Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

26,240 exploits

Referência

CVE-2016-3053

CVE-2016-3053—

IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile

23RISK

open ↗

Referência

CVE-2017-14620

CVE-2017-14620—

SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQu

23RISK

open ↗

Referência

CVE-2019-13029

CVE-2019-13029—

Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9

23RISK

open ↗

Referência

CVE-2026-75800

CVE-2026-75800CRITICAL

Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse

48RISK

open ↗

Referência

CVE-2021-32403

CVE-2021-32403—

Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of security mecha

23RISK

open ↗

Referência✓ VexDay Proof

RicarGBooK 1.2.1 - 'lang' Local File Inclusion

CVE-2007-2050—webappsphp

Multiple directory traversal vulnerabilities in header.php in RicarGBooK 1.2.1 allow remote attackers to include and exe

23RISK

open ↗

Referência✓ VexDay Proof

PHP Coupon Script 3.0 - 'bus' SQL Injection

CVE-2007-2672—webappsphp

SQL injection vulnerability in index.php in PHP Coupon Script 3.0 allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência

CVE-2014-5100

CVE-2014-5100—

Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the au

23RISK

open ↗

Referência✓ VexDay Proof

xml2owl 0.1.1 - 'showcode.php' Remote Command Execution

CVE-2007-6632—webappsphp

showCode.php in xml2owl 0.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path

23RISK

open ↗

Referência

CVE-2010-0755

CVE-2010-0755—

PHP remote file inclusion vulnerability in include/WBmap.php in WikyBlog 1.7.3 rc2 allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

PHPMyCart 1.3 - 'cat' SQL Injection

CVE-2008-2904—webappsphp

SQL injection vulnerability in shop.php in Conkurent PHPMyCart allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

myPHPscripts Login Session 2.0 - Cross-Site Scripting / Database Disclosure

CVE-2008-5855—webappsphp

myPHPscripts Login Session 2.0 stores sensitive information under the web root with insufficient access control, which a

23RISK

open ↗

Referência

CVE-2010-0755

CVE-2010-0755—

PHP remote file inclusion vulnerability in include/WBmap.php in WikyBlog 1.7.3 rc2 allows remote attackers to execute ar

23RISK

open ↗

Referência

CVE-2012-2586

CVE-2012-2586—

Multiple cross-site scripting (XSS) vulnerabilities in Mailtraq 2.17.3.3150 allow remote attackers to inject arbitrary w

23RISK

open ↗

Referência

CVE-2004-1580

CVE-2004-1580—

SQL injection vulnerability in index.php in CubeCart 2.0.1 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência

CVE-2018-11532

CVE-2018-11532—

An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonst

23RISK

open ↗

Referência

CVE-2017-10129

CVE-2017-10129—

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version

23RISK

open ↗

Referência

CVE-2018-18419

CVE-2018-18419—

Stored XSS has been discovered in the upload section of ARDAWAN.COM User Management 1.1, as demonstrated by a .jpg filen

23RISK

open ↗

Referência

CVE-2015-6516

CVE-2015-6516—

SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

vhostadmin 0.1 - 'MODULES_DIR' Remote File Inclusion

CVE-2007-0558—webappsphp

PHP remote file inclusion vulnerability in modules/mail/main.php in Inter7 vHostAdmin 1.0 allows remote attackers to exe

23RISK

open ↗

Referência

CVE-2026-101262

CVE-2026-101262CRITICAL

Ziroom ZHOME A0101 set_online_client command injection

48RISK

open ↗

Referência✓ VexDay Proof

jGallery 1.3 - 'index.php' Remote File Inclusion

CVE-2007-2158—webappsphp

PHP remote file inclusion vulnerability in index.php in jGallery 1.3 allows remote attackers to execute arbitrary PHP co

23RISK

open ↗

Referência✓ VexDay Proof

Squirrelcart 1.x - 'cart.php' Remote File Inclusion

CVE-2007-4439—webappsphp

PHP remote file inclusion vulnerability in popup_window.php in Squirrelcart 1.x.x and earlier allows remote attackers to

23RISK

open ↗

Referência

CVE-2026-70619

CVE-2026-70619HIGH

Odysseus Missing Admin Authorization via Embedding Endpoint Routes

41RISK

open ↗

Referência

CVE-2010-0674

CVE-2010-0674—

StatCounteX 3.1 stores sensitive information under the web root with insufficient access control, which allows remote at

23RISK

open ↗

Referência

CVE-2010-0939

CVE-2010-0939—

Visialis ABB Forum 1.1 stores sensitive information under the web root with insufficient access control, which allows re

23RISK

open ↗

Referência✓ VexDay Proof

PEEL CMS 3.x - Admin Hash Extraction / Arbitrary File Upload

CVE-2008-1506—webappsphp

PEEL, possibly 3.x and earlier, allows remote attackers to obtain configuration information via a direct request to phpi

23RISK

open ↗

Referência

CVE-2010-0939

CVE-2010-0939—

Visialis ABB Forum 1.1 stores sensitive information under the web root with insufficient access control, which allows re

23RISK

open ↗

Referência

CVE-2010-2721

CVE-2010-2721—

SQL injection vulnerability in index.php in RightInPoint Lyrics Script 3.0 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2010-2721

CVE-2010-2721—

SQL injection vulnerability in index.php in RightInPoint Lyrics Script 3.0 allows remote attackers to execute arbitrary

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.