Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,647cataloged exploits
34,986CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,899GitHub PoC 14,014VulnCheck XDB 8,571Nuclei 4,248Metasploit 3,472✓ verified onlyrecentpopularrisk
21,899 exploits
Referência
CVE-2010-1703
CVE-2010-1703—
Multiple cross-site scripting (XSS) vulnerabilities in index_search.php in 2daybiz Polls (aka Advanced Poll) Script allo
23RISK
open ↗
Referência
CVE-2010-1703
CVE-2010-1703—
Multiple cross-site scripting (XSS) vulnerabilities in index_search.php in 2daybiz Polls (aka Advanced Poll) Script allo
23RISK
open ↗
Referência
CVE-2015-6541
CVE-2015-6541—
Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) be
23RISK
open ↗
Referência
CVE-2021-4462
CVE-2021-4462CRITICAL
Employee Records System v1.0 Arbitrary File Upload RCE
63RISK
open ↗
Referência
CVE-2010-1921
CVE-2010-1921—
Multiple PHP remote file inclusion vulnerabilities in OpenMairie openAnnuaire 2.00, when register_globals is enabled, al
23RISK
open ↗
Referência✓ VexDay Proof
Crysis 1.1.1.5879 - Remote Format String Denial of Service (PoC)
CVE-2008-1127—doswindows
Format string vulnerability in the cryactio function in Crysis 1.1.1.5879 allows remote authenticated users to execute a
23RISK
open ↗
Referência✓ VexDay Proof
KISGB (tmp_theme) 5.1.1 - Local File Inclusion
CVE-2008-1635—webappsphp
Directory traversal vulnerability in view_private.php in Keep It Simple Guest Book (KISGB) 5.0.0 and earlier allows remo
23RISK
open ↗
Referência✓ VexDay Proof
Carbon Communities 2.4 - Multiple Vulnerabilities
CVE-2008-1896—webappsasp
Multiple cross-site scripting (XSS) vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to inje
23RISK
open ↗
Referência✓ VexDay Proof
WebSVN 2.0 - Cross-Site Scripting / File Handling / Code Execution
CVE-2008-5920—webappsphp
The create_anchors function in utils.inc in WebSVN 1.x allows remote attackers to execute arbitrary PHP code via a craft
23RISK
open ↗
Referência
CVE-2009-4423
CVE-2009-4423—
SQL injection vulnerability in index.php in weenCompany 4.0.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2010-1923
CVE-2010-1923—
SQL injection vulnerability in user.php in Hi Web Wiesbaden Web 2.0 Social Network Freunde Community System allows remot
23RISK
open ↗
Referência
CVE-2017-17570
CVE-2017-17570—
FS Expedia Clone 1.0 has SQL Injection via the pages.php or content.php id parameter, or the show-flight-result.php fl_o
23RISK
open ↗
Referência
CVE-2017-17570
CVE-2017-17570—
FS Expedia Clone 1.0 has SQL Injection via the pages.php or content.php id parameter, or the show-flight-result.php fl_o
23RISK
open ↗
Referência
CVE-2026-11866
CVE-2026-11866MEDIUM
LatePoint < 5.6.3 - Multiple Privileged Actions via CSRF
33RISK
open ↗
Referência
CVE-2026-11371
CVE-2026-11371MEDIUM
BetterDocs < 4.5.5 - Unauthenticated Stored XSS via AI Doc Summarizer Prompt Injection
33RISK
open ↗
Referência
CVE-2015-4630
CVE-2015-4630—
Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x
23RISK
open ↗
Referência
CVE-2017-0282
CVE-2017-0282—
Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT
23RISK
open ↗
Referência
CVE-2017-0284
CVE-2017-0284—
Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT
23RISK
open ↗
Referência
CVE-2010-5007
CVE-2010-5007—
Cross-site scripting (XSS) vulnerability in pages/match_report.php in UTStats Beta 4 and earlier allows remote attackers
23RISK
open ↗
Referência
CVE-2009-4427
CVE-2009-4427—
Directory traversal vulnerability in cmd.php in phpLDAPadmin 1.1.0.5 allows remote attackers to include and execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
Cisco IP Phone 7940 - Reboot (Denial of Service)
CVE-2006-0179—doshardware
The Cisco IP Phone 7940 allows remote attackers to cause a denial of service (reboot) via a large amount of TCP SYN pack
28RISK
open ↗
Referência
CVE-2018-7216
CVE-2018-7216—
Cross-site request forgery (CSRF) vulnerability in esop/toolkit/profile/regData.do in Bravo Tejari Procurement Portal al
23RISK
open ↗
Referência
CVE-2018-7216
CVE-2018-7216—
Cross-site request forgery (CSRF) vulnerability in esop/toolkit/profile/regData.do in Bravo Tejari Procurement Portal al
23RISK
open ↗
Referência
CVE-2017-16783
CVE-2017-16783—
In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter.
23RISK
open ↗
Referência
CVE-2010-5007
CVE-2010-5007—
Cross-site scripting (XSS) vulnerability in pages/match_report.php in UTStats Beta 4 and earlier allows remote attackers
23RISK
open ↗
Referência
CVE-2019-14280
CVE-2019-14280—
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images whe
23RISK
open ↗
Referência
CVE-2009-4430
CVE-2009-4430—
SQL injection vulnerability in index.php in VirtueMart 1.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
LightCMS 1.3.4 - 'exclusive' Stored XSS
CVE-2021-3355—webappsmultiple
A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Tit
23RISK
open ↗
Referência✓ VexDay Proof
MODx CMS 0.9.2.1 - 'FCKeditor' Remote File Inclusion
CVE-2006-5730—webappsphp
PHP remote file inclusion vulnerability in manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php in Modx CMS
23RISK
open ↗
Referência✓ VexDay Proof
Durian Web Application Server 3.02 - Remote Buffer Overflow
CVE-2006-6853—remotewindows
Buffer overflow in Durian Web Application Server 3.02 freeware on Windows allows remote attackers to execute arbitrary c
23RISK
open ↗
← previouspage 330 / 730next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.