Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,164cataloged exploits
40,551CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,076VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2026-86517
CVE-2026-86517MEDIUM
itsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql injection
33RISK
open ↗
Referência
CVE-2026-101013
CVE-2026-101013MEDIUM
mathurvishal CloudClassroom-PHP-Project updateresultdetails.php sql injection
33RISK
open ↗
Referência
CVE-2009-4220
CVE-2009-4220—
PHP remote file inclusion vulnerability in includes/classes/pctemplate.php in PointComma 3.8b2 and earlier allows remote
23RISK
open ↗
Referência✓ VexDay Proof
FdWeB Espace Membre 2.01 - 'path' Remote File Inclusion
CVE-2007-0301—webappsphp
PHP remote file inclusion vulnerability in _admin/admin_menu.php in FdWeB Espace Membre 2.1 and earlier allows remote at
23RISK
open ↗
Referência
CVE-2010-3206
CVE-2010-3206—
Multiple PHP remote file inclusion vulnerabilities in DiY-CMS 1.0 allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗
Referência
CVE-2015-7602
CVE-2015-7602—
Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (d
50RISK
open ↗
Referência✓ VexDay Proof
Mutant 0.9.2 - 'mutant_functions.php' Remote File Inclusion
CVE-2007-1961—webappsphp
PHP remote file inclusion vulnerability in mutant_functions.php in the Mutant 0.9.2 portal for phpBB 2.2 allows remote a
23RISK
open ↗
Referência✓ VexDay Proof
Expow 0.8 - 'autoindex.php?cfg_file' Remote File Inclusion
CVE-2007-2302—webappsphp
PHP remote file inclusion vulnerability in autoindex.php in Expow 0.8 allows remote attackers to execute arbitrary PHP c
23RISK
open ↗
Referência✓ VexDay Proof
NewsSync for phpBB 1.5.0rc6 - Remote File Inclusion
CVE-2007-3136—webappsphp
PHP remote file inclusion vulnerability in inc/nuke_include.php in newsSync 1.5.0rc6 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
MyCMS 0.9.8 - Remote Command Execution (2)
CVE-2007-3585—webappsphp
PHP remote file inclusion vulnerability in games.php in MyCMS 0.9.8 and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
eXtremail 2.1.1 - Remote Heap Overflow (PoC)
CVE-2007-5466—doslinux
Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending
28RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Gaming Cheats - SQL Injection
CVE-2008-6244—webappsphp
SQL injection vulnerability in view_reviews.php in Scripts for Sites (SFS) EZ Gaming Cheats allows remote attackers to e
23RISK
open ↗
Referência
CVE-2009-4220
CVE-2009-4220—
PHP remote file inclusion vulnerability in includes/classes/pctemplate.php in PointComma 3.8b2 and earlier allows remote
23RISK
open ↗
Referência
CVE-2009-4231
CVE-2009-4231—
Directory traversal vulnerability in as/lib/plugins.php in SweetRice 0.5.3 and earlier allows remote attackers to includ
23RISK
open ↗
Referência
CVE-2017-9516
CVE-2017-9516—
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
23RISK
open ↗
Referência
CVE-2018-17588
CVE-2018-17588—
AirTies Air 5021 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.
23RISK
open ↗
Referência
CVE-2015-1424
CVE-2015-1424—
Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentic
23RISK
open ↗
Referência
CVE-2018-9183
CVE-2018-9183—
The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS.
23RISK
open ↗
Referência
CVE-2021-24444
CVE-2021-24444—
TaxoPress < 3.0.7.2 - Authenticated Stored Cross-Site Scripting (XSS)
23RISK
open ↗
Referência
CVE-2009-4739
CVE-2009-4739—
PHP remote file inclusion vulnerability in index.php in SkaDate Dating allows remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência
CVE-2010-0680
CVE-2010-0680—
Directory traversal vulnerability in index.php in ZeusCMS 0.2 allows remote attackers to include and execute arbitrary l
23RISK
open ↗
Referência
CVE-2016-4337
CVE-2016-4337—
SQL injection vulnerability in the mgr.login.php file in Ktools.net Photostore before 4.7.5 allows remote attackers to e
23RISK
open ↗
Referência
CVE-2021-47728
CVE-2021-47728CRITICAL
Selea Targa IP Camera Remote Code Execution via Utils
48RISK
open ↗
Referência
CVE-2017-9516
CVE-2017-9516—
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
23RISK
open ↗
Referência
CVE-2025-34100
CVE-2025-34100CRITICAL
BuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File Upload
63RISK
open ↗
Referência
CVE-2025-34100
CVE-2025-34100CRITICAL
BuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File Upload
63RISK
open ↗
Referência
CVE-2026-86285
CVE-2026-86285MEDIUM
BookStack Attachment Edit Endpoint AttachmentController.php getUpdateForm access control
33RISK
open ↗
Referência
CVE-2012-5225
CVE-2012-5225—
Cross-site scripting (XSS) vulnerability in webscr.php in xClick Cart 1.0.1 and 1.0.2 allows remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
A-shop 0.70 - Remote File Deletion
CVE-2007-3936—webappsasp
Directory traversal vulnerability in admin/filebrowser.asp in A-shop 0.70 and earlier, and possibly 0.71, allows remote
23RISK
open ↗
Referência
CVE-2009-4099
CVE-2009-4099—
SQL injection vulnerability in the Google Calendar GCalendar (com_gcalendar) component 1.1.2, 2.1.4, and possibly earlie
23RISK
open ↗
← previouspage 430 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.