Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
26,327 exploits
Referência✓ VexDay Proof
fipsForum 2.6 - 'default2.asp' SQL Injection
CVE-2006-6116—webappsasp
SQL injection vulnerability in default2.asp in fipsForum 2.6 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2017-14147
CVE-2017-14147—
An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to ea
35RISK
open ↗
Referência
CVE-2018-0835
CVE-2018-0835—
Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remot
35RISK
open ↗
Referência✓ VexDay Proof
WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting
CVE-2020-29233—webappsphp
WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This vulnerability can allo
23RISK
open ↗
Referência
WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting
CVE-2020-29469—webappsphp
WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component. This vulnerability can allow an attacke
23RISK
open ↗
Referência✓ VexDay Proof
NULL FTP Server 1.1.0.7 - 'Site' Command Injection
CVE-2008-6534—remotewindows
Incomplete blacklist vulnerability in NULL FTP Server Free and Pro 1.1.0.7 allows remote authenticated users to execute
23RISK
open ↗
Referência
CVE-2010-4902
CVE-2010-4902—
Multiple SQL injection vulnerabilities in the Clantools (com_clantools) component 1.2.3 for Joomla! allow remote attacke
23RISK
open ↗
Referência
CVE-2017-14147
CVE-2017-14147—
An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to ea
35RISK
open ↗
Referência
CVE-2016-2296
CVE-2016-2296—
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pag
50RISK
open ↗
Referência
CVE-2013-5019
CVE-2013-5019—
Stack-based buffer overflow in Ultra Mini HTTPD 1.21 allows remote attackers to execute arbitrary code via a long resour
50RISK
open ↗
Referência
CVE-2015-1486
CVE-2015-1486—
The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote attackers t
50RISK
open ↗
Referência
CVE-2026-108805
CVE-2026-108805MEDIUM
krupalshah EmployeeRecruitmentSystem Login loginprocessing.php mysql_query sql injection
33RISK
open ↗
Referência
CVE-2017-11764
CVE-2017-11764—
Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code
35RISK
open ↗
Referência
CVE-2018-1217
CVE-2018-1217—
Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection A
50RISK
open ↗
Referência
CVE-2022-44149
CVE-2022-44149HIGH
The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by
53RISK
open ↗
Referência✓ VexDay Proof
CJ Ultra Plus 1.0.4 - Cookie SQL Injection
CVE-2008-4241—webappsphp
SQL injection vulnerability in CJ Ultra Plus 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Server - Code Execution (PoC) (MS08-067)
CVE-2008-4250CRITICALunder attackdoswindows
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 20
100RISK
open ↗
Referência✓ VexDay Proof
cf shopkart 5.2.2 - SQL Injection / File Disclosure
CVE-2008-6320—webappsasp
SQL injection vulnerability in index.cfm in CF Shopkart 5.2.2 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
MercuryBoard 1.1.5 - 'login.php' Blind SQL Injection
CVE-2008-6632—webappsphp
SQL injection vulnerability in func/login.php in MercuryBoard 1.1.5 and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
Shader TV (Beta) - Multiple SQL Injections
CVE-2008-6641—webappsasp
Multiple SQL injection vulnerabilities in Shader TV (Beta) allow remote authenticated administrators to execute arbitrar
23RISK
open ↗
Referência
CVE-2010-4976
CVE-2010-4976—
Cross-site scripting (XSS) vulnerability in search/search.php in MetInfo 3.0 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2011-5002
CVE-2011-5002—
Multiple stack-based buffer overflows in Final Draft 8 before 8.02 allow remote attackers to execute arbitrary code via
23RISK
open ↗
Referência
CVE-2013-5019
CVE-2013-5019—
Stack-based buffer overflow in Ultra Mini HTTPD 1.21 allows remote attackers to execute arbitrary code via a long resour
50RISK
open ↗
Referência
CVE-2013-5019
CVE-2013-5019—
Stack-based buffer overflow in Ultra Mini HTTPD 1.21 allows remote attackers to execute arbitrary code via a long resour
50RISK
open ↗
Referência✓ VexDay Proof
IBM Director < 5.10 - 'Redirect.bat' Directory Traversal
CVE-2006-4681—remotewindows
Directory traversal vulnerability in Redirect.bat in IBM Director before 5.10 allows remote attackers to read arbitrary
23RISK
open ↗
Referência
CVE-2005-2855
CVE-2005-2855—
Cross-site scripting (XSS) vulnerability in Unclassified NewsBoard 1.5.3 allows remote attackers to inject arbitrary web
23RISK
open ↗
Referência
CVE-2020-6857
CVE-2020-6857—
CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FT
23RISK
open ↗
Referência✓ VexDay Proof
PayProCart 1146078425 - Multiple Remote File Inclusions
CVE-2006-4672—webappsphp
PHP remote file inclusion vulnerability in profitCode ppalCart 2.5 EE, possibly a component of PayProCart, allows remote
23RISK
open ↗
Referência✓ VexDay Proof
pForum 1.30 - 'showprofil.php' SQL Injection
CVE-2008-4355—webappsphp
SQL injection vulnerability in showprofil.php in Powie PSCRIPT Forum (aka PHP Forum or pForum) 1.30 and earlier allows r
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Volunteer 2.0 - SQL Injection
CVE-2008-6337—webappsphp
SQL injection vulnerability in the Volunteer Management System (com_volunteer) module 2.0 for Joomla! allows remote atta
23RISK
open ↗
← previouspage 621 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.