Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,151cataloged exploits
35,370CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecentpopularrisk
22,175 exploits
Referência
CVE-2010-0936
CVE-2010-0936—
Cross-site scripting (XSS) vulnerability in auth.asp on the D-LINK DKVM-IP8 with firmware 2282_dlinkA4_p8_20071213 allow
23RISK
open ↗
Referência
CVE-2009-3153
CVE-2009-3153—
Multiple cross-site scripting (XSS) vulnerabilities in x10 MP3 Search engine 1.6.5 allow remote attackers to inject arbi
23RISK
open ↗
Referência✓ VexDay Proof
SunShop Shopping Cart 4.1.4 - 'id' SQL Injection
CVE-2008-3768—webappsphp
Multiple SQL injection vulnerabilities in class.ajax.php in Turnkey Web Tools SunShop Shopping Cart before 4.1.5 allow r
23RISK
open ↗
Referência✓ VexDay Proof
gf-3xplorer 2.4 - Cross-Site Scripting / Local File Inclusion
CVE-2007-6474—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in GF-3XPLORER 2.4 allow remote attackers to inject arbitrary web sc
23RISK
open ↗
Referência
CVE-2009-2778
CVE-2009-2778—
Cross-site scripting (XSS) vulnerability in visitor/view.php in GarageSales Script allows remote attackers to inject arb
23RISK
open ↗
Referência
CVE-2012-5918
CVE-2012-5918—
razorCMS 1.2 allows remote authenticated users to access administrator directories and files by creating and deleting a
23RISK
open ↗
Referência✓ VexDay Proof
427bb 2.3.1 - SQL Injection / Cross-Site Scripting
CVE-2008-2561—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in 427BB 2.3.1 allow remote attackers to inject arbitrary web script
23RISK
open ↗
Referência✓ VexDay Proof
NetRisk 1.9.7 - Cross-Site Scripting / SQL Injection
CVE-2008-0186—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in NetRisk 1.9.7 and possibly earlier allows remote attackers to i
23RISK
open ↗
Referência
CVE-2026-8757
CVE-2026-8757MEDIUM
adenhq hive Delete Request routes_sessions.py _read_events_tail path traversal
33RISK
open ↗
Referência
CVE-2026-8756
CVE-2026-8756MEDIUM
fishaudio Bert-VITS2 Gradio webui_preprocess.py generate_config path traversal
33RISK
open ↗
Referência
CVE-2013-5656
CVE-2013-5656—
FuzeZip 1.0.0.131625 has a Local Buffer Overflow vulnerability
23RISK
open ↗
Referência✓ VexDay Proof
myPHPNuke < 1.8.8_8rc2 - Cross-Site Scripting / SQL Injection
CVE-2008-4089—webappsphp
Cross-site scripting (XSS) vulnerability in print.php in myPHPNuke (MPN) before 1.8.8_8rc2 allows remote attackers to in
23RISK
open ↗
Referência
CVE-2007-4434
CVE-2007-4434—
Cross-site scripting (XSS) vulnerability in textfilesearch.asp in the Text File Search ASP (Classic) edition allows remo
23RISK
open ↗
Referência
CVE-2018-25334
CVE-2018-25334MEDIUM
Zechat 1.5 Cross-Site Request Forgery (CSRF) via hashtag parameter
33RISK
open ↗
Referência✓ VexDay Proof
ourvideo CMS 9.5 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2008-2979—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in phpi/login.php in Ourvideo CMS 9.5 allow remote attackers to inje
23RISK
open ↗
Referência✓ VexDay Proof
ClanLite 2.x - SQL Injection / Cross-Site Scripting
CVE-2008-5214—webappsphp
Cross-site scripting (XSS) vulnerability in service/calendrier.php in ClanLite 2.2006.05.20 allows remote attackers to i
23RISK
open ↗
Referência✓ VexDay Proof
SyndeoCMS 2.6.0 - Local File Inclusion / Cross-Site Scripting
CVE-2008-5271—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Fred Stuurman SyndeoCMS 2.6.0 allows remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
isweb CMS 3.0 - SQL Injection / Cross-Site Scripting
CVE-2008-5933—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in index.php in CMS ISWEB 3.0 allow remote attackers to inject arbit
23RISK
open ↗
Referência✓ VexDay Proof
WEBBDOMAIN WebShop 1.02 - SQL Injection / Cross-Site Scripting
CVE-2008-6629—webappsphp
Cross-site scripting (XSS) vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote a
23RISK
open ↗
Referência
CVE-2016-7084
CVE-2016-7084—
tpview.dll in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, whe
23RISK
open ↗
Referência
CVE-2022-40684
CVE-2022-40684CRITICALunder attackransomware
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
100RISK
open ↗
Referência
CVE-2022-40684
CVE-2022-40684CRITICALunder attackransomware
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
100RISK
open ↗
Referência
CVE-2025-34111
CVE-2025-34111CRITICAL
Tiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCE
63RISK
open ↗
Referência
CVE-2025-34111
CVE-2025-34111CRITICAL
Tiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCE
63RISK
open ↗
Referência✓ VexDay Proof
Txx CMS 0.2 - Multiple Remote File Inclusions
CVE-2007-4819—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Txx CMS 0.2 allow remote attackers to inject arbitrary web script
23RISK
open ↗
Referência✓ VexDay Proof
Vigile CMS 1.4 - Multiple Vulnerabilities
CVE-2007-6085—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in index.php in VigileCMS 1.4 allow remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2014-125126
CVE-2014-125126CRITICAL
Simple E-Document Arbitrary File Upload RCE
63RISK
open ↗
Referência
CVE-2014-125126
CVE-2014-125126CRITICAL
Simple E-Document Arbitrary File Upload RCE
63RISK
open ↗
Referência
CVE-2010-4852
CVE-2010-4852—
Cross-site scripting (XSS) vulnerability in login.php in Eclime 1.1.2b allows remote attackers to inject arbitrary web s
23RISK
open ↗
Referência
CVE-2010-4852
CVE-2010-4852—
Cross-site scripting (XSS) vulnerability in login.php in Eclime 1.1.2b allows remote attackers to inject arbitrary web s
23RISK
open ↗
← previouspage 383 / 740next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.