Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2015-4669
CVE-2015-4669—
The MySQL "root" user in Xsuite 2.x does not have a password set, which allows local users to access databases on the sy
23RISK
open ↗
Referência✓ VexDay Proof
Basic PHP Events Lister 1.0 - SQL Injection
CVE-2008-6464—webappsphp
SQL injection vulnerability in event.php in Mevin Productions Basic PHP Events Lister 1.0 allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
EgyPlus 7ml 1.0.1 - Authentication Bypass
CVE-2009-2168CRITICALwebappsphp
cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit whe
53RISK
open ↗
Referência
CVE-2023-1934
CVE-2023-1934CRITICAL
The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL
48RISK
open ↗
Referência
CVE-2026-109934
CVE-2026-109934MEDIUM
Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API
33RISK
open ↗
Referência
CVE-2014-9643
CVE-2014-9643—
K7Sentry.sys in K7 Computing Ultimate Security, Anti-Virus Plus, and Total Security before 14.2.0.253 allows local users
23RISK
open ↗
Referência
CVE-2014-9643
CVE-2014-9643—
K7Sentry.sys in K7 Computing Ultimate Security, Anti-Virus Plus, and Total Security before 14.2.0.253 allows local users
23RISK
open ↗
Referência
CVE-2015-6306
CVE-2015-6306—
Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions,
23RISK
open ↗
Referência✓ VexDay Proof
MySpace Resource Script (MSRS) 1.21 - Remote File Inclusion
CVE-2007-5721—webappsphp
PHP remote file inclusion vulnerability in _theme/breadcrumb.php in MySpacePros MySpace Resource Script (MSRS) 1.21 allo
23RISK
open ↗
Referência
CVE-2026-96533
CVE-2026-96533MEDIUM
Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL
33RISK
open ↗
Referência
CVE-2012-4265
CVE-2012-4265—
SQL injection vulnerability in category_edit.php in Proman Xpress 5.0.1 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2026-109933
CVE-2026-109933MEDIUM
Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes
33RISK
open ↗
Referência
CVE-2015-6306
CVE-2015-6306—
Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions,
23RISK
open ↗
Referência
CVE-2017-14492
CVE-2017-14492—
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
45RISK
open ↗
Referência
CVE-2017-7005
CVE-2017-7005—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS
23RISK
open ↗
Referência
CVE-2026-107858
CVE-2026-107858HIGH
Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server
41RISK
open ↗
Referência
CVE-2026-115535
CVE-2026-115535MEDIUM
gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting
33RISK
open ↗
Referência
CVE-2011-1567
CVE-2011-1567—
Multiple stack-based buffer overflows in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Grap
50RISK
open ↗
Referência
CVE-2010-20112
CVE-2010-20112CRITICAL
Amlibweb NetOpacs webquery.dll Stack Buffer Overflow
63RISK
open ↗
Referência
CVE-2010-20112
CVE-2010-20112CRITICAL
Amlibweb NetOpacs webquery.dll Stack Buffer Overflow
63RISK
open ↗
Referência
CVE-2024-55879
CVE-2024-55879CRITICAL
XWiki allows RCE from script right in configurable sections
48RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module WF-Snippets 1.02 (c) - Blind SQL Injection
CVE-2007-1962—webappsphp
SQL injection vulnerability in index.php in the WF-Snippets 1.02 and earlier module for XOOPS allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
QuickEStore 8.2 - 'insertorder.cfm' SQL Injection
CVE-2007-3933—webappsphp
SQL injection vulnerability in insertorder.cfm in QuickEStore 8.2 and earlier allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2017-13878
CVE-2017-13878—
An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Intel Graph
23RISK
open ↗
Referência
CVE-2021-47851
CVE-2021-47851CRITICAL
Mini Mouse 9.2.0 - Remote Code Execution
48RISK
open ↗
Referência✓ VexDay Proof
PHP Real Estate - 'fullnews.php?id' SQL Injection
CVE-2007-6462—webappsphp
SQL injection vulnerability in fullnews.php in PHP Real Estate Classifieds allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Limbo CMS 1.0.4.2 - 'Cuid' cookie Blind SQL Injection
CVE-2008-0734—webappsphp
SQL injection vulnerability in class_auth.php in Limbo CMS 1.0.4.2, and possibly earlier versions, allows remote attacke
23RISK
open ↗
Referência
CVE-2009-3911
CVE-2009-3911—
Cross-site scripting (XSS) vulnerability in settings.php in TFTgallery 0.13 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2009-4719
CVE-2009-4719—
SQL injection vulnerability in index.php in Discloser 0.0.4 rc2 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência
CVE-2010-4905
CVE-2010-4905—
SQL injection vulnerability in article_details.php in Softbiz Article Directory Script allows remote attackers to execut
23RISK
open ↗
← previouspage 331 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.