Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

26,240 exploits

Referência

CVE-2016-3974

CVE-2016-3974—

XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remo

28RISK

open ↗

Referência

CVE-2010-4399

CVE-2010-4399—

Directory traversal vulnerability in languages.inc.php in DynPG CMS 4.1.1 and 4.2.0, when magic_quotes_gpc is disabled,

23RISK

open ↗

Referência✓ VexDay Proof

Black Ice Software Inc Barcode SDK - 'BITiff.ocx' Remote Buffer Overflow (1)

CVE-2008-2693—remotewindows

Stack-based buffer overflow in the BITIFF.BITiffCtrl.1 ActiveX control in BITiff.ocx 10.9.3.0 in Black Ice Barcode SDK 5

28RISK

open ↗

Referência

CVE-2013-5961

CVE-2013-5961—

Unrestricted file upload vulnerability in lazyseo.php in the Lazy SEO plugin 1.1.9 for WordPress allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

JiRo's FAQ Manager eXperience 1.0 - 'fID' SQL Injection

CVE-2008-2691—webappsasp

SQL injection vulnerability in read.asp in JiRo's FAQ Manager eXperience 1.0 allows remote attackers to execute arbitrar

23RISK

open ↗

Referência

CVE-2022-39290

CVE-2022-39290HIGH

CSRF key bypass using HTTP methods in zoneminder

41RISK

open ↗

Referência

CVE-2024-0566

CVE-2024-0566HIGH

Smart Manager < 8.28.0 - Admin+ SQL Injection

41RISK

open ↗

Referência

CVE-2016-0007

CVE-2016-0007—

The sandbox implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8,

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_pccookbook - 'recipe_id' Blind SQL Injection

CVE-2009-0329—webappsphp

SQL injection vulnerability in the PcCookBook (com_pccookbook) component for Joomla! allows remote attackers to execute

23RISK

open ↗

Referência

CVE-2026-94298

CVE-2026-94298MEDIUM

BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter

33RISK

open ↗

Referência

CVE-2023-54405

CVE-2023-54405CRITICAL

H3C CVM Unauthenticated File Upload via fileUpload/upload Token

48RISK

open ↗

Referência

CVE-2009-3598

CVE-2009-3598—

Cross-site scripting (XSS) vulnerability in survey_result.php in eCardMAX FormXP 2007 allows remote attackers to inject

23RISK

open ↗

Referência

CVE-2011-2641

CVE-2011-2641—

Opera 11.11 allows remote attackers to cause a denial of service (application crash) by setting the FACE attribute of a

23RISK

open ↗

Referência

CVE-2009-3364

CVE-2009-3364—

Stack-based buffer overflow in FTPShell Client 4.1 RC2 allows remote FTP servers to execute arbitrary code via a long re

23RISK

open ↗

Referência

CVE-2013-4949

CVE-2013-4949—

Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code b

23RISK

open ↗

Referência

CVE-2016-0007

CVE-2016-0007—

The sandbox implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8,

23RISK

open ↗

Referência

CVE-2003-1160

CVE-2003-1160—

FlexWATCH Network video server 132 allows remote attackers to bypass authentication and gain administrative privileges v

23RISK

open ↗

Referência

CVE-2019-13383

CVE-2019-13383—

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a usern

28RISK

open ↗

Referência

CVE-2013-2271

CVE-2013-2271—

The D-Link DSL-2740B Gateway with firmware EU_1.0, when an active administrator session exists, allows remote attackers

23RISK

open ↗

Referência

CVE-2016-0861

CVE-2016-0861—

General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authentica

28RISK

open ↗

Referência

CVE-2019-9591

CVE-2019-9591—

A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attack

23RISK

open ↗

Referência

CVE-2017-15664

CVE-2017-15664—

In Flexense Sync Breeze Enterprise v10.1.16, the Control Protocol suffers from a denial of service vulnerability. The at

23RISK

open ↗

Referência✓ VexDay Proof

Total Video Player 1.03 - '.m3u' File Local Buffer Overflow

CVE-2007-0949—localwindows

Stack-based buffer overflow in iTinySoft Studio Total Video Player 1.03, and possibly earlier, allows remote attackers t

28RISK

open ↗

Referência

CVE-2019-9591

CVE-2019-9591—

A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attack

23RISK

open ↗

Referência

CVE-2022-40347

CVE-2022-40347CRITICAL

SQL Injection vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'phone', 'email', 'deptType

48RISK

open ↗

Referência

CVE-2010-4879

CVE-2010-4879—

PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2026-91072

CVE-2026-91072MEDIUM

EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler

33RISK

open ↗

Referência

CVE-2023-33584

CVE-2023-33584CRITICAL

Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to

53RISK

open ↗

Referência

CVE-2026-91051

CVE-2026-91051MEDIUM

EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta

33RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component mosmedia 1.0.8 - Remote File Inclusion

CVE-2007-2043—webappsphp

Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia (com_mosmedia) 1.08 and earlier

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.