Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
OpenElec 3.01 - 'obj' Local File Inclusion
CVE-2008-6025—webappsphp
Directory traversal vulnerability in scr/form.php in openElec 3.01 and earlier allows remote attackers to include and ex
23RISK
open ↗
Referência
CVE-2026-19848
CVE-2026-19848MEDIUM
ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name
33RISK
open ↗
Referência✓ VexDay Proof
Mozilla Firefox - unclamped loop Denial of Service
CVE-2009-1827—dosmultiple
The SVG component in Mozilla Firefox 3.0.4 allows remote attackers to cause a denial of service (application hang) via a
23RISK
open ↗
Referência
CVE-2010-0953
CVE-2010-0953—
Directory traversal vulnerability in mod.php in phpCOIN 1.2.1 allows remote attackers to read arbitrary files via a .. (
23RISK
open ↗
Referência
CVE-2010-1743
CVE-2010-1743—
SQL injection vulnerability in projects.php in Scratcher allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Referência
CVE-2010-2124
CVE-2010-2124—
SQL injection vulnerability in firma.php in Bartels Schone ConPresso 4.0.7 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2012-4259
CVE-2012-4259—
Cross-site scripting (XSS) vulnerability in the contacts in (1) XPhone UC Web and the (2) web frontend for XPhone Virtua
23RISK
open ↗
Referência
CVE-2012-4926
CVE-2012-4926—
approve.php in Img Pals Photo Host 1.0 does not authenticate requests, which allows remote attackers to change the activ
23RISK
open ↗
Referência
CVE-2013-5791
CVE-2013-5791—
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.0 and 8.4.1 allo
23RISK
open ↗
Referência
CVE-2015-2866
CVE-2015-2866—
SQL injection vulnerability on the Grandstream GXV3611_HD camera with firmware before 1.0.3.9 beta allows remote attacke
23RISK
open ↗
Referência
CVE-2015-6944
CVE-2015-6944—
Cross-site request forgery (CSRF) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to hijack the a
23RISK
open ↗
Referência
CVE-2016-10033
CVE-2016-10033CRITICALunder attack
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗
Referência
CVE-2017-8836
CVE-2017-8836—
CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_
23RISK
open ↗
Referência
CVE-2018-11332
CVE-2018-11332—
Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in
23RISK
open ↗
Referência
CVE-2020-8825
CVE-2020-8825—
index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.
23RISK
open ↗
Referência
CVE-2026-13726
CVE-2026-13726HIGH
Multiple Page Generator Plugin – MPG < 4.1.8 - Reflected XSS via mpg_shortcode
41RISK
open ↗
Referência✓ VexDay Proof
Artmedic CMS 3.4 - 'index.php' Local File Inclusion
CVE-2007-5600—webappsphp
Incomplete blacklist vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
Pre Real Estate Listings - Arbitrary File Upload
CVE-2008-7052—webappsphp
Unrestricted file upload vulnerability in profile.php in Pre Projects Pre Real Estate Listings allows remote authenticat
23RISK
open ↗
Referência
CVE-2010-0801
CVE-2010-0801—
Directory traversal vulnerability in the AutartiTarot (com_autartitarot) component 1.0.3 for Joomla! allows remote authe
23RISK
open ↗
Referência
CVE-2010-1878
CVE-2010-1878—
Directory traversal vulnerability in the OrgChart (com_orgchart) component 1.0.0 for Joomla! allows remote attackers to
43RISK
open ↗
Referência
CVE-2012-6523
CVE-2012-6523—
Multiple cross-site scripting (XSS) vulnerabilities in w-CMS 2.01 allow remote attackers to inject arbitrary web script
23RISK
open ↗
Referência✓ VexDay Proof
Kensei Board 2.0.0b - Multiple SQL Injections
CVE-2009-1853—webappsphp
Multiple SQL injection vulnerabilities in index.php in Kensei Board 2.0 BETA (aka 2.0.0b) and earlier allow remote attac
23RISK
open ↗
Referência
CVE-2016-10033
CVE-2016-10033CRITICALunder attack
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗
Referência
CVE-2017-15580
CVE-2017-15580—
osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly v
28RISK
open ↗
Referência
CVE-2016-10033
CVE-2016-10033CRITICALunder attack
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗
Referência
CVE-2017-1085
CVE-2017-1085—
In FreeBSD before 11.2-RELEASE, an application which calls setrlimit() to increase RLIMIT_STACK may turn a read-only mem
23RISK
open ↗
Referência
CVE-2017-15665
CVE-2017-15665—
In Flexense DiskBoss Enterprise 8.5.12, the Control Protocol suffers from a denial of service vulnerability. The attack
23RISK
open ↗
Referência
CVE-2021-26078
CVE-2021-26078—
The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before
23RISK
open ↗
Referência
CVE-2023-6906
CVE-2023-6906CRITICAL
Totolink A7100RU HTTP POST Request main buffer overflow
48RISK
open ↗
Referência
CVE-2025-2618
CVE-2025-2618CRITICAL
D-Link DAP-1620 Path api set_ws_action heap-based overflow
48RISK
open ↗
← previouspage 469 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.