Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,900cataloged exploits
35,840CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,600GitHub PoC 14,323VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
22,573 exploits
Referência
CVE-2014-3962
Multiple SQL injection vulnerabilities in Videos Tube 1.0 allow remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Referência
CVE-2014-3962
Multiple SQL injection vulnerabilities in Videos Tube 1.0 allow remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Referência
CVE-2014-100031
Multiple SQL injection vulnerabilities in Ganesha Digital Library (GDL) 4.2 allow remote attackers to execute arbitrary
23RISK
open ↗Referência
CVE-2014-0794
SQL injection vulnerability in the JV Comment (com_jvcomment) component before 3.0.3 for Joomla! allows remote authentic
23RISK
open ↗Referência✓ VexDay Proof
PHP Net Tools 2.7.1 - Remote Code Execution
nettools.php in PHP Net Tools 2.7.1 allows remote attackers to execute arbitrary commands via shell metacharacters in th
23RISK
open ↗Referência✓ VexDay Proof
Podcast Generator 1.1 - Remote Code Execution
core/admin/delete.php in Podcast Generator 1.1 and earlier does not properly restrict access to administrative functions
23RISK
open ↗Referência
CVE-2010-1925
SQL injection vulnerability in makale.php in tekno.Portal 0.1b allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência
CVE-2009-4220
PHP remote file inclusion vulnerability in includes/classes/pctemplate.php in PointComma 3.8b2 and earlier allows remote
23RISK
open ↗Referência
CVE-2009-4220
PHP remote file inclusion vulnerability in includes/classes/pctemplate.php in PointComma 3.8b2 and earlier allows remote
23RISK
open ↗Referência
CVE-2010-1928
Directory traversal vulnerability in scr/soustab.php in openMairie openPlanning 1.00, when register_globals is enabled,
23RISK
open ↗Referência
CVE-2014-9344
Cross-site request forgery (CSRF) vulnerability in Snowfox CMS before 1.0.10 allows remote attackers to hijack the authe
23RISK
open ↗Referência
CVE-2016-20089
Iperius Remote 1.7.0 Unquoted Service Path Elevation of Privilege
41RISK
open ↗Referência
CVE-2016-5310
The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP);
23RISK
open ↗Referência
CVE-2021-24383
WP Google Maps < 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)
23RISK
open ↗Referência✓ VexDay Proof
FdWeB Espace Membre 2.01 - 'path' Remote File Inclusion
PHP remote file inclusion vulnerability in _admin/admin_menu.php in FdWeB Espace Membre 2.1 and earlier allows remote at
23RISK
open ↗Referência
CVE-2010-3206
Multiple PHP remote file inclusion vulnerabilities in DiY-CMS 1.0 allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗Referência✓ VexDay Proof
Motorola Wimax modem CPEi300 - File Disclosure / Cross-Site Scripting
Directory traversal vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated users to re
23RISK
open ↗Referência✓ VexDay Proof
WebPortal CMS 0.8b - Multiple Local/Remote File Inclusions
PHP remote file inclusion vulnerability in indexk.php in WebPortal CMS 0.8-beta allows remote attackers to execute arbit
23RISK
open ↗Referência
CVE-2015-4133
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 f
50RISK
open ↗Referência✓ VexDay Proof
Mutant 0.9.2 - 'mutant_functions.php' Remote File Inclusion
PHP remote file inclusion vulnerability in mutant_functions.php in the Mutant 0.9.2 portal for phpBB 2.2 allows remote a
23RISK
open ↗Referência✓ VexDay Proof
Expow 0.8 - 'autoindex.php?cfg_file' Remote File Inclusion
PHP remote file inclusion vulnerability in autoindex.php in Expow 0.8 allows remote attackers to execute arbitrary PHP c
23RISK
open ↗Referência✓ VexDay Proof
NewsSync for phpBB 1.5.0rc6 - Remote File Inclusion
PHP remote file inclusion vulnerability in inc/nuke_include.php in newsSync 1.5.0rc6 allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
MyCMS 0.9.8 - Remote Command Execution (2)
PHP remote file inclusion vulnerability in games.php in MyCMS 0.9.8 and earlier allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
CandyPress eCommerce suite 4.1.1.26 - Multiple Vulnerabilities
SQL injection vulnerability in admin/utilities_ConfigHelp.asp in CandyPress (CP) 4.1.1.26, and other 4.x and 3.x version
23RISK
open ↗Referência✓ VexDay Proof
CNStats 2.9 - 'who_r.php?bj' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in CNStats 2.9 allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗Referência✓ VexDay Proof
Chipmunk Blog - (Authentication Bypass) Add Admin
Chipmunk Blogger Script allows remote attackers to gain administrator privileges via a direct request to admin/reguser.p
23RISK
open ↗Referência
CVE-2015-4414
Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player)
43RISK
open ↗Referência
CVE-2009-4796
Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.