Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,190 exploits
Referência
CVE-2009-3665
Multiple SQL injection vulnerabilities in index.php in Nullam Blog 0.1.2 allow remote attackers to execute arbitrary SQL
23RISK
open ↗Referência
CVE-2016-0099
The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8
98RISK
open ↗Referência
CVE-2026-80341
Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDOR
33RISK
open ↗Referência
CVE-2023-5241
AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file
48RISK
open ↗Referência
CVE-2014-9235
Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated
23RISK
open ↗Referência
CVE-2015-5736
The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel
23RISK
open ↗Referência
CVE-2016-0099
The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8
98RISK
open ↗Referência
CVE-2010-2037
Directory traversal vulnerability in the Percha Downloads Attach (com_perchadownloadsattach) component 1.1 for Joomla! a
43RISK
open ↗Referência
CVE-2016-0099
The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8
98RISK
open ↗Referência
CVE-2018-7886
An issue was discovered in CloudMe 1.11.0. An unauthenticated local attacker that can connect to the "CloudMe Sync" clie
23RISK
open ↗Referência
CVE-2013-4468
VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execut
50RISK
open ↗Referência
CVE-2026-4164
Wavlink WL-WN578W2 POST Request wireless.cgi GuestWifi command injection
48RISK
open ↗Referência
CVE-2017-14703
SQL injection vulnerability in Cash Back Comparison Script 1.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
X.Org xorg-x11-xfs 1.0.2-3.1 - Local Race Condition
The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component PU Arcade 2.1.3 - SQL Injection
SQL injection vulnerability in (1) Puarcade.php and (2) PUarcade.html.php in Pragmatic Utopia PU Arcade (com_puarcade) 2
23RISK
open ↗Referência✓ VexDay Proof
Alstrasoft Forum Pay Per Post Exchange 2.0 - SQL Injection
AlstraSoft Forum Pay Per Post Exchange 2.0 stores passwords in cleartext, which makes it easier for attackers to access
23RISK
open ↗Referência✓ VexDay Proof
DeluxeBB 1.2 - Multiple Vulnerabilities
Static code injection vulnerability in admincp.php in DeluxeBB 1.2 and earlier allows remote authenticated administrator
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component iDoBlog b24 - SQL Injection
SQL injection vulnerability in the IDoBlog (com_idoblog) component b24 and earlier and 1.0, a component for Joomla!, all
23RISK
open ↗Referência
CVE-2010-5040
PHP remote file inclusion vulnerability in nucleus/plugins/NP_gallery.php in the NP_Gallery plugin 0.94 for Nucleus allo
23RISK
open ↗Referência✓ VexDay Proof
Post Affiliate Pro 2.0 - 'md' Local File Inclusion
Directory traversal vulnerability in index.php in Post Affiliate Pro 2.0 allows remote authenticated users to read and p
23RISK
open ↗Referência✓ VexDay Proof
PHPcounter 1.3.2 - 'defs.php' Local File Inclusion
Directory traversal vulnerability in defs.php in PHPcounter 1.3.2 and earlier, when magic_quotes_gpc is disabled, allows
23RISK
open ↗Referência✓ VexDay Proof
PHPmyGallery 1.0beta2 - Local/Remote File Inclusion
PHP remote file inclusion vulnerability in _conf/core/common-tpl-vars.php in PHPmyGallery 1.0 beta2 allows remote attack
23RISK
open ↗Referência✓ VexDay Proof
CMSbright - 'id_rub_page' SQL Injection
SQL injection vulnerability in public/page.php in Websens CMSbright allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
PHPRunner 4.2 - 'SearchOption' Blind SQL Injection
Multiple SQL injection vulnerabilities in PHPRunner 4.2, and possibly earlier, allow remote attackers to execute arbitra
23RISK
open ↗Referência
CVE-2010-1346
SQL injection vulnerability in admin/login.php in Mini CMS RibaFS 1.0, when magic_quotes_gpc is disabled, allows remote
23RISK
open ↗Referência✓ VexDay Proof
Teraway LiveHelp 2.0 - Insecure Cookie Handling
Teraway LiveHelp 2.0 allows remote attackers to bypass authentication and gain administrative access via a pwd=&lvl=1&us
23RISK
open ↗Referência
CVE-2009-2393
admin/index.php in Virtuenetz Virtue Online Test Generator does not require administrative privileges, which allows remo
23RISK
open ↗Referência
CVE-2010-1363
SQL injection vulnerability in the JProjects (com_j-projects) component for Joomla! allows remote attackers to execute a
23RISK
open ↗Referência
CVE-2019-19493
Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, lea
23RISK
open ↗Referência
CVE-2017-2528
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.