Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,569cataloged exploits
34,981CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,899GitHub PoC 13,965VulnCheck XDB 8,542Nuclei 4,248Metasploit 3,472✓ verified onlyrecentpopularrisk
21,899 exploits
Referência
CVE-2012-1417
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow
23RISK
open ↗Referência
CVE-2012-1417
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow
23RISK
open ↗Referência✓ VexDay Proof
phpCC 4.2 Beta - 'base_dir' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Fabian Hainz phpCC Beta 4.2 allow remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
SIPS 0.3.1 - 'box.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in sipssys/code/box.inc.php in Haakon Nilsen simple, integrated publishing syste
23RISK
open ↗Referência✓ VexDay Proof
MyPHPcommander 2.0 - 'package.php' Remote File Inclusion
PHP remote file inclusion vulnerability in system/lib/package.php in MyPHPCommander 2.0 allows remote attackers to execu
23RISK
open ↗Referência✓ VexDay Proof
FCRing 1.31 - 'fcring.php?s_fuss' Remote File Inclusion
PHP remote file inclusion vulnerability in fcring.php in FCRing 1.3 allows remote attackers to execute arbitrary PHP cod
23RISK
open ↗Referência✓ VexDay Proof
Versado CMS 1.07 - 'ajax_listado.php?urlModulo' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/ajax_listado.php in Versado CMS 1.07 allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
MG-SOFT Net Inspector 6.5.0.828 - Multiple Vulnerabilities
Format string vulnerability in the Net Inspector HTTP server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier fo
23RISK
open ↗Referência✓ VexDay Proof
WordPress Plugin Spreadsheet 0.6 - SQL Injection
SQL injection vulnerability in ss_load.php in the Spreadsheet (wpSS) 0.6 and earlier plugin for WordPress allows remote
23RISK
open ↗Referência✓ VexDay Proof
RSS-aggregator - 'path' Remote File Inclusion
PHP remote file inclusion vulnerability in display.php in RSS-aggregator allows remote attackers to execute arbitrary PH
23RISK
open ↗Referência
CVE-2008-5167
PHP remote file inclusion vulnerability in layout/default/params.php in Boonex Orca 2.0 and 2.0.2, when register_globals
23RISK
open ↗Referência
CVE-2020-5811
An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, whi
23RISK
open ↗Referência
CVE-2017-8926
Buffer overflow in Halliburton LogView Pro 10.0.1 allows attackers to cause a denial of service or possibly have unspeci
23RISK
open ↗Referência
CVE-2010-3486
Directory traversal vulnerability in FileStorageUpload.ashx in SmarterMail 7.1.3876 allows remote attackers to read arbi
23RISK
open ↗Referência
CVE-2009-4216
Directory traversal vulnerability in funzioni/lib/menulast.php in klinza professional cms 5.0.1 and earlier allows remot
23RISK
open ↗Referência
CVE-2002-1966
Directory traversal vulnerability in magiccard.cgi in My Postcards Platinum 5.0 and 6.0 allows remote attackers to read
23RISK
open ↗Referência✓ VexDay Proof
iziContents rc6 - Local/Remote File Inclusion
Directory traversal vulnerability in tiny_mce_gzip.php in TinyMCE Compressor PHP before 1.06 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
KnowledgeBuilder 2.2 - 'visEdit_root' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/e_data/visEdit_control.class.php in ActiveCampaign KnowledgeBuilder 2.2
23RISK
open ↗Referência✓ VexDay Proof
Philips VOIP841 Firmware 1.0.4.800 - Multiple Vulnerabilities
Directory traversal vulnerability in the web server in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and
23RISK
open ↗Referência
CVE-2015-2564
SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to
23RISK
open ↗Referência
CVE-2015-2564
SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to
23RISK
open ↗Referência
CVE-2019-9184
SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitr
23RISK
open ↗Referência
CVE-2011-5233
Heap-based buffer overflow in IrfanView before 4.32 allows remote attackers to execute arbitrary code via crafted "Rows
23RISK
open ↗Referência
CVE-2019-6224
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.
23RISK
open ↗Referência
CVE-2013-4985
Multiple Vivotek IP Cameras remote authentication bypass that could allow access to the video stream
23RISK
open ↗Referência
CVE-2026-2017
IP-COM W30AP POST Request wx3auth R7WebsSecurityHandler stack-based overflow
48RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.