Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,325 exploits
Referência
CVE-2012-4926
CVE-2012-4926—
approve.php in Img Pals Photo Host 1.0 does not authenticate requests, which allows remote attackers to change the activ
23RISK
open ↗
Referência
CVE-2013-5791
CVE-2013-5791—
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.0 and 8.4.1 allo
23RISK
open ↗
Referência
CVE-2015-2866
CVE-2015-2866—
SQL injection vulnerability on the Grandstream GXV3611_HD camera with firmware before 1.0.3.9 beta allows remote attacke
23RISK
open ↗
Referência
CVE-2015-6944
CVE-2015-6944—
Cross-site request forgery (CSRF) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to hijack the a
23RISK
open ↗
Referência
CVE-2016-10033
CVE-2016-10033CRITICALunder attack
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗
Referência
CVE-2017-8836
CVE-2017-8836—
CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_
23RISK
open ↗
Referência
CVE-2018-11332
CVE-2018-11332—
Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in
23RISK
open ↗
Referência
CVE-2020-8825
CVE-2020-8825—
index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.
23RISK
open ↗
Referência
CVE-2026-13726
CVE-2026-13726HIGH
Multiple Page Generator Plugin – MPG < 4.1.8 - Reflected XSS via mpg_shortcode
41RISK
open ↗
Referência✓ VexDay Proof
Artmedic CMS 3.4 - 'index.php' Local File Inclusion
CVE-2007-5600—webappsphp
Incomplete blacklist vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
Pre Real Estate Listings - Arbitrary File Upload
CVE-2008-7052—webappsphp
Unrestricted file upload vulnerability in profile.php in Pre Projects Pre Real Estate Listings allows remote authenticat
23RISK
open ↗
Referência
CVE-2010-0801
CVE-2010-0801—
Directory traversal vulnerability in the AutartiTarot (com_autartitarot) component 1.0.3 for Joomla! allows remote authe
23RISK
open ↗
Referência
CVE-2010-1878
CVE-2010-1878—
Directory traversal vulnerability in the OrgChart (com_orgchart) component 1.0.0 for Joomla! allows remote attackers to
43RISK
open ↗
Referência
CVE-2012-6523
CVE-2012-6523—
Multiple cross-site scripting (XSS) vulnerabilities in w-CMS 2.01 allow remote attackers to inject arbitrary web script
23RISK
open ↗
Referência✓ VexDay Proof
Kensei Board 2.0.0b - Multiple SQL Injections
CVE-2009-1853—webappsphp
Multiple SQL injection vulnerabilities in index.php in Kensei Board 2.0 BETA (aka 2.0.0b) and earlier allow remote attac
23RISK
open ↗
Referência
CVE-2016-10033
CVE-2016-10033CRITICALunder attack
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗
Referência
CVE-2017-15580
CVE-2017-15580—
osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly v
28RISK
open ↗
Referência
CVE-2016-10033
CVE-2016-10033CRITICALunder attack
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗
Referência
CVE-2017-14344
CVE-2017-14344—
This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. An attacker must
23RISK
open ↗
Referência
CVE-2014-125124
CVE-2014-125124CRITICAL
Pandora FMS <= 5.0RC1 Anyterm Unauthenticated Command Injection
63RISK
open ↗
Referência
CVE-2014-125124
CVE-2014-125124CRITICAL
Pandora FMS <= 5.0RC1 Anyterm Unauthenticated Command Injection
63RISK
open ↗
Referência✓ VexDay Proof
e107 < 0.7.8 - 'photograph' Arbitrary File Upload
CVE-2007-3429—webappsphp
Unrestricted file upload vulnerability in signup.php in e107 0.7.8 and earlier, when photograph upload is enabled, allow
23RISK
open ↗
Referência
CVE-2009-3349
CVE-2009-3349—
SQL injection vulnerability in Datavore Gyro 5.0 allows remote attackers to execute arbitrary SQL commands via the cid p
23RISK
open ↗
Referência
CVE-2009-4458
CVE-2009-4458—
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow re
23RISK
open ↗
Referência
CVE-2024-4399
CVE-2024-4399CRITICAL
CAS <= 1.0.0 - Unauthenticated SSRF
63RISK
open ↗
Referência
CVE-2010-0723
CVE-2010-0723—
SQL injection vulnerability in news.php in Ero Auktion 2.0 and 2010 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2010-0723
CVE-2010-0723—
SQL injection vulnerability in news.php in Ero Auktion 2.0 and 2010 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2010-1922
CVE-2010-1922—
Multiple PHP remote file inclusion vulnerabilities in 29o3 CMS 0.1 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗
Referência
CVE-2010-1922
CVE-2010-1922—
Multiple PHP remote file inclusion vulnerabilities in 29o3 CMS 0.1 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗
Referência
CVE-2010-1927
CVE-2010-1927—
Multiple PHP remote file inclusion vulnerabilities in openMairie openCourrier 2.02 and 2.03 beta, when register_globals
23RISK
open ↗
← previouspage 480 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.