Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,231cataloged exploits
35,420CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecentpopularrisk
22,266 exploits
Referência
CVE-2023-25439
CVE-2023-25439MEDIUM
Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbitr
33RISK
open ↗
Referência
CVE-2018-12090
CVE-2018-12090—
There is unauthenticated reflected cross-site scripting (XSS) in LAMS before 3.1 that allows a remote attacker to introd
23RISK
open ↗
Referência✓ VexDay Proof
open-medium.CMS 0.25 - '404.php' Remote File Inclusion
CVE-2006-2683—webappsphp
PHP remote file inclusion vulnerability in 404.php in open-medium.CMS 0.25 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2012-4927
CVE-2012-4927—
SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attack
23RISK
open ↗
Referência
CVE-2012-4927
CVE-2012-4927—
SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
MyBloggie 2.1.6 - Multiple SQL Injections
CVE-2008-3080—webappsphp
Cross-site request forgery (CSRF) vulnerability in admin.php in myWebland myBloggie 2.1.6 allows remote attackers to per
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Brightcode Weblinks - 'catid' SQL Injection
CVE-2008-3083—webappsphp
SQL injection vulnerability in Brightcode Weblinks (com_brightweblinks) component for Joomla! allows remote attackers to
23RISK
open ↗
Referência
CVE-2009-3171
CVE-2009-3171—
Multiple cross-site scripting (XSS) vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to
23RISK
open ↗
Referência
CVE-2022-44900
CVE-2022-44900CRITICAL
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and ea
48RISK
open ↗
Referência
CVE-2016-6435
CVE-2016-6435—
The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via
50RISK
open ↗
Referência
CVE-2016-6483
CVE-2016-6483—
The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Le
28RISK
open ↗
Referência
CVE-2016-6505
CVE-2016-6505—
epan/dissectors/packet-packetbb.c in the PacketBB dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 allo
23RISK
open ↗
Referência✓ VexDay Proof
Simple Customer 1.3 - Arbitrary Change Admin Password
CVE-2009-1637—webappsphp
profile.php in Simple Customer 1.3 does not require administrative authentication, which allows remote attackers to chan
23RISK
open ↗
Referência✓ VexDay Proof
ASP Stats Generator 2.1.1 - SQL Injection
CVE-2006-3184—webappsasp
Direct static code injection vulnerability in ASP Stats Generator before 2.1.2 allows remote authenticated attackers to
23RISK
open ↗
Referência
CVE-2009-2337
CVE-2009-2337—
SQL injection vulnerability in includes/module/book/index.inc.php in w3b|cms Gaestebuch Guestbook Module 3.0.0, when mag
23RISK
open ↗
Referência
CVE-2011-5218
CVE-2011-5218—
SQL injection vulnerability in DotA OpenStats 1.3.9 and earlier allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência
CVE-2019-2721
CVE-2019-2721—
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions th
23RISK
open ↗
Referência
CVE-2009-2606
CVE-2009-2606—
ASP Football Pool 2.3 stores sensitive information under the web root with insufficient access control, which allows rem
23RISK
open ↗
Referência
CVE-2009-2602
CVE-2009-2602—
R2 Newsletter Lite, Pro, and Stats stores sensitive information under the web root with insufficient access control, whi
23RISK
open ↗
Referência
CVE-2018-25427
CVE-2018-25427CRITICAL
Arm Whois 3.11 Buffer Overflow via SEH Overwrite
48RISK
open ↗
Referência
CVE-2009-4545
CVE-2009-4545—
Logoshows BBS 2.0 stores sensitive information under the web root with insufficient access control, which allows remote
23RISK
open ↗
Referência
CVE-2022-47870
CVE-2022-47870MEDIUM
A Cross Site Scripting (XSS) vulnerability in the web SQL monitor login page in Redgate SQL Monitor 12.1.31.893 allows r
33RISK
open ↗
Referência
CVE-2010-0725
CVE-2010-0725—
Cross-site scripting (XSS) vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2010-0725
CVE-2010-0725—
Cross-site scripting (XSS) vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke NukeAI Module 3b - 'util.php' Remote File Inclusion
CVE-2006-6255—webappsphp
Direct static code injection vulnerability in util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Program E is an
23RISK
open ↗
Referência
CVE-2016-6600
CVE-2016-6600—
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remot
60RISK
open ↗
Referência
CVE-2026-46243
CVE-2026-46243HIGH
smb: client: reject userspace cifs.spnego descriptions
41RISK
open ↗
Referência✓ VexDay Proof
P-News 1.16/1.17 - 'user.dat' Remote Password Disclosure
CVE-2006-6888—webappsphp
P-News 1.16 and 1.17 store sensitive information under the web root with insufficient access control, which allows remot
23RISK
open ↗
Referência✓ VexDay Proof
MiniBB 2.2 - Cross-Site Scripting / SQL Injection / Full Path Disclosure
CVE-2008-2028—webappsphp
miniBB 2.2, and possibly earlier, when register_globals is enabled, allows remote attackers to obtain the full path via
23RISK
open ↗
Referência✓ VexDay Proof
XPOZE Pro 3.06 - 'uid' SQL Injection
CVE-2008-3089—webappsphp
SQL injection vulnerability in user.html in Xpoze Pro 3.06 (aka Xpoze Pro CMS 2008) allows remote attackers to execute a
23RISK
open ↗
← previouspage 416 / 743next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.