage 294 / 873next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.