Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,337cataloged exploits

39,873CVEs with public exploitation

24,696lab-tested

All Referência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecent popular risk

25,629 exploits

Referência

CVE-2026-7068

CVE-2026-7068HIGH

D-Link DIR-825 nmbd sserver.c NMBD_process buffer overflow

41RISK

open ↗

Referência

CVE-2010-2690

CVE-2010-2690—

SQL injection vulnerability in the JOOFORGE Gamesbox (com_gamesbox) component 1.0.2, and possibly earlier, for Joomla! a

23RISK

open ↗

Referência

CVE-2021-35064

CVE-2021-35064—

KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits runn

60RISK

open ↗

Referência

CVE-2021-4039

CVE-2021-4039CRITICAL

A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to exec

70RISK

open ↗

Referência✓ VexDay Proof

GreenCart PHP Shopping Cart - 'id' SQL Injection

CVE-2008-3585—webappsphp

Multiple SQL injection vulnerabilities in PozScripts GreenCart PHP Shopping Cart allow remote attackers to execute arbit

23RISK

open ↗

Referência

CVE-2013-1469

CVE-2013-1469—

Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbit

35RISK

open ↗

Referência

CVE-2014-8686

CVE-2014-8686—

CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-

50RISK

open ↗

Referência✓ VexDay Proof

Netartmedia Real Estate Portal 1.2 - SQL Injection

CVE-2008-6042—webappsphp

SQL injection vulnerability in the re_search module in NetArtMedia Real Estate Portal 2.0 allows remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

Symphony 1.7.01 (non-patched) - Remote Code Execution

CVE-2008-3592—webappsphp

Unrestricted file upload vulnerability in the File Manager in the admin panel in Twentyone Degrees Symphony 1.7.01 and e

23RISK

open ↗

Referência

CVE-2013-6117

CVE-2013-6117—

Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive informatio

50RISK

open ↗

Referência

CVE-2018-18323

CVE-2018-18323—

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/

60RISK

open ↗

Referência✓ VexDay Proof

Pre ADS Portal 2.0 - Authentication Bypass / Cross-Site Scripting

CVE-2008-6716—webappsphp

homeadmin/adminhome.php in Pre ADS Portal 2.0 and earlier does not require administrative authentication, which allows r

23RISK

open ↗

Referência✓ VexDay Proof

Exodus 0.10 - URI Handler Arbitrary Parameter Injection (2)

CVE-2008-6936—remotewindows

Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, over

23RISK

open ↗

Referência

CVE-2010-2845

CVE-2010-2845—

SQL injection vulnerability in the QuickFAQ (com_quickfaq) component 1.0.3 for Joomla! allows remote attackers to execut

23RISK

open ↗

Referência

CVE-2010-2908

CVE-2010-2908—

SQL injection vulnerability in the Joomdle (com_joomdle) component 0.24 and earlier for Joomla! allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Quicksilver Forums 1.4.1 - SQL Injection

CVE-2008-3601—webappsphp

SQL injection vulnerability in index.php in Quicksilver Forums 1.4.1 allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência

CVE-2010-2912

CVE-2010-2912—

SQL injection vulnerability in index.php in Kayako eSupport 3.70.02 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência

CVE-2021-21220

CVE-2021-21220HIGHunder attack

Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to po

100RISK

open ↗

Referência

CVE-2021-21220

CVE-2021-21220HIGHunder attack

Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to po

100RISK

open ↗

Referência✓ VexDay Proof

MyShoutPro 1.2 - Final Insecure Cookie Handling

CVE-2008-6738—webappsphp

MyShoutPro 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin_acce

23RISK

open ↗

Referência

CVE-2022-28810

CVE-2022-28810MEDIUMunder attack

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary

100RISK

open ↗

Referência

CVE-2010-2917

CVE-2010-2917—

Multiple cross-site scripting (XSS) vulnerabilities in index.php in AJ Square AJ Article 3.0 allow remote attackers to i

23RISK

open ↗

Referência

CVE-2010-3029

CVE-2010-3029—

SQL injection vulnerability in statistics.php in PHPKick 0.8 allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência✓ VexDay Proof

Fast Click 1.1.3/2.3.8 - 'show.php' Remote File Inclusion

CVE-2006-2175—webappsphp

PHP remote file inclusion vulnerability in FtrainSoft Fast Click 2.3.8 and earlier allows remote attackers to execute ar

23RISK

open ↗

Referência

CVE-2012-4869

CVE-2012-4869—

The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attacke

60RISK

open ↗

Referência

CVE-2013-2028

CVE-2013-2028—

The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau

60RISK

open ↗

Referência

CVE-2015-4495

CVE-2015-4495HIGHunder attack

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote

98RISK

open ↗

Referência

CVE-2017-8634

CVE-2017-8634—

Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current u

45RISK

open ↗

Referência✓ VexDay Proof

ReVou Twitter Clone - Arbitrary File Upload

CVE-2008-6751—webappsphp

Unrestricted file upload vulnerability in index.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging allows

23RISK

open ↗

Referência

CVE-2026-109519

CVE-2026-109519MEDIUM

YouTransfer Template Rendering template path traversal

33RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.