Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,056cataloged exploits

35,925CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,458Referência 22,640GitHub PoC 14,392VulnCheck XDB 8,755Nuclei 4,333Metasploit 3,478✓ verified onlyrecent popular risk

22,640 exploits

Referência

CVE-2018-14497

CVE-2018-14497—

Tenda D152 ADSL routers allow XSS via a crafted SSID.

23RISK

open ↗

Referência

CVE-2018-0901

CVE-2018-0901—

The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve

23RISK

open ↗

Referência

CVE-2010-1725

CVE-2010-1725—

SQL injection vulnerability in offers_buy.php in Alibaba Clone Platinum allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2010-1725

CVE-2010-1725—

SQL injection vulnerability in offers_buy.php in Alibaba Clone Platinum allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2026-16603

CVE-2026-16603HIGH

Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API

41RISK

open ↗

Referência

CVE-2010-1726

CVE-2010-1726—

SQL injection vulnerability in offers_buy.php in EC21 Clone 3.0 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência

CVE-2009-4825

CVE-2009-4825—

8pixel.net Blog 4 stores sensitive information under the web root with insufficient access control, which allows remote

23RISK

open ↗

Referência

CVE-2009-4820

CVE-2009-4820—

Angelo-Emlak 1.0 stores sensitive information under the web root with insufficient access control, which allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

microssys CMS 1.5 - Remote File Inclusion

CVE-2008-2396—webappsphp

PHP remote file inclusion vulnerability in index.php in Wajox Software microSSys CMS 1.5 and earlier, when register_glob

23RISK

open ↗

Referência✓ VexDay Proof

deeemm CMS (dmcms) 0.7.4 - Multiple Vulnerabilities

CVE-2008-3721—webappsphp

PHP remote file inclusion vulnerability in user_language.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

wotw 5.0 - Local/Remote File Inclusion

CVE-2008-6223—webappsphp

PHP remote file inclusion vulnerability in visualizza.php in Way Of The Warrior (WOTW) 5.0 and earlier allows remote att

23RISK

open ↗

Referência

CVE-2009-4056

CVE-2009-4056—

Directory traversal vulnerability in admin/popup.php in Betsy CMS 3.5 allows remote attackers to include and execute arb

23RISK

open ↗

Referência

CVE-2009-4471

CVE-2009-4471—

Multiple PHP remote file inclusion vulnerabilities in FreeSchool 1.1.0 and earlier allow remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

Destar 0.2.2-5 - Arbitrary Add New User

CVE-2008-6538—webappsphp

DeStar 0.2.2-5 allows remote attackers to add arbitrary users via a direct request to config/add/CfgOptUser.

23RISK

open ↗

Referência

CVE-2010-1726

CVE-2010-1726—

SQL injection vulnerability in offers_buy.php in EC21 Clone 3.0 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

GRBoard 1.8 - Multiple Remote File Inclusions

CVE-2009-0444—webappsphp

Multiple PHP remote file inclusion vulnerabilities in GRBoard 1.8, when register_globals is enabled and magic_quotes_gpc

23RISK

open ↗

Referência✓ VexDay Proof

acute control panel 1.0.0 - SQL Injection / Remote File Inclusion

CVE-2009-1248—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Acute Control Panel 1.0.0 allow remote attackers to execute arbitr

23RISK

open ↗

Referência

CVE-2018-18419

CVE-2018-18419—

Stored XSS has been discovered in the upload section of ARDAWAN.COM User Management 1.1, as demonstrated by a .jpg filen

23RISK

open ↗

Referência

CVE-2017-10129

CVE-2017-10129—

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version

23RISK

open ↗

Referência

CVE-2026-70619

CVE-2026-70619HIGH

Odysseus Missing Admin Authorization via Embedding Endpoint Routes

41RISK

open ↗

Referência

CVE-2010-0674

CVE-2010-0674—

StatCounteX 3.1 stores sensitive information under the web root with insufficient access control, which allows remote at

23RISK

open ↗

Referência

CVE-2010-0674

CVE-2010-0674—

StatCounteX 3.1 stores sensitive information under the web root with insufficient access control, which allows remote at

23RISK

open ↗

Referência

CVE-2012-6048

CVE-2012-6048—

Guitar Pro 6.1.1 r10791 allows remote attackers to cause a denial of service (crash) via a long string in a gpx file.

23RISK

open ↗

Referência

CVE-2010-0939

CVE-2010-0939—

Visialis ABB Forum 1.1 stores sensitive information under the web root with insufficient access control, which allows re

23RISK

open ↗

Referência

CVE-2010-0939

CVE-2010-0939—

Visialis ABB Forum 1.1 stores sensitive information under the web root with insufficient access control, which allows re

23RISK

open ↗

Referência✓ VexDay Proof

PEEL CMS 3.x - Admin Hash Extraction / Arbitrary File Upload

CVE-2008-1506—webappsphp

PEEL, possibly 3.x and earlier, allows remote attackers to obtain configuration information via a direct request to phpi

23RISK

open ↗

Referência

CVE-2010-0765

CVE-2010-0765—

fipsForum 2.6 stores sensitive information under the web root with insufficient access control, which allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

Kmita Mail 3.0 - 'file' Remote File Inclusion

CVE-2008-2199—webappsphp

PHP remote file inclusion vulnerability in kmitaadmin/kmitam/htmlcode.php in Kmita Mail 3.0 and earlier, when register_g

23RISK

open ↗

Referência

CVE-2004-1580

CVE-2004-1580—

SQL injection vulnerability in index.php in CubeCart 2.0.1 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência

CVE-2018-11532

CVE-2018-11532—

An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonst

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.