Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,151cataloged exploits

35,370CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecent popular risk

22,233 exploits

Referência

CVE-2026-13432

CVE-2026-13432MEDIUM

ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation

33RISK

open ↗

Referência

CVE-2026-13156

CVE-2026-13156MEDIUM

MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF

33RISK

open ↗

Referência

CVE-2026-12972

CVE-2026-12972MEDIUM

PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering

33RISK

open ↗

Referência

CVE-2026-12898

CVE-2026-12898MEDIUM

All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal

33RISK

open ↗

Referência

CVE-2019-6282

CVE-2019-6282—

ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpag

23RISK

open ↗

Referência

CVE-2015-2055

CVE-2015-2055—

Zhone GPON 2520 with firmware R4.0.2.566b allows remote attackers to cause a denial of service via a long string in the

23RISK

open ↗

Referência

CVE-2014-3804

CVE-2014-3804—

The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a

60RISK

open ↗

Referência

CVE-2017-11321

CVE-2017-11321—

The restricted shell interface in UCOPIA Wireless Appliance before 5.1.8 allows remote authenticated users to gain 'admi

23RISK

open ↗

Referência

CVE-2009-4365

CVE-2009-4365—

Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ScriptsEz Ez Blog 1.0 allow remote attackers

23RISK

open ↗

Referência

CVE-2010-20121

CVE-2010-20121CRITICAL

EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow

63RISK

open ↗

Referência

CVE-2010-20121

CVE-2010-20121CRITICAL

EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow

63RISK

open ↗

Referência

CVE-2010-20121

CVE-2010-20121CRITICAL

EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow

63RISK

open ↗

Referência

CVE-2010-20121

CVE-2010-20121CRITICAL

EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow

63RISK

open ↗

Referência

CVE-2017-5798

CVE-2017-5798—

A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP ve

23RISK

open ↗

Referência

CVE-2010-20121

CVE-2010-20121CRITICAL

EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow

63RISK

open ↗

Referência

CVE-2010-20121

CVE-2010-20121CRITICAL

EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow

63RISK

open ↗

Referência

CVE-2010-20121

CVE-2010-20121CRITICAL

EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow

63RISK

open ↗

Referência

CVE-2012-5349

CVE-2012-5349—

Multiple cross-site scripting (XSS) vulnerabilities in pay.php in the Pay With Tweet plugin before 1.2 allow remote atta

23RISK

open ↗

Referência

CVE-2022-50944

CVE-2022-50944HIGH

Aero CMS 0.0.1 PHP Code Injection via posts.php

41RISK

open ↗

Referência

CVE-2023-53963

CVE-2023-53963CRITICAL

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command Injection

48RISK

open ↗

Referência

CVE-2020-35437

CVE-2020-35437—

Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar[path] parameter in a POST request to the

23RISK

open ↗

Referência✓ VexDay Proof

Absolute Poll Manager XE 4.1 - 'xlacomments.asp' SQL Injection

CVE-2008-4569—webappsasp

SQL injection vulnerability in xlacomments.asp in XIGLA Software Absolute Poll Manager XE 4.1 allows remote attackers to

23RISK

open ↗

Referência

CVE-2017-14848

CVE-2017-14848—

WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter.

23RISK

open ↗

Referência

CVE-2009-2395

CVE-2009-2395—

SQL injection vulnerability in the K2 (com_k2) component 1.0.1 Beta and earlier for Joomla! allows remote attackers to e

23RISK

open ↗

Referência✓ VexDay Proof

open NewsLetter 2.5 - Multiple Vulnerabilities (2)

CVE-2006-6786—webappsphp

Open Newsletter 2.5 and earlier allows remote authenticated administrators to execute arbitrary PHP code by inserting th

23RISK

open ↗

Referência

CVE-2009-3601

CVE-2009-3601—

Cross-site scripting (XSS) vulnerability in demo_page.php in Scriptsez Ultimate Poll allows remote attackers to inject a

23RISK

open ↗

Referência✓ VexDay Proof

Valdersoft Shopping Cart 3.0 - Remote Command Execution

CVE-2006-0099—webappsphp

PHP remote file include vulnerability in (1) include/templates/categories/default.php and (2) certain other include/temp

23RISK

open ↗

Referência

CVE-2018-11415

CVE-2018-11415—

SAP Internet Transaction Server (ITS) 6200.X.X has Reflected Cross Site Scripting (XSS) via certain wgate URIs. NOTE: th

23RISK

open ↗

Referência

CVE-2004-1521

CVE-2004-1521—

Eudora 6.2.0.14 does not issue a warning when a user forwards an e-mail message that contains base64 or quoted-printable

23RISK

open ↗

Referência

CVE-2010-4781

CVE-2010-4781—

index.php in Enano CMS 1.1.7pl1, and possibly other versions before 1.1.8, 1.0.6pl3, and 1.1.7pl2, allows remote attacke

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.