Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,166cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,078VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
Focus/SIS 1.0/2.2 - Remote File Inclusion
CVE-2007-4806—webappsphp
PHP remote file inclusion vulnerability in modules/Discipline/CategoryBreakdownTime.php in Focus/SIS 1.0 allows remote a
23RISK
open ↗
Referência✓ VexDay Proof
EZWebAlbum - Remote File Disclosure
CVE-2008-3293—webappsphp
Directory traversal vulnerability in download.php in EZWebAlbum allows remote attackers to read arbitrary files via the
23RISK
open ↗
Referência✓ VexDay Proof
FipsCMS Light 2.1 - 'r' SQL Injection
CVE-2008-3417—webappsasp
SQL injection vulnerability in home/index.asp in fipsCMS light 2.1 and earlier allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2010-1659
CVE-2010-1659—
Directory traversal vulnerability in the Ultimate Portfolio (com_ultimateportfolio) component 1.0 for Joomla! allows rem
43RISK
open ↗
Referência
CVE-2015-5999
CVE-2015-5999—
Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2
23RISK
open ↗
Referência
CVE-2016-6754
CVE-2016-6754—
A remote code execution vulnerability in Webview in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-
23RISK
open ↗
Referência
CVE-2020-23839
CVE-2020-23839—
A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpa
28RISK
open ↗
Referência
CVE-2020-35754
CVE-2020-35754—
OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequentl
28RISK
open ↗
Referência✓ VexDay Proof
ProSysInfo TFTP Server TFTPDWIN 0.4.2 - 'UDP' Denial of Service
CVE-2007-1404—doswindows
tftpd.exe in ProSysInfo TFTP Server TFTPDWIN 0.4.2 allows remote attackers to cause a denial of service via a long UDP p
35RISK
open ↗
Referência✓ VexDay Proof
Coppermine Photo Gallery 1.4.18 - Local File Inclusion / Remote Code Execution
CVE-2008-3481—webappsphp
themes/sample/theme.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier allows remote attackers to obtain sensitive
23RISK
open ↗
Referência
CVE-2010-4799
CVE-2010-4799—
Multiple SQL injection vulnerabilities in Chipmunk Pwngame 1.0, when magic_quotes_gpc is disabled, allow remote attacker
23RISK
open ↗
Referência
CVE-2012-4768
CVE-2012-4768—
Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attac
43RISK
open ↗
Referência
CVE-2014-9224
CVE-2014-9224—
Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management serve
23RISK
open ↗
Referência✓ VexDay Proof
WSN Guest 1.23 - 'Search' SQL Injection
CVE-2009-0704—webappsphp
SQL injection vulnerability in search.php in WSN Guest 1.23 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência
CVE-2010-1352
CVE-2010-1352—
Directory traversal vulnerability in the JOOFORGE Jutebox (com_jukebox) component 1.0 and 1.7 for Joomla! allows remote
43RISK
open ↗
Referência✓ VexDay Proof
Coppermine Photo Gallery 1.4.18 - Local File Inclusion / Remote Code Execution
CVE-2008-3486—webappsphp
Directory traversal vulnerability in the user_get_profile function in include/functions.inc.php in Coppermine Photo Gall
23RISK
open ↗
Referência
CVE-2012-5896
CVE-2012-5896—
The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not prope
50RISK
open ↗
Referência
CVE-2010-0288
CVE-2010-0288—
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12
28RISK
open ↗
Referência
CVE-2012-5909
CVE-2012-5909—
SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers
23RISK
open ↗
Referência
CVE-2020-8819
CVE-2020-8819—
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in
23RISK
open ↗
Referência
CVE-2021-27885
CVE-2021-27885—
usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.
23RISK
open ↗
Referência
CVE-2021-42697
CVE-2021-42697—
Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, whic
35RISK
open ↗
Referência
CVE-2023-24217
CVE-2023-24217HIGH
AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.
41RISK
open ↗
Referência
CVE-2010-1980
CVE-2010-1980—
Directory traversal vulnerability in joomlaflickr.php in the Joomla Flickr (com_joomlaflickr) component 1.0.3 for Joomla
43RISK
open ↗
Referência
CVE-2013-10060
CVE-2013-10060CRITICAL
Netgear Routers pppoe.cgi RCE
63RISK
open ↗
Referência
CVE-2013-10060
CVE-2013-10060CRITICAL
Netgear Routers pppoe.cgi RCE
63RISK
open ↗
Referência
CVE-2013-10060
CVE-2013-10060CRITICAL
Netgear Routers pppoe.cgi RCE
63RISK
open ↗
Referência
CVE-2013-10060
CVE-2013-10060CRITICAL
Netgear Routers pppoe.cgi RCE
63RISK
open ↗
Referência
CVE-2026-84153
CVE-2026-84153MEDIUM
Xinhu Rainrock RockOA index.php toaddval sql injection
33RISK
open ↗
Referência
CVE-2026-77784
CVE-2026-77784LOW
Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as
28RISK
open ↗
← previouspage 436 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.