Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,056cataloged exploits

35,925CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,458Referência 22,640GitHub PoC 14,392VulnCheck XDB 8,755Nuclei 4,333Metasploit 3,478✓ verified onlyrecent popular risk

22,640 exploits

Referência

CVE-2017-17062

CVE-2017-17062—

The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev4

23RISK

open ↗

Referência

CVE-2017-17062

CVE-2017-17062—

The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev4

23RISK

open ↗

Referência

CVE-2026-10267

CVE-2026-10267MEDIUM

janet-lang janet debug.c doframe out-of-bounds

33RISK

open ↗

Referência

CVE-2026-48559

CVE-2026-48559MEDIUM

Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags

33RISK

open ↗

Referência

CVE-2015-5520

CVE-2015-5520—

Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allow

23RISK

open ↗

Referência

CVE-2009-4563

CVE-2009-4563—

Cross-site request forgery (CSRF) vulnerability in zp-core/admin-options.php in Zenphoto 1.2.5 allows remote attackers t

23RISK

open ↗

Referência

CVE-2026-10172

CVE-2026-10172MEDIUM

Bdtask Multi-Store Inventory Management System Component Module.php upload unrestricted upload

33RISK

open ↗

Referência

CVE-2017-6979

CVE-2017-6979—

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS

23RISK

open ↗

Referência

CVE-2026-10162

CVE-2026-10162HIGH

TRENDnet TEW-432BRP formSetPassword stack-based overflow

41RISK

open ↗

Referência

CVE-2026-10157

CVE-2026-10157MEDIUM

Open5GS NGAP PathSwitchRequest Message ngap-handler.c improper authentication

33RISK

open ↗

Referência

CVE-2009-4729

CVE-2009-4729—

Multiple cross-site scripting (XSS) vulnerabilities in x10 Adult Media Script 1.7 allow remote attackers to inject arbit

23RISK

open ↗

Referência

CVE-2017-11176

CVE-2017-11176—

The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retr

23RISK

open ↗

Referência

CVE-2016-4315

CVE-2016-4315—

Cross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authenticatio

23RISK

open ↗

Referência

CVE-2008-6888

CVE-2008-6888—

Cross-site scripting (XSS) vulnerability in signup.asp in Pre Classified Listings 1.0 allows remote attackers to inject

23RISK

open ↗

Referência

CVE-2016-1000123

CVE-2016-1000123—

Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla

23RISK

open ↗

Referência

CVE-2010-1312

CVE-2010-1312—

Directory traversal vulnerability in the iJoomla News Portal (com_news_portal) component 1.5.x for Joomla! allows remote

43RISK

open ↗

Referência

CVE-2010-1313

CVE-2010-1313—

Directory traversal vulnerability in the Seber Cart (com_sebercart) component 1.0.0.12 and 1.0.0.13 for Joomla!, when ma

38RISK

open ↗

Referência✓ VexDay Proof

LunarPoll 1.0 - 'show.php?PollDir' Remote File Inclusion

CVE-2007-0298—webappsphp

PHP remote file inclusion vulnerability in show.php in LunarPoll, when register_globals is enabled, allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

Sciurus Hosting Panel - Remote Code Injection

CVE-2007-6082—webappsphp

Direct static code injection vulnerability in acp/savenews.php in Sciurus Hosting Panel, possibly 2.0.3, allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

Gradman 0.1.3 - 'agregar_info.php' Local File Inclusion

CVE-2008-0361—webappsphp

Directory traversal vulnerability in agregar_info.php in GradMan 0.1.3 and earlier allows remote attackers to include an

23RISK

open ↗

Referência

CVE-2022-29851

CVE-2022-29851CRITICAL

documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Inj

48RISK

open ↗

Referência✓ VexDay Proof

427bb 2.3.1 - SQL Injection / Cross-Site Scripting

CVE-2008-2560—webappsphp

SQL injection vulnerability in showpost.php in 427BB 2.3.1 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência

CVE-2017-17721

CVE-2017-17721—

CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, ass

23RISK

open ↗

Referência

CVE-2020-9371

CVE-2020-9371—

Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php

23RISK

open ↗

Referência✓ VexDay Proof

GeBlog 0.1 (Windows) - GLOBALS[tplname] Local File Inclusion

CVE-2007-1577—webappsphp

Directory traversal vulnerability in index.php in GeBlog 0.1 allows remote attackers to include and execute arbitrary lo

23RISK

open ↗

Referência✓ VexDay Proof

YouTube blog 0.1 - Remote File Inclusion / SQL Injection / Cross-Site Scripting

CVE-2008-3305—webappsphp

Cross-site scripting (XSS) vulnerability in mensaje.php in C. Desseno YouTube Blog (ytb) 0.1 allows remote attackers to

23RISK

open ↗

Referência

CVE-2016-7384

CVE-2016-7384—

For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3

23RISK

open ↗

Referência

CVE-2017-8471

CVE-2017-8471—

Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2,

23RISK

open ↗

Referência✓ VexDay Proof

Libc - 'libc:fts_*()' Local Denial of Service

CVE-2009-0537—dosbsd

Integer overflow in the fts_build function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0

23RISK

open ↗

Referência✓ VexDay Proof

PostNuke pnFlashGames Module 1.5 - SQL Injection

CVE-2007-2427—webappsphp

SQL injection vulnerability in index.php in the pnFlashGames 1.5 module for PostNuke allows remote attackers to execute

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.