Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2009-4627
CVE-2009-4627—
Directory traversal vulnerability in sources/_template_parser.php in Moa Gallery 1.2.0 and earlier allows remote attacke
23RISK
open ↗
Referência
CVE-2026-13169
CVE-2026-13169HIGH
Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR
41RISK
open ↗
Referência
CVE-2026-93975
CVE-2026-93975MEDIUM
code-projects Assessment Management User Editing edit-user.php cross site scripting
33RISK
open ↗
Referência✓ VexDay Proof
PHPWebThings 1.4 - 'msg'/'forum' SQL Injection
CVE-2005-4218—webappsphp
SQL injection vulnerability in forum.php in PHPWebThings 1.4 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2022-30333
CVE-2022-30333CRITICALunder attackransomware
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
100RISK
open ↗
Referência✓ VexDay Proof
Rama CMS 0.68 - Cookie: lang Local File Inclusion
CVE-2006-5894—webappsphp
Directory traversal vulnerability in lang.php in Rama CMS 0.68 and earlier, when register_globals is enabled, allows rem
23RISK
open ↗
Referência
CVE-2026-82842
CVE-2026-82842HIGH
SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching
41RISK
open ↗
Referência
CVE-2026-12375
CVE-2026-12375CRITICAL
Uncanny Automator Pro 7.3.0.5 - Backdoor via Compromised Vendor Update Server
48RISK
open ↗
Referência
CVE-2026-76003
CVE-2026-76003CRITICAL
UTT HiPER 1200GW formGroupConfig strcpy stack-based overflow
48RISK
open ↗
Referência✓ VexDay Proof
shibby shop 2.2 - Multiple Vulnerabilities
CVE-2008-2873—webappsphp
sHibby sHop 2.2 and earlier stores sensitive information under the web root with insufficient access control, which allo
23RISK
open ↗
Referência
CVE-2026-15105
CVE-2026-15105MEDIUM
davenardella snap7 ReadVar Request s7_server.cpp PerformFunctionRead out-of-bounds write
33RISK
open ↗
Referência
CVE-2026-12277
CVE-2026-12277HIGH
Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal
41RISK
open ↗
Referência
CVE-2012-3816
CVE-2012-3816—
WinRadius Server 2009 allows remote attackers to cause a denial of service (crash) via a long password in an Access-Requ
23RISK
open ↗
Referência
CVE-2014-8393
CVE-2014-8393—
DLL Hijacking vulnerability in CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015, and Corel
23RISK
open ↗
Referência
CVE-2026-14736
CVE-2026-14736MEDIUM
Ruijie RG-UAC user_auth_commit.php unrestricted upload
33RISK
open ↗
Referência
CVE-2017-9101
CVE-2017-9101—
import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User
60RISK
open ↗
Referência✓ VexDay Proof
torrentflux 2.2 - Arbitrary File Create/ Execute/Delete
CVE-2006-6329—webappsphp
index.php for TorrentFlux 2.2 allows remote attackers to delete files by specifying the target filename in the delfile p
23RISK
open ↗
Referência
CVE-2015-2184
CVE-2015-2184—
ZeusCart 4 allows remote attackers to obtain configuration information via a getphpinfo action to admin/, which calls th
23RISK
open ↗
Referência
CVE-2010-4795
CVE-2010-4795—
SQL injection vulnerability in the JS Calendar (com_jscalendar) component 1.5.1 and 1.5.4 for Joomla! allows remote atta
23RISK
open ↗
Referência
CVE-2016-5740
CVE-2016-5740—
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev5. JavaScript code can be used as part of ical atta
23RISK
open ↗
Referência✓ VexDay Proof
F-Prot AntiVirus 4.6.6 - 'ACE' Denial of Service
CVE-2006-6352—doslinux
FRISK Software F-Prot Antivirus before 4.6.7 allows user-assisted remote attackers to cause a denial of service (infinit
28RISK
open ↗
Referência✓ VexDay Proof
Pivot 1.40.5 - Dreamwind 'load_template()' Credentials Disclosure
CVE-2008-3128—webappsphp
Directory traversal vulnerability in search.php in Pivot 1.40.5 allows remote attackers to read arbitrary files via a ..
23RISK
open ↗
Referência✓ VexDay Proof
Apartment Search Script - Arbitrary File Upload / Cross-Site Scripting
CVE-2008-6683—webappsphp
Cross-site scripting (XSS) vulnerability in listtest.php in Apartment Search Script allows remote attackers to inject ar
23RISK
open ↗
Referência
CVE-2023-6553
CVE-2023-6553CRITICAL
Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
85RISK
open ↗
Referência
CVE-2026-87933
CVE-2026-87933MEDIUM
DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free
33RISK
open ↗
Referência✓ VexDay Proof
mxBB Module Profile CP 0.91c - Remote File Inclusion
CVE-2006-6566—webappsphp
PHP remote file inclusion vulnerability in includes/profilcp_constants.php in the Profile Control Panel (CPanel) module
23RISK
open ↗
Referência
CVE-2026-34097
CVE-2026-34097MEDIUM
Guardian Language-System XSS via id Parameter in text_file.php
33RISK
open ↗
Referência
CVE-2026-34096
CVE-2026-34096MEDIUM
Guardian Language-System XSS via name Parameter in designer.php
33RISK
open ↗
Referência
CVE-2026-59097
CVE-2026-59097MEDIUM
Taiga < 6.10.2 - Unauthorized Due-Date Creation via API Viewsets
33RISK
open ↗
Referência
CVE-2026-9576
CVE-2026-9576MEDIUM
Fluent Booking < 2.1.2 - Calendar Manager+ Sensitive Information Disclosure via Attendee Export
33RISK
open ↗
← previouspage 484 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.