Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,900cataloged exploits
35,840CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,600GitHub PoC 14,323VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
22,600 exploits
Referência✓ VexDay Proof
EZContents CMS 2.0.0 - Multiple SQL Injections
CVE-2008-2135—webappsphp
Multiple SQL injection vulnerabilities in VisualShapers ezContents 2.0.0 allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2017-20273
CVE-2017-20273HIGH
Joomla Event Registration Pro Calendar 4.1.3 SQL Injection
41RISK
open ↗
Referência
Lingdang CRM 8.6.4.7 - SQL Injection
CVE-2025-9140MEDIUMwebappsmultiple
Shanghai Lingdang Information Technology Lingdang CRM tabdetail_moduleSave.php sql injection
33RISK
open ↗
Referência
CVE-2019-0836
CVE-2019-0836—
An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), ak
23RISK
open ↗
Referência
CVE-2019-0836
CVE-2019-0836—
An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), ak
23RISK
open ↗
Referência
CVE-2017-11567
CVE-2017-11567—
Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the
23RISK
open ↗
Referência✓ VexDay Proof
Studio Lounge Address Book 2.5 - 'profile' Arbitrary File Upload
CVE-2009-1483—webappsphp
Unrestricted file upload vulnerability in upload-file.php in Adam Patterson Studio Lounge Address Book 2.5, as reachable
23RISK
open ↗
Referência✓ VexDay Proof
VS-News-System 1.2.1 - 'newsordner' Remote File Inclusion
CVE-2007-1017—webappsphp
PHP remote file inclusion vulnerability in show_news_inc.php in VirtualSystem VS-News-System 1.2.1 and earlier allows re
23RISK
open ↗
Referência
CVE-2015-0554
CVE-2015-0554—
The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly rest
50RISK
open ↗
Referência✓ VexDay Proof
PrecisionID Barcode ActiveX 1.3 - Denial of Service
CVE-2007-2657—doswindows
Unspecified vulnerability in the PrecisionID Barcode 1.3 ActiveX control in PrecisionID_DataMatrix.DLL allows remote att
23RISK
open ↗
Referência
CVE-2010-4928
CVE-2010-4928—
Cross-site scripting (XSS) vulnerability in the Restaurant Guide (com_restaurantguide) component 1.0.0 for Joomla! allow
23RISK
open ↗
Referência
CVE-2010-4928
CVE-2010-4928—
Cross-site scripting (XSS) vulnerability in the Restaurant Guide (com_restaurantguide) component 1.0.0 for Joomla! allow
23RISK
open ↗
Referência
CVE-2010-4929
CVE-2010-4929—
SQL injection vulnerability in the Joostina (com_ezautos) component for Joomla! allows remote attackers to execute arbit
23RISK
open ↗
Referência
CVE-2013-5978
CVE-2013-5978—
Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPr
23RISK
open ↗
Referência
CVE-2013-5219
CVE-2013-5219—
Directory traversal vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to read arbitrar
23RISK
open ↗
Referência
CVE-2007-3340
CVE-2007-3340—
BugHunter HTTP SERVER (httpsv.exe) 1.6.2 allows remote attackers to cause a denial of service (application crash) via a
23RISK
open ↗
Referência
CVE-2012-5861
CVE-2012-5861—
Sinapsi eSolar SQL Injection
41RISK
open ↗
Referência
CVE-2026-14938
CVE-2026-14938MEDIUM
FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR
33RISK
open ↗
Referência
CVE-2015-1318
CVE-2015-1318—
The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a craf
38RISK
open ↗
Referência
CVE-2015-1318
CVE-2015-1318—
The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a craf
38RISK
open ↗
Referência
CVE-2018-0746
CVE-2018-0746—
The Windows kernel in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Wi
23RISK
open ↗
Referência
CVE-2009-3219
CVE-2009-3219—
Directory traversal vulnerability in a.php in AR Web Content Manager (AWCM) 2.1, when magic_quotes_gpc is disabled, allo
23RISK
open ↗
Referência
CVE-2017-9834
CVE-2017-9834—
SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2017-9869
CVE-2017-9869—
The II_step_one function in layer2.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows rem
23RISK
open ↗
Referência
CVE-2019-6205
CVE-2019-6205—
A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 12.1.3, macOS Moja
23RISK
open ↗
Referência
CVE-2019-6205
CVE-2019-6205—
A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 12.1.3, macOS Moja
23RISK
open ↗
Referência✓ VexDay Proof
Ksemail - Local File Inclusion
CVE-2008-1751—webappsphp
Multiple directory traversal vulnerabilities in index.php in Ksemail allow remote attackers to read arbitrary local file
23RISK
open ↗
Referência✓ VexDay Proof
Vlbook 1.21 - Cross-Site Scripting / Local File Inclusion
CVE-2008-2073—webappsphp
Directory traversal vulnerability in include/global.inc.php in Virtual Design Studio vlbook 1.21 allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
OneCMS 2.5 - 'install_mod.php' Local File Inclusion
CVE-2008-2482—webappsphp
Directory traversal vulnerability in install_mod.php in insanevisions OneCMS 2.5 allows remote attackers to include and
23RISK
open ↗
Referência✓ VexDay Proof
Panda Security ActiveScan 2.0 (Update) - Remote Buffer Overflow
CVE-2008-3156—remotewindows
The ActiveScan ActiveX Control (as2guiie.dll) in Panda ActiveScan before 1.02.00 allows remote attackers to download and
23RISK
open ↗
← previouspage 609 / 754next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.