Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,166cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,078VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2022-39285
CVE-2022-39285HIGH
Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder
41RISK
open ↗
Referência
CVE-2026-4567
CVE-2026-4567CRITICAL
Tenda A15 UploadCfg stack-based overflow
48RISK
open ↗
Referência
CVE-2022-3481
CVE-2022-3481CRITICAL
WooCommerce Dropshipping < 4.4 - Unauthenticated SQLi
63RISK
open ↗
Referência
CVE-2026-86449
CVE-2026-86449MEDIUM
LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API
33RISK
open ↗
Referência✓ VexDay Proof
makit Newsposter Script 3.0 - SQL Injection
CVE-2007-0600—webappsasp
SQL injection vulnerability in news_page.asp in Martyn Kilbryde Newsposter Script (aka makit news/blog poster) 3 and ear
23RISK
open ↗
Referência
CVE-2010-1302
CVE-2010-1302—
Directory traversal vulnerability in dwgraphs.php in the DecryptWeb DW Graphs (com_dwgraphs) component 1.0 for Joomla! a
38RISK
open ↗
Referência
CVE-2017-17612
CVE-2017-17612—
Hot Scripts Clone 3.1 has SQL Injection via the /categories subctid or mctid parameter.
23RISK
open ↗
Referência
CVE-2023-3843
CVE-2023-3843LOW
mooSocial mooDating URL question cross site scripting
43RISK
open ↗
Referência
CVE-2018-18308
CVE-2018-18308—
In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (ak
23RISK
open ↗
Referência
CVE-2018-18308
CVE-2018-18308—
In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (ak
23RISK
open ↗
Referência
CVE-2018-5754
CVE-2018-5754—
Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and
23RISK
open ↗
Referência
CVE-2018-6024
CVE-2018-6024—
SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.
23RISK
open ↗
Referência
CVE-2017-0058
CVE-2017-0058—
A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides
23RISK
open ↗
Referência✓ VexDay Proof
Fullaspsite Asp Hosting Sitesi - 'tr' SQL Injection
CVE-2007-0678—webappsasp
SQL injection vulnerability in windows.asp in Fullaspsite Asp Hosting Sitesi allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2025-10162
CVE-2025-10162HIGH
OrderConvo <= 15.1 - Unauthenticated Arbitrary File Read
56RISK
open ↗
Referência✓ VexDay Proof
AuraCMS 2.1 - Remote File Attachment / Local File Inclusion
CVE-2007-4908—webappsphp
Directory traversal vulnerability in index.php in AuraCMS 2.1 and earlier allows remote attackers to include and execute
23RISK
open ↗
Referência
CVE-2023-33864
CVE-2023-33864CRITICAL
StreamReader::ReadFromExternal in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. It
48RISK
open ↗
Referência
CVE-2013-6976
CVE-2013-6976—
Cross-site request forgery (CSRF) vulnerability in goform/Quick_setup on Cisco EPC3925 devices allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
Weblosninger 4 - Cross-Site Scripting / SQL Injection
CVE-2008-2506—webappsphp
Multiple SQL injection vulnerabilities in Simpel Side Weblosning 1 through 4 allow remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2017-17612
CVE-2017-17612—
Hot Scripts Clone 3.1 has SQL Injection via the /categories subctid or mctid parameter.
23RISK
open ↗
Referência
CVE-2015-1701
CVE-2015-1701HIGHunder attackransomware
Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local
98RISK
open ↗
Referência✓ VexDay Proof
FlashGet 1.9.0.1012 - 'FTP PWD Response' Remote Buffer Overflow (SafeSEH)
CVE-2008-4321—remotewindows
Buffer overflow in FlashGet (formerly JetCar) FTP 1.9 allows remote FTP servers to execute arbitrary code via a long res
23RISK
open ↗
Referência
CVE-2026-10212
CVE-2026-10212MEDIUM
AstrBotDevs AstrBot astr_main_agent.py astr_main_agent authorization
33RISK
open ↗
Referência
CVE-2013-6976
CVE-2013-6976—
Cross-site request forgery (CSRF) vulnerability in goform/Quick_setup on Cisco EPC3925 devices allows remote attackers t
23RISK
open ↗
Referência
CVE-2026-10188
CVE-2026-10188HIGH
Tenda W12 httpd cgistaKickOff stack-based overflow
41RISK
open ↗
Referência✓ VexDay Proof
Atomic Photo Album 1.1.0pre4 - Cross-Site Scripting / SQL Injection
CVE-2008-4335—webappsphp
SQL injection vulnerability in album.php in Atomic Photo Album (APA) 1.1.0pre4 allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2017-17612
CVE-2017-17612—
Hot Scripts Clone 3.1 has SQL Injection via the /categories subctid or mctid parameter.
23RISK
open ↗
Referência
CVE-2018-12603
CVE-2018-12603—
Cross-site request forgery (CSRF) vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authen
23RISK
open ↗
Referência
CVE-2013-7375
CVE-2013-7375—
SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remo
23RISK
open ↗
Referência
CVE-2016-3411
CVE-2016-3411—
Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrar
23RISK
open ↗
← previouspage 448 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.