Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,866cataloged exploits

35,812CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,458Referência 22,573GitHub PoC 14,316VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecent popular risk

22,549 exploits

Referência

CVE-2012-5849

CVE-2012-5849—

Multiple SQL injection vulnerabilities in ClipBucket 2.6 Revision 738 and earlier allow remote attackers to execute arbi

23RISK

open ↗

Referência

CVE-2014-3136

CVE-2014-3136—

Cross-site request forgery (CSRF) vulnerability in D-Link DWR-113 (Rev. Ax) with firmware before 2.03b02 allows remote a

23RISK

open ↗

Referência

CVE-2018-6940

CVE-2018-6940—

A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote

23RISK

open ↗

Referência

CVE-2018-6940

CVE-2018-6940—

A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote

23RISK

open ↗

Referência

CVE-2009-4475

CVE-2009-4475—

SQL injection vulnerability in the Joomlub (com_joomlub) component for Joomla! allows remote attackers to execute arbitr

23RISK

open ↗

Referência

php-fusion 9.03.50 - Persistent Cross-Site Scripting

CVE-2020-12706—webappsphp

Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web scrip

23RISK

open ↗

Referência✓ VexDay Proof

CyberBrau 0.9.4 - '/forum/track.php' Remote File Inclusion

CVE-2006-5400—webappsphp

PHP remote file inclusion vulnerability in forum/track.php in CyberBrau 0.9.4, when register_globals is enabled, allows

23RISK

open ↗

Referência✓ VexDay Proof

MyCMS 0.9.8 - Remote Command Execution (1)

CVE-2007-3587—webappsphp

MyCMS 0.9.8 and earlier allows remote attackers to gain privileges via the admin cookie parameter, as demonstrated by a

23RISK

open ↗

Referência✓ VexDay Proof

PHP-Stats 0.1.9.2 - Multiple Vulnerabilities

CVE-2007-5452—webappsphp

Multiple SQL injection vulnerabilities in php-stats.recjs.php in Php-Stats 0.1.9.2 allow remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

xeCMS 1.x - 'view.php' Remote File Disclosure

CVE-2007-6508—webappsphp

Directory traversal vulnerability in view.php in xeCMS 1.0 allows remote attackers to read arbitrary files via a ..%2F (

23RISK

open ↗

Referência✓ VexDay Proof

Pollbooth 2.0 - 'pollID' SQL Injection

CVE-2008-4765—webappsphp

SQL injection vulnerability in pollBooth.php in osCommerce Poll Booth Add-On 2.0 allows remote attackers to execute arbi

23RISK

open ↗

Referência

CVE-2018-0745

CVE-2018-0745—

The Windows kernel in Windows 10 version 1703. Windows 10 version 1709, and Windows Server, version 1709 allows an infor

23RISK

open ↗

Referência

CVE-2023-28293

CVE-2023-28293HIGH

Windows Kernel Elevation of Privilege Vulnerability

41RISK

open ↗

Referência

CVE-2012-5905

CVE-2012-5905—

Buffer overflow in KnFTPd 1.0.0 allows remote authenticated users to cause a denial of service (crash) via a long string

23RISK

open ↗

Referência

CVE-2012-5905

CVE-2012-5905—

Buffer overflow in KnFTPd 1.0.0 allows remote authenticated users to cause a denial of service (crash) via a long string

23RISK

open ↗

Referência

CVE-2013-5099

CVE-2013-5099—

Cross-site scripting (XSS) vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote at

23RISK

open ↗

Referência

CVE-2019-1344

CVE-2019-1344—

An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memo

23RISK

open ↗

Referência✓ VexDay Proof

Falt4 CMS rc4 10.9.2007 - Multiple Vulnerabilities

CVE-2007-6311—webappsphp

SQL injection vulnerability in (1) index.php, and possibly (2) admin/index.php, in Falt4Extreme RC4 10.9.2007 allows rem

23RISK

open ↗

Referência

CVE-2014-4511

CVE-2014-4511—

Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in

60RISK

open ↗

Referência

CVE-2026-15597

CVE-2026-15597MEDIUM

SourceCodester Class and Exam Timetabling System edit_exam2.php sql injection

33RISK

open ↗

Referência

CVE-2026-15559

CVE-2026-15559MEDIUM

CodeAstro Simple Online Leave Management System POST accept.php sql injection

33RISK

open ↗

Referência

CVE-2026-15558

CVE-2026-15558MEDIUM

CodeAstro Simple Online Leave Management System deletemp.php sql injection

33RISK

open ↗

Referência✓ VexDay Proof

CPCommerce 1.1.0 - Cross-Site Scripting / Local File Inclusion

CVE-2008-1906—webappsphp

Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

aflog 1.01 - Multiple Insecure Cookie Handling Vulnerabilities

CVE-2008-4784—webappsphp

aflog 1.01 allows remote attackers to bypass authentication and gain administrative access by setting the aflog_auth_a c

23RISK

open ↗

Referência

CVE-2009-4627

CVE-2009-4627—

Directory traversal vulnerability in sources/_template_parser.php in Moa Gallery 1.2.0 and earlier allows remote attacke

23RISK

open ↗

Referência

CVE-2017-15972

CVE-2017-15972—

SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php

23RISK

open ↗

Referência

CVE-2017-15972

CVE-2017-15972—

SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php

23RISK

open ↗

Referência✓ VexDay Proof

MODx CMS 0.9.6.2 - Remote File Inclusion / Cross-Site Scripting

CVE-2008-5939—webappsphp

Cross-site scripting (XSS) vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject

23RISK

open ↗

Referência

CVE-2006-4611

CVE-2006-4611—

Buffer overflow in the _tor_resolve function in dsocks.c in dsocks before 1.4 allows remote attackers to execute arbitra

23RISK

open ↗

Referência

CVE-2020-14073

CVE-2020-14073—

XSS exists in PRTG Network Monitor 20.1.56.1574 via crafted map properties. An attacker with Read/Write privileges can c

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.