Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,302cataloged exploits
35,469CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,301GitHub PoC 14,141VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
22,301 exploits
Referência✓ VexDay Proof
Arab Portal 2.1 (Windows) - Remote File Disclosure
CVE-2008-5787—webappsphp
Directory traversal vulnerability in mod.php in Arab Portal 2.1 on Windows allows remote attackers to read arbitrary fil
23RISK
open ↗
Referência
CVE-2018-6363
CVE-2018-6363—
SQL Injection exists in Task Rabbit Clone 1.0 via the single_blog.php id parameter.
23RISK
open ↗
Referência
CVE-2018-6363
CVE-2018-6363—
SQL Injection exists in Task Rabbit Clone 1.0 via the single_blog.php id parameter.
23RISK
open ↗
Referência
CVE-2017-9614
CVE-2017-9614—
The fill_input_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service
23RISK
open ↗
Referência
CVE-2017-9614
CVE-2017-9614—
The fill_input_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service
23RISK
open ↗
Referência
CVE-2014-3961
CVE-2014-3961—
SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allo
23RISK
open ↗
Referência
CVE-2010-1711
CVE-2010-1711—
Cross-site scripting (XSS) vulnerability in carga_foto_al.php in Siestta 2.0, when register_globals is enabled, allows r
23RISK
open ↗
Referência
CVE-2010-1711
CVE-2010-1711—
Cross-site scripting (XSS) vulnerability in carga_foto_al.php in Siestta 2.0, when register_globals is enabled, allows r
23RISK
open ↗
Referência✓ VexDay Proof
Jupiter CMS 1.1.5 - '/index.php' Local/Remote File Inclusion
CVE-2007-0987—webappsphp
Directory traversal vulnerability in index.php in Jupiter CMS 1.1.5 allows remote attackers to include and execute arbit
23RISK
open ↗
Referência
CVE-2019-0570
CVE-2019-0570—
An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka "Windo
23RISK
open ↗
Referência✓ VexDay Proof
Link Request Contact Form 3.4 - Remote Code Execution
CVE-2007-3199—webappsphp
Unrestricted file upload vulnerability in Link Request Contact Form 3.4 allows remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência
CVE-2009-2923
CVE-2009-2923—
Multiple directory traversal vulnerabilities in BitmixSoft PHP-Lance 1.52 allow remote attackers to read arbitrary files
23RISK
open ↗
Referência
CVE-2012-5387
CVE-2012-5387—
Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordP
23RISK
open ↗
Referência
CVE-2009-4386
CVE-2009-4386—
SQL injection vulnerability in hotel_tiempolibre_ext.php in Venalsur Booking Centre Booking System for Hotels Group, whe
23RISK
open ↗
Referência✓ VexDay Proof
Simple Machines Forum (SMF) 1.1.3 - Blind SQL Injection
CVE-2007-5646—webappsphp
SQL injection vulnerability in Sources/Search.php in Simple Machines Forum (SMF) 1.1.3, when MySQL 5 is used, allows rem
23RISK
open ↗
Referência✓ VexDay Proof
PowerPHPBoard 1.00b - Multiple Local File Inclusions
CVE-2008-1534—webappsphp
Multiple directory traversal vulnerabilities in PowerPHPBoard 1.00b allow remote attackers to include and execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
ITechBids 7.0 gold - Cross-Site Scripting / SQL Injection
CVE-2008-3237—webappsphp
Cross-site scripting (XSS) vulnerability in forward_to_friend.php in ITechBids 7.0 Gold allows remote attackers to injec
23RISK
open ↗
Referência✓ VexDay Proof
easysite 2.3 - Multiple Vulnerabilities
CVE-2008-4155—webappsphp
Multiple directory traversal vulnerabilities in EasySite 2.3 allow remote attackers to read arbitrary files or list dire
23RISK
open ↗
Referência✓ VexDay Proof
PowerPortal 2.0.13 - 'path' Local Directory Traversal
CVE-2008-4361—webappsphp
Directory traversal vulnerability in PowerPortal 2.0.13 allows remote attackers to list and possibly read arbitrary file
23RISK
open ↗
Referência
CVE-2025-8730
CVE-2025-8730CRITICAL
Belkin F9K1009/F9K1010 Web Interface hard-coded credentials
48RISK
open ↗
Referência
CVE-2009-4082
CVE-2009-4082—
PHP remote file inclusion vulnerability in forums/Forum_Include/index.php in Outreach Project Tool (OPT) 1.2.7 and earli
23RISK
open ↗
Referência
CVE-2009-4082
CVE-2009-4082—
PHP remote file inclusion vulnerability in forums/Forum_Include/index.php in Outreach Project Tool (OPT) 1.2.7 and earli
23RISK
open ↗
Referência✓ VexDay Proof
Crysis 1.1.1.5879 - Remote Format String Denial of Service (PoC)
CVE-2008-1127—doswindows
Format string vulnerability in the cryactio function in Crysis 1.1.1.5879 allows remote authenticated users to execute a
23RISK
open ↗
Referência
CVE-2010-1114
CVE-2010-1114—
Multiple PHP remote file inclusion vulnerabilities in Web Server Creator - Web Portal 0.1 allow remote attackers to exec
23RISK
open ↗
Referência
CVE-2019-16197
CVE-2019-16197—
In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document
23RISK
open ↗
Referência
CVE-2010-0975
CVE-2010-0975—
PHP remote file inclusion vulnerability in external.php in PHPCityPortal allows remote attackers to execute arbitrary PH
23RISK
open ↗
Referência
CVE-2010-0975
CVE-2010-0975—
PHP remote file inclusion vulnerability in external.php in PHPCityPortal allows remote attackers to execute arbitrary PH
23RISK
open ↗
Referência
CVE-2010-1703
CVE-2010-1703—
Multiple cross-site scripting (XSS) vulnerabilities in index_search.php in 2daybiz Polls (aka Advanced Poll) Script allo
23RISK
open ↗
Referência
CVE-2010-1703
CVE-2010-1703—
Multiple cross-site scripting (XSS) vulnerabilities in index_search.php in 2daybiz Polls (aka Advanced Poll) Script allo
23RISK
open ↗
Referência
CVE-2014-3961
CVE-2014-3961—
SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allo
23RISK
open ↗
← previouspage 433 / 744next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.