Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits

40,553CVEs with public exploitation

24,696lab-tested

All Referência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecent popular risk

26,240 exploits

Referência

CVE-2016-10045

CVE-2016-10045—

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman

60RISK

open ↗

Referência

CVE-2012-3294

CVE-2012-3294—

Multiple cross-site request forgery (CSRF) vulnerabilities in the Web Gateway component in IBM WebSphere MQ File Transfe

23RISK

open ↗

Referência✓ VexDay Proof

PeopleAggregator 1.2pre6-release-53 - Multiple Remote File Inclusions

CVE-2007-5631—webappsphp

Multiple PHP remote file inclusion vulnerabilities in PeopleAggregator 1.2pre6, when register_globals is enabled, allow

35RISK

open ↗

Referência

CVE-2017-14016

CVE-2017-14016—

A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. The applicati

43RISK

open ↗

Referência

CVE-2010-3486

CVE-2010-3486—

Directory traversal vulnerability in FileStorageUpload.ashx in SmarterMail 7.1.3876 allows remote attackers to read arbi

23RISK

open ↗

Referência

CVE-2017-14075

CVE-2017-14075—

This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. An attacker must

23RISK

open ↗

Referência

CVE-2017-6371

CVE-2017-6371—

Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string

23RISK

open ↗

Referência

CVE-2010-4847

CVE-2010-4847—

SQL injection vulnerability in view_item.php in MH Products MHP Downloadshop allows remote attackers to execute arbitrar

23RISK

open ↗

Referência

CVE-2014-9642

CVE-2014-9642—

bdagent.sys in BullGuard Antivirus, Internet Security, Premium Protection, and Online Backup before 15.0.288 allows loca

23RISK

open ↗

Referência✓ VexDay Proof

PHP Project Management 0.8.10 - Multiple Local/Remote File Inclusions

CVE-2007-5641—webappsphp

Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers t

35RISK

open ↗

Referência

CVE-2016-10045

CVE-2016-10045—

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman

60RISK

open ↗

Referência

CVE-2016-10045

CVE-2016-10045—

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman

60RISK

open ↗

Referência✓ VexDay Proof

ECShop 2.5.0 - 'order_sn' SQL Injection

CVE-2009-1622—webappsphp

SQL injection vulnerability in user.php in EcShop 2.5.0 allows remote attackers to execute arbitrary SQL commands via th

23RISK

open ↗

Referência

CVE-2009-3313

CVE-2009-3313—

Multiple SQL injection vulnerabilities in FMyClone 2.3 allow remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência

CVE-2010-5060

CVE-2010-5060—

SQL injection vulnerability in Nus.php in NUs Newssystem 1.02 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2010-5285

CVE-2010-5285—

Cross-site request forgery (CSRF) vulnerability in admin.php in Collabtive 0.6.5 allows remote attackers to hijack the a

23RISK

open ↗

Referência

CVE-2015-7895

CVE-2015-7895—

Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash).

23RISK

open ↗

Referência

CVE-2026-110506

CVE-2026-110506MEDIUM

Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class

33RISK

open ↗

Referência

CVE-2013-4952

CVE-2013-4952—

SQL injection vulnerability in functions/global.php in Elemata CMS RC 3.0 allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência

CVE-2016-7660

CVE-2016-7660—

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchO

23RISK

open ↗

Referência

CVE-2026-110292

CVE-2026-110292MEDIUM

PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent

33RISK

open ↗

Referência✓ VexDay Proof

Einstein 1.01 - Local Password Disclosure

CVE-2005-0619—localwindows

Einstein 1.0.1 stores sensitive information such as usernames and passwords in plaintext in the registry, which allows l

23RISK

open ↗

Referência

CVE-2012-5891

CVE-2012-5891—

Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow

23RISK

open ↗

Referência

CVE-2023-53872

CVE-2023-53872CRITICAL

Wp2Fac 1.0 OS Command Injection via send.php Endpoint

48RISK

open ↗

Referência

CVE-2022-3603

CVE-2022-3603CRITICAL

Export customers list CSV for WooCommerce < 2.0.69 - CSV Injection

48RISK

open ↗

Referência

CVE-2015-7895

CVE-2015-7895—

Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash).

23RISK

open ↗

Referência

CVE-2012-1220

CVE-2012-1220—

Cross-site request forgery (CSRF) vulnerability in modules/config/admin_utente.php in GAzie 5.20 and earlier allows remo

23RISK

open ↗

Referência✓ VexDay Proof

xweblog 2.1 - 'kategori.asp' SQL Injection

CVE-2006-5023—webappsasp

SQL injection vulnerability in kategori.asp in xweblog 2.1 and earlier allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2012-4325

CVE-2012-4325—

Cross-site request forgery (CSRF) vulnerability in upload/users.php in Utopia News Pro (UNP) 1.4.0 and earlier allows re

23RISK

open ↗

Referência

CVE-2012-5891

CVE-2012-5891—

Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.