Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,337cataloged exploits

39,873CVEs with public exploitation

24,696lab-tested

All Referência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecent popular risk

25,629 exploits

Referência✓ VexDay Proof

Sitellite CMS 4.2.12 - '559668.php' Remote File Inclusion

CVE-2007-3228—webappsphp

PHP remote file inclusion vulnerability in saf/lib/PEAR/PhpDocumentor/Documentation/tests/bug-559668.php in Sitellite CM

35RISK

open ↗

Referência✓ VexDay Proof

EasyClassifields 3.0 - 'go' SQL Injection

CVE-2008-4084—webappsphp

SQL injection vulnerability in staticpages/easyclassifields/index.php in MyioSoft EasyClassifields 3.0 allows remote att

23RISK

open ↗

Referência

CVE-2010-4617

CVE-2010-4617—

Directory traversal vulnerability in the JotLoader (com_jotloader) component 2.2.1 for Joomla! allows remote attackers t

38RISK

open ↗

Referência

CVE-2008-4687

CVE-2008-4687—

manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort param

50RISK

open ↗

Referência

CVE-2012-6522

CVE-2012-6522—

Directory traversal vulnerability in the getContent function in codes/wcms.php in w-CMS 2.01 allows remote attackers to

23RISK

open ↗

Referência

CVE-2015-0816

CVE-2015-0816—

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource

50RISK

open ↗

Referência

CVE-2018-8145

CVE-2018-8145—

An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could

35RISK

open ↗

Referência

CVE-2019-9978

CVE-2019-9978MEDIUMunder attack

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio

100RISK

open ↗

Referência

CVE-2025-25257

CVE-2025-25257CRITICALunder attack

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi

100RISK

open ↗

Referência✓ VexDay Proof

ASPSiteWare Automotive Dealer 1.0/2.0 - SQL Injection

CVE-2008-6874—webappsphp

Multiple SQL injection vulnerabilities in ASP SiteWare autoDealer 1 and 2 allow remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência

CVE-2010-4631

CVE-2010-4631—

Multiple cross-site scripting (XSS) vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to inject arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

ASP Smiley 1.0 - 'default.asp' Authentication Bypass / SQL Injection

CVE-2006-5952—webappsasp

SQL injection vulnerability in admin/default.asp in ASP Smiley 1.0 allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência

CVE-2013-3928

CVE-2013-3928—

Stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before 4.11.02 allows remote atta

50RISK

open ↗

Referência✓ VexDay Proof

Enterprise Payroll Systems 1.1 - 'footer' Remote File Inclusion

CVE-2006-2982—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Enterprise Timesheet and Payroll Systems (EPS) 1.1 and earlier all

23RISK

open ↗

Referência✓ VexDay Proof

myPHPNuke < 1.8.8_8rc2 - 'artid' SQL Injection

CVE-2008-4092—webappsphp

SQL injection vulnerability in printfeature.php in myPHPNuke (MPN) before 1.8.8_8rc2 allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

Yourownbux 3.1/3.2 Beta - SQL Injection

CVE-2008-4093—webappsphp

SQL injection vulnerability in memberstats.php in YourOwnBux 3.1 and 3.2 beta, when magic_quotes_gpc is disabled, allows

23RISK

open ↗

Referência

CVE-2013-4865

CVE-2013-4865—

Cross-site request forgery (CSRF) vulnerability in upgrade_step2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows

23RISK

open ↗

Referência✓ VexDay Proof

Zeeways ZeeJobsite 2.0 - Arbitrary File Upload

CVE-2008-6913—webappsphp

Unrestricted file upload vulnerability in editresume_next.php in Zeeways ZEEJOBSITE 2.0 allows remote authenticated user

23RISK

open ↗

Referência

CVE-2012-6525

CVE-2012-6525—

SQL injection vulnerability in members.php in PHPBridges allows remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência

CVE-2013-4988

CVE-2013-4988—

Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCoun

50RISK

open ↗

Referência

CVE-2013-4988

CVE-2013-4988—

Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCoun

50RISK

open ↗

Referência✓ VexDay Proof

X10media Mp3 Search Engine 1.5.5 - Remote File Inclusion

CVE-2008-4141—webappsphp

Multiple PHP remote file inclusion vulnerabilities in x10Media x10 Automatic MP3 Script 1.5.5 allow remote attackers to

23RISK

open ↗

Referência

CVE-2019-13101

CVE-2019-13101—

An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without

50RISK

open ↗

Referência✓ VexDay Proof

GNUBoard 4.31.03 (08.12.29) - Local File Inclusion

CVE-2009-0290—webappsphp

Directory traversal vulnerability in common.php in SIR GNUBoard 4.31.03 allows remote attackers to include and execute a

23RISK

open ↗

Referência✓ VexDay Proof

addalink 4 - 'category_id' SQL Injection

CVE-2008-4145—webappsphp

SQL injection vulnerability in user_read_links.php in Addalink 1.0 beta 4 and earlier, when magic_quotes_gpc is disabled

23RISK

open ↗

Referência

CVE-2010-1870

CVE-2010-1870—

The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fishe

60RISK

open ↗

Referência

CVE-2010-1870

CVE-2010-1870—

The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fishe

60RISK

open ↗

Referência

CVE-2012-2962

CVE-2012-2962—

SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2

50RISK

open ↗

Referência

CVE-2013-7260

CVE-2013-7260—

Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before

50RISK

open ↗

Referência

CVE-2016-4657

CVE-2016-4657HIGHunder attack

WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory

98RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.