Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,331cataloged exploits
40,631CVEs with public exploitation
24,696lab-tested
AllReferência 26,377Exploit-DB 24,489GitHub PoC 18,131VulnCheck XDB 10,218Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-16056
CVE-2026-16056MEDIUM
Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts
33RISK
open ↗
Referência✓ VexDay Proof
PHPUserBase 1.3b - 'unverified.inc.php' Remote File Inclusion
CVE-2008-1043—webappsphp
PHP remote file inclusion vulnerability in templates/default/header.inc.php in Linux Web Shop (LWS) php User Base 1.3 BE
35RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component FacileForms 1.4.4 - Remote File Inclusion
CVE-2008-2990—webappsphp
PHP remote file inclusion vulnerability in facileforms.frame.php in the FacileForms (com_facileforms) component 1.4.4 fo
23RISK
open ↗
Referência✓ VexDay Proof
Downline Goldmine paidversion - SQL Injection
CVE-2008-4178—webappsphp
SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and D
23RISK
open ↗
Referência
CVE-2012-0911
CVE-2012-0911—
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted
50RISK
open ↗
Referência✓ VexDay Proof
PHP Realtor 1.5 - 'v_cat' SQL Injection
CVE-2008-4496—webappsphp
SQL injection vulnerability in view_cat.php in PHP Realtor 1.5 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2009-2335
CVE-2009-2335—
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the u
60RISK
open ↗
Referência
CVE-2018-17463
CVE-2018-17463HIGHunder attack
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbit
100RISK
open ↗
Referência
CVE-2019-1620
CVE-2019-1620CRITICAL
Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability
85RISK
open ↗
Referência
CVE-2015-3035
CVE-2015-3035HIGHunder attack
Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before
100RISK
open ↗
Referência
CVE-2023-25690
CVE-2023-25690CRITICAL
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
70RISK
open ↗
Referência
rConfig 3.9.4 - 'search.crud.php' Remote Command Injection
CVE-2020-10879—webappsphp
rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nod
45RISK
open ↗
Referência
CVE-2008-1122
CVE-2008-1122—
SQL injection vulnerability in the downloads module in Koobi Pro 5.7 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Kasseler CMS 1.3.0 - Local File Inclusion / Cross-Site Scripting
CVE-2008-3088—webappsphp
Cross-site scripting (XSS) vulnerability in the Files module in Kasseler CMS 1.3.0 and 1.3.1 Lite allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
LoudBlog 0.8.0a - 'ajax.php' SQL Injection
CVE-2008-6077—webappsphp
SQL injection vulnerability in loudblog/ajax.php in LoudBlog 0.8.0a and earlier allows remote authenticated users to exe
23RISK
open ↗
Referência
CVE-2009-2265
CVE-2009-2265—
Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable fil
60RISK
open ↗
Referência
CVE-2009-3309
CVE-2009-3309—
SQL injection vulnerability in index.cfm in CF ShopKart 5.4 beta allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência
CVE-2017-17587
CVE-2017-17587—
FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or c
23RISK
open ↗
Referência✓ VexDay Proof
QuickTalk Forum 1.6 - Blind SQL Injection
CVE-2008-1316—webappsphp
SQL injection vulnerability in qtf_ind_search_ov.php in QT-cute QuickTalk Forum 1.6 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft PicturePusher - ActiveX Cross-Site Arbitrary File Upload
CVE-2008-4493—remotewindows
Microsoft PicturePusher ActiveX control (PipPPush.DLL 7.00.0709), as used in Microsoft Digital Image 2006 Starter Editio
28RISK
open ↗
Referência
CVE-2008-1336
CVE-2008-1336—
SQL injection vulnerability in Koobi CMS 4.2.3 through 4.3.0 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
jira 4.4.3 / greenhopper < 5.9.8 - Multiple Vulnerabilities
CVE-2012-1500—webappsjsp
Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject
23RISK
open ↗
Referência
CVE-2017-11317
CVE-2017-11317CRITICALunder attack
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload
100RISK
open ↗
Referência✓ VexDay Proof
Built2Go PHP Realestate 1.5 - 'event_detail.php' SQL Injection
CVE-2008-4497—webappsphp
SQL injection vulnerability in event_detail.php in Built2Go Real Estate Listings 1.5 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
ITLPoll 2.7 Stable2 - Blind SQL Injection
CVE-2009-0295—webappsphp
SQL injection vulnerability in index.php in Information Technology Light Poll Information (ITLPoll) 2.7 Stable 2, when m
23RISK
open ↗
Referência
CVE-2009-3539
CVE-2009-3539—
Multiple cross-site scripting (XSS) vulnerabilities in YourFreeWorld Ultra Classifieds Pro allow remote attackers to inj
23RISK
open ↗
Referência
CVE-2012-1261
CVE-2012-1261—
Cross-site scripting (XSS) vulnerability in cgi-bin/scrut_fa_exclusions.cgi in Plixer International Scrutinizer NetFlow
23RISK
open ↗
Referência
CVE-2012-1261
CVE-2012-1261—
Cross-site scripting (XSS) vulnerability in cgi-bin/scrut_fa_exclusions.cgi in Plixer International Scrutinizer NetFlow
23RISK
open ↗
Referência
CVE-2012-1503
CVE-2012-1503—
Cross-site scripting (XSS) vulnerability in Six Apart (formerly Six Apart KK) Movable Type (MT) Pro 5.13 allows remote a
23RISK
open ↗
Referência
CVE-2019-2729
CVE-2019-2729CRITICAL
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
85RISK
open ↗
← previouspage 613 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.