Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,056cataloged exploits
35,925CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,640GitHub PoC 14,392VulnCheck XDB 8,755Nuclei 4,333Metasploit 3,478✓ verified onlyrecentpopularrisk
22,640 exploits
Referência
CVE-2018-7707
CVE-2018-7707—
Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitr
23RISK
open ↗
Referência
Jara 1.6 - SQL Injection
CVE-2011-4094—webappsphp
Jara 1.6 has a SQL injection vulnerability.
23RISK
open ↗
Referência✓ VexDay Proof
HomePH Design 2.10 RC2 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2008-2981—webappsphp
PHP remote file inclusion vulnerability in admin/templates/template_thumbnail.php in HomePH Design 2.10 RC2, when regist
23RISK
open ↗
Referência✓ VexDay Proof
Simple HTTPd 1.38 - Multiple Vulnerabilities
CVE-2007-6404—remotewindows
Directory traversal vulnerability in Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attac
23RISK
open ↗
Referência
CVE-2009-3760
CVE-2009-3760—
Static code injection vulnerability in config/writeconfig.php in the sample code in the XenServer Resource Kit in Citrix
23RISK
open ↗
Referência
CVE-2010-1475
CVE-2010-1475—
Directory traversal vulnerability in the Preventive & Reservation (com_preventive) component 1.0.5 for Joomla! allows re
38RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin WP-Cal 0.3 - 'editevent.php' SQL Injection
CVE-2008-0490—webappsphp
SQL injection vulnerability in functions/editevent.php in the WP-Cal 0.3 plugin for WordPress allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Acc Autos 4.0 - Insecure Cookie Handling
CVE-2008-6292—webappsphp
Acc Autos 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the (1) usernam
23RISK
open ↗
Referência✓ VexDay Proof
AvailScript Jobs Portal Script - (Authenticated) Arbitrary File Upload
CVE-2008-7021—webappsphp
Unrestricted file upload vulnerability in editlogo.php in AvailScript Jobs Portal Script allows remote authenticated use
23RISK
open ↗
Referência✓ VexDay Proof
Popcorn 1.87 - Remote Heap Overflow (PoC)
CVE-2009-1647—doswindows
Heap-based buffer overflow in popcorn.exe in Ultrafunk Popcorn 1.87 allows remote POP3 servers to cause a denial of serv
23RISK
open ↗
Referência
CVE-2014-9099
CVE-2014-9099—
Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attacker
23RISK
open ↗
Referência
CVE-2026-15751
CVE-2026-15751MEDIUM
mastergo-design mastergo-magic-mcp mcp__getComponentGenerator component-workflow.md execute path traversal
33RISK
open ↗
Referência
CVE-2017-14842
CVE-2017-14842—
Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.
23RISK
open ↗
Referência
CVE-2026-19992
CVE-2026-19992LOW
Orange View Limited DualSafe Password Manager & Digital Vault Extension postMessage-based Bridge information disclosure
28RISK
open ↗
Referência
CVE-2015-2797
CVE-2015-2797—
Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 502
60RISK
open ↗
Referência
CVE-2018-11715
CVE-2018-11715—
The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject.
23RISK
open ↗
Referência
CVE-2023-26692
CVE-2023-26692MEDIUM
ZCBS Zijper Collectie Beheer Systeem (ZCBS), Zijper Publication Management System (ZPBS), and Zijper Image Bank Manageme
33RISK
open ↗
Referência
CVE-2014-2088
CVE-2014-2088—
Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrar
23RISK
open ↗
Referência
CVE-2014-3991
CVE-2014-3991—
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2011-3645
CVE-2011-3645—
Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter
23RISK
open ↗
Referência✓ VexDay Proof
Project Based Calendaring System (PBCS) 0.7.1 - Multiple Vulnerabilities
CVE-2008-2215—webappsphp
Multiple directory traversal vulnerabilities in Project-Based Calendaring System (PBCS) 0.7.1-1 allow remote attackers t
23RISK
open ↗
Referência
CVE-2010-0799
CVE-2010-0799—
Directory traversal vulnerability in misc/tell_a_friend/tell.php in phpunity.newsmanager allows remote attackers to read
23RISK
open ↗
Referência
CVE-2010-0799
CVE-2010-0799—
Directory traversal vulnerability in misc/tell_a_friend/tell.php in phpunity.newsmanager allows remote attackers to read
23RISK
open ↗
Referência
CVE-2010-2677
CVE-2010-2677—
PHP remote file inclusion vulnerability in mw_plugin.php in Open Web Analytics (OWA) 1.2.3, when magic_quotes_gpc is dis
23RISK
open ↗
Referência
CVE-2010-2677
CVE-2010-2677—
PHP remote file inclusion vulnerability in mw_plugin.php in Open Web Analytics (OWA) 1.2.3, when magic_quotes_gpc is dis
23RISK
open ↗
Referência✓ VexDay Proof
V-Webmail 1.6.4 - 'pear_dir' Remote File Inclusion
CVE-2006-2666—webappsphp
PHP remote file inclusion vulnerability in includes/mailaccess/pop3.php in V-Webmail 1.5 through 1.6.4 allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
FreeLyrics 1.0 - Remote File Disclosure
CVE-2008-5861—webappsphp
Directory traversal vulnerability in source.php in FreeLyrics 1.0 allows remote attackers to read arbitrary files via di
23RISK
open ↗
Referência✓ VexDay Proof
Ocean12 Mailing List Manager Gold - File Disclosure / SQL Injection / Cross-Site Scripting
CVE-2008-5979—webappsphp
Cross-site scripting (XSS) vulnerability in default.asp in Ocean12 Mailing List Manager Gold allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Visagesoft eXPert PDF EditorX - 'VSPDFEditorX.ocx' Insecure Method
CVE-2008-6496—doswindows
Insecure method vulnerability in the VSPDFEditorX.VSPDFEdit ActiveX control in VSPDFEditorX.ocx 1.0.200.0 in VISAGESOFT
23RISK
open ↗
Referência✓ VexDay Proof
mrcgiguy the ticket system 2.0 PHP - Multiple Vulnerabilities
CVE-2009-2080—webappsphp
admin.php in MRCGIGUY The Ticket System 2.0 does not properly restrict access, which allows remote attackers to (1) obta
23RISK
open ↗
← previouspage 622 / 755next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.