Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,137cataloged exploits
35,961CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,657GitHub PoC 14,424VulnCheck XDB 8,773Nuclei 4,340Metasploit 3,485✓ verified onlyrecentpopularrisk
22,657 exploits
Referência
CVE-2009-4426
CVE-2009-4426—
Multiple directory traversal vulnerabilities in Ignition 1.2, when magic_quotes_gpc is disabled, allow remote attackers
23RISK
open ↗
Referência
CVE-2018-11404
CVE-2018-11404—
DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter.
23RISK
open ↗
Referência
CVE-2016-5237
CVE-2016-5237—
Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to m
23RISK
open ↗
Referência
CVE-2014-9528
CVE-2014-9528—
SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListControlle
23RISK
open ↗
Referência
CVE-2014-9528
CVE-2014-9528—
SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListControlle
23RISK
open ↗
Referência✓ VexDay Proof
beLive 0.2.3 - 'arch.php?arch' Local File Inclusion
CVE-2009-1649—webappsphp
Directory traversal vulnerability in arch.php in beLive 0.2.3 allows remote attackers to read arbitrary files via a .. (
23RISK
open ↗
Referência
CVE-2026-5311
CVE-2026-5311MEDIUM
D-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control
33RISK
open ↗
Referência
CVE-2026-5310
CVE-2026-5310LOW
Enter Software Iperius Backup IperiusAccounts.ini hard-coded key
28RISK
open ↗
Referência
CVE-2010-1924
CVE-2010-1924—
SQL injection vulnerability in index.php in Hi Web Wiesbaden Live Shopping Multi Portal System allows remote attackers t
23RISK
open ↗
Referência
CVE-2010-5003
CVE-2010-5003—
SQL injection vulnerability in the AutarTimonial (com_autartimonial) component 1.0.8 for Joomla! allows remote attackers
23RISK
open ↗
Referência
CVE-2010-5003
CVE-2010-5003—
SQL injection vulnerability in the AutarTimonial (com_autartimonial) component 1.0.8 for Joomla! allows remote attackers
23RISK
open ↗
Referência
CVE-2023-5212
CVE-2023-5212CRITICAL
AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file
48RISK
open ↗
Referência
CVE-2016-5309
CVE-2016-5309—
The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP);
23RISK
open ↗
Referência
CVE-2009-2792
CVE-2009-2792—
Directory traversal vulnerability in plugings/pagecontent.php in Really Simple CMS (RSCMS) 0.3a allows remote attackers
23RISK
open ↗
Referência
CVE-2009-3825
CVE-2009-3825—
Multiple directory traversal vulnerabilities in GenCMS 2006 allow remote attackers to include and execute arbitrary loca
23RISK
open ↗
Referência
CVE-2012-5685
CVE-2012-5685—
SQL injection vulnerability in ZPanel 10.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Referência
CVE-2010-1936
CVE-2010-1936—
Directory traversal vulnerability in scr/soustab.php in openMairie openComInterne 1.01, when register_globals is enabled
23RISK
open ↗
Referência
CVE-2009-3596
CVE-2009-3596—
JoxTechnology Ajox Poll does not properly restrict access to admin/managepoll.php, which allows remote attackers to bypa
23RISK
open ↗
Referência
CVE-2010-1936
CVE-2010-1936—
Directory traversal vulnerability in scr/soustab.php in openMairie openComInterne 1.01, when register_globals is enabled
23RISK
open ↗
Referência
CVE-2018-15845
CVE-2018-15845—
There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add.
23RISK
open ↗
Referência
CVE-2021-42751
CVE-2021-42751—
A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrat
23RISK
open ↗
Referência
CVE-2009-2330
CVE-2009-2330—
Cross-site scripting (XSS) vulnerability in admin/admin_menu.php in CMS Chainuk 1.2 and earlier allows remote attackers
23RISK
open ↗
Referência
CVE-2015-4460
CVE-2015-4460—
Cross-site request forgery (CSRF) vulnerability in SecuritySetting/UserSecurity/UserManagement.aspx in B.A.S C2Box befor
23RISK
open ↗
Referência
CVE-2021-42750
CVE-2021-42750—
A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrat
23RISK
open ↗
Referência✓ VexDay Proof
CoAST 0.95 - 'sections_file' Remote File Inclusion
CVE-2008-4735—webappsphp
PHP remote file inclusion vulnerability in header.php in Concord Asset, Software, and Ticket system (CoAST) 0.95 allows
23RISK
open ↗
Referência✓ VexDay Proof
The Net Guys ASPired2Poll - Remote Database Disclosure
CVE-2008-6354—webappsasp
The Net Guys ASPired2poll stores sensitive information under the web root with insufficient access control, which allows
23RISK
open ↗
Referência
CVE-2012-10027
CVE-2012-10027CRITICAL
WordPress Plugin WP-Property <= 1.35.0 PHP File Upload
63RISK
open ↗
Referência✓ VexDay Proof
Mailist 3.0 - Insecure Backup / Local File Inclusion
CVE-2009-0571—webappsphp
admin.php in Ninja Designs Mailist 3.0 stores backup copies of maillist.php under the web root with insufficient access
23RISK
open ↗
Referência✓ VexDay Proof
vm Watermark for Gallery 0.4.1 - Remote File Inclusion
CVE-2007-2575—webappsphp
PHP remote file inclusion vulnerability in watermark.php in the vm (aka Jean-Francois Laflamme) watermark 0.4.1 mod for
23RISK
open ↗
Referência✓ VexDay Proof
Flatchat 3.0 - 'pmscript.php' Local File Inclusion
CVE-2009-1486—webappsphp
Directory traversal vulnerability in pmscript.php in Flatchat 3.0 allows remote attackers to include and execute arbitra
23RISK
open ↗
← previouspage 637 / 756next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.