Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,060cataloged exploits

35,302CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,175GitHub PoC 14,096VulnCheck XDB 8,607Nuclei 4,257Metasploit 3,474✓ verified onlyrecent popular risk

22,175 exploits

Referência

CVE-2010-4974

CVE-2010-4974—

SQL injection vulnerability in info.php in BrotherScripts (BS) and ScriptsFeed Auto Dealer allows remote attackers to ex

23RISK

open ↗

Referência

CVE-2010-2034

CVE-2010-2034—

Directory traversal vulnerability in the Percha Image Attach (com_perchaimageattach) component 1.1 for Joomla! allows re

43RISK

open ↗

Referência

CVE-2020-13118

CVE-2020-13118—

An issue was discovered in Mikrotik-Router-Monitoring-System through 2018-10-22. SQL Injection exists in check_community

23RISK

open ↗

Referência

CVE-2010-2035

CVE-2010-2035—

Directory traversal vulnerability in the Percha Gallery (com_perchagallery) component 1.6 Beta for Joomla! allows remote

43RISK

open ↗

Referência

CVE-2014-8690

CVE-2014-8690—

Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, an

23RISK

open ↗

Referência

CVE-2014-8690

CVE-2014-8690—

Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, an

23RISK

open ↗

Referência✓ VexDay Proof

Quake 3 Engine 1.32b - 'R_RemapShader()' Remote Client Buffer Overflow

CVE-2006-2236—remotelinux

Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Castle Wolfenstein 1.41, and (3) Quake III

23RISK

open ↗

Referência

CVE-2026-15368

CVE-2026-15368HIGH

Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration

41RISK

open ↗

Referência

CVE-2026-15244

CVE-2026-15244HIGH

HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_view

41RISK

open ↗

Referência✓ VexDay Proof

MiniBB 2.0.5 - 'Language' Local File Inclusion

CVE-2007-3272—webappsphp

Directory traversal vulnerability in index.php in MiniBB 2.0.5 allows remote attackers to read arbitrary files via a ..

23RISK

open ↗

Referência

CVE-2016-1915

CVE-2016-1915—

Multiple cross-site scripting (XSS) vulnerabilities in BlackBerry Enterprise Server 12 (BES12) Self-Service before 12.4

23RISK

open ↗

Referência✓ VexDay Proof

EMO Realty Manager - 'ida' SQL Injection

CVE-2008-2265—webappsphp

SQL injection vulnerability in news.php in EMO Realty Manager allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2026-10551

CVE-2026-10551MEDIUM

Breeze Cache < 2.5.6 - Unauthenticated Stored XSS via Minify Library

33RISK

open ↗

Referência✓ VexDay Proof

phpBB User Viewed Posts Tracker 1.0 - Remote File Inclusion

CVE-2006-5223—webappsphp

PHP remote file inclusion vulnerability in includes/functions_user_viewed_posts.php in the Nivisec User Viewed Posts Tra

23RISK

open ↗

Referência

CVE-2017-15957

CVE-2017-15957—

my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.

23RISK

open ↗

Referência

CVE-2017-15957

CVE-2017-15957—

my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.

23RISK

open ↗

Referência✓ VexDay Proof

X-Forum 0.6.2 - Remote Command Execution

CVE-2009-1512—webappsphp

Static code injection vulnerability in X-Forum 0.6.2 allows remote authenticated administrators to inject arbitrary PHP

23RISK

open ↗

Referência

CVE-2010-4987

CVE-2010-4987—

SQL injection vulnerability in default.asp in KMSoft Guestbook (aka GBook) allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

OpenEMR 2.8.1 - 'srcdir' Multiple Remote File Inclusions

CVE-2006-5811—webappsphp

PHP remote file inclusion vulnerability in library/translation.inc.php in OpenEMR 2.8.1, with register_globals enabled,

23RISK

open ↗

Referência

CVE-2010-4988

CVE-2010-4988—

PHP remote file inclusion vulnerability in mod_chatting/themes/default/header.php in Family Connections Who is Chatting

23RISK

open ↗

Referência

CVE-2023-0037

CVE-2023-0037CRITICAL

10WebMapBuilder < 1.0.73 - Unauthenticated SQLi

63RISK

open ↗

Referência

CVE-2014-1636

CVE-2014-1636—

Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

Etomite CMS 0.6.1 - 'rfiles.php' Remote Command Execution

CVE-2006-7070—webappsphp

Unrestricted file upload vulnerability in manager/media/ibrowser/scripts/rfiles.php in Etomite CMS 0.6.1 and earlier all

23RISK

open ↗

Referência✓ VexDay Proof

PHP-Stats 0.1.9.2 - Multiple Vulnerabilities

CVE-2007-5453—webappsphp

Multiple eval injection vulnerabilities in Php-Stats 0.1.9.2 allow remote authenticated administrators to execute arbitr

23RISK

open ↗

Referência

CVE-2010-2042

CVE-2010-2042—

SQL injection vulnerability in search.php in ECShop 2.7.2 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

Freelance Auction Script 1.0 - 'browseproject.php' SQL Injection

CVE-2008-2278—webappsphp

SQL injection vulnerability in browseproject.php in Freelance Auction Script 1.0 allows remote attackers to execute arbi

23RISK

open ↗

Referência

CVE-2019-1642

CVE-2019-1642MEDIUM

Cisco Firepower Management Center Cross-Site Scripting Vulnerability

33RISK

open ↗

Referência✓ VexDay Proof

Internet PhotoShow (Special Edition) - Insecure Cookie Handling

CVE-2008-2282—webappsphp

admin.php in Internet Photoshow and Internet Photoshow Special Edition (SE) allows remote attackers to bypass authentica

23RISK

open ↗

Referência

CVE-2018-20503

CVE-2018-20503—

Allied Telesis 8100L/8 devices allow XSS via the edit-ipv4_interface.php vlanid or subnet_mask parameter.

23RISK

open ↗

Referência

CVE-2018-20503

CVE-2018-20503—

Allied Telesis 8100L/8 devices allow XSS via the edit-ipv4_interface.php vlanid or subnet_mask parameter.

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.