Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,647cataloged exploits
34,986CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,899GitHub PoC 14,014VulnCheck XDB 8,571Nuclei 4,248Metasploit 3,472✓ verified onlyrecentpopularrisk
21,899 exploits
Referência
CVE-2020-15930
CVE-2020-15930—
An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.
23RISK
open ↗
Referência✓ VexDay Proof
Musoo 0.21 - Remote File Inclusion
CVE-2007-3297—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Musoo 0.21 allow remote attackers to execute arbitrary PHP code vi
23RISK
open ↗
Referência
CVE-2024-53584
CVE-2024-53584CRITICAL
OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter.
48RISK
open ↗
Referência
CVE-2017-17591
CVE-2017-17591—
Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter.
23RISK
open ↗
Referência
CVE-2017-17591
CVE-2017-17591—
Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter.
23RISK
open ↗
Referência
CVE-2014-100003
CVE-2014-100003—
SQL injection vulnerability in includes/ym-download_functions.include.php in the Code Futures YourMembers plugin for Wor
23RISK
open ↗
Referência
CVE-2014-100003
CVE-2014-100003—
SQL injection vulnerability in includes/ym-download_functions.include.php in the Code Futures YourMembers plugin for Wor
23RISK
open ↗
Referência
CVE-2018-11564
CVE-2018-11564—
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature.
23RISK
open ↗
Referência
CVE-2018-11564
CVE-2018-11564—
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature.
23RISK
open ↗
Referência
CVE-2021-29447
CVE-2021-29447HIGH
WordPress Authenticated XXE attack when installation is running PHP 8
63RISK
open ↗
Referência
CVE-2021-29447
CVE-2021-29447HIGH
WordPress Authenticated XXE attack when installation is running PHP 8
63RISK
open ↗
Referência
CVE-2011-4898
CVE-2011-4898—
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error message
23RISK
open ↗
Referência✓ VexDay Proof
MyPHPcommander 2.0 - 'package.php' Remote File Inclusion
CVE-2007-0568—webappsphp
PHP remote file inclusion vulnerability in system/lib/package.php in MyPHPCommander 2.0 allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
Ocean FTP Server 1.00 - Denial of Service
CVE-2005-0847—doswindows
Code Ocean FTP server 1.0 allows remote attackers to cause a denial of service via a large number of connections.
23RISK
open ↗
Referência
CVE-2015-4071
CVE-2015-4071—
The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users
23RISK
open ↗
Referência
CVE-2015-4071
CVE-2015-4071—
The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users
23RISK
open ↗
Referência
CVE-2013-5945
CVE-2013-5945—
Multiple SQL injection vulnerabilities in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.0
23RISK
open ↗
Referência
CVE-2018-8814
CVE-2018-8814—
Cross-site request forgery (CSRF) vulnerability in WolfCMS 0.8.3.1 allows remote attackers to hijack the authentication
23RISK
open ↗
Referência
CVE-2012-1417
CVE-2012-1417—
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow
23RISK
open ↗
Referência
CVE-2012-1417
CVE-2012-1417—
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow
23RISK
open ↗
Referência✓ VexDay Proof
FCRing 1.31 - 'fcring.php?s_fuss' Remote File Inclusion
CVE-2007-1133—webappsphp
PHP remote file inclusion vulnerability in fcring.php in FCRing 1.3 allows remote attackers to execute arbitrary PHP cod
23RISK
open ↗
Referência✓ VexDay Proof
phpCC 4.2 Beta - 'base_dir' Remote File Inclusion
CVE-2006-4073—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Fabian Hainz phpCC Beta 4.2 allow remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
Versado CMS 1.07 - 'ajax_listado.php?urlModulo' Remote File Inclusion
CVE-2007-2541—webappsphp
PHP remote file inclusion vulnerability in includes/ajax_listado.php in Versado CMS 1.07 allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
MG-SOFT Net Inspector 6.5.0.828 - Multiple Vulnerabilities
CVE-2008-1401—remotewindows
Format string vulnerability in the Net Inspector HTTP server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier fo
23RISK
open ↗
Referência✓ VexDay Proof
SIPS 0.3.1 - 'box.inc.php' Remote File Inclusion
CVE-2006-4733—webappsphp
PHP remote file inclusion vulnerability in sipssys/code/box.inc.php in Haakon Nilsen simple, integrated publishing syste
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin Spreadsheet 0.6 - SQL Injection
CVE-2008-1982—webappsphp
SQL injection vulnerability in ss_load.php in the Spreadsheet (wpSS) 0.6 and earlier plugin for WordPress allows remote
23RISK
open ↗
Referência✓ VexDay Proof
RSS-aggregator - 'path' Remote File Inclusion
CVE-2008-2884—webappsphp
PHP remote file inclusion vulnerability in display.php in RSS-aggregator allows remote attackers to execute arbitrary PH
23RISK
open ↗
Referência✓ VexDay Proof
Cisco Router - HTTP Administration Cross-Site Request Forgery / Command Execution (1)
CVE-2008-4128MEDIUMunder attackremotehardware
Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the
75RISK
open ↗
Referência
CVE-2026-14926
CVE-2026-14926MEDIUM
FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR
33RISK
open ↗
Referência✓ VexDay Proof
MDForum 2.0.1 - 'PNSVlang' Remote Code Execution
CVE-2006-6869—webappsphp
Directory traversal vulnerability in includes/search/search_mdforum.php in MAXdev MDForum 2.0.1 and earlier, when magic_
23RISK
open ↗
← previouspage 334 / 730next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.