Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,137cataloged exploits
35,961CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,657GitHub PoC 14,424VulnCheck XDB 8,773Nuclei 4,340Metasploit 3,485✓ verified onlyrecentpopularrisk
22,657 exploits
Referência
CVE-2018-6563
CVE-2018-6563—
Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow
23RISK
open ↗
Referência
CVE-2010-4918
CVE-2010-4918—
PHP remote file inclusion vulnerability in iJoomla Magazine (com_magazine) component 3.0.1 for Joomla! allows remote att
23RISK
open ↗
Referência
CVE-2010-4918
CVE-2010-4918—
PHP remote file inclusion vulnerability in iJoomla Magazine (com_magazine) component 3.0.1 for Joomla! allows remote att
23RISK
open ↗
Referência
CVE-2010-0966
CVE-2010-0966—
PHP remote file inclusion vulnerability in inc/config.php in deV!L`z Clanportal (DZCP) 1.5.2, when register_globals is e
23RISK
open ↗
Referência✓ VexDay Proof
MyBlog: PHP and MySQL Blog/CMS software - SQL Injection / Cross-Site Scripting
CVE-2008-2962—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in MyBlog allow remote attackers to inject arbitrary web script or H
23RISK
open ↗
Referência
CVE-2012-1912
CVE-2012-1912—
Cross-site scripting (XSS) vulnerability in preferences.php in PHP Address Book 7.0 and earlier allows remote attackers
23RISK
open ↗
Referência
CVE-2014-9096
CVE-2014-9096—
Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute a
23RISK
open ↗
Referência
CVE-2015-2070
CVE-2015-2070—
SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2015-2070
CVE-2015-2070—
SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2015-1476
CVE-2015-1476—
Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência
CVE-2015-1476
CVE-2015-1476—
Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
Google Chrome 1.0.154.43 - Clickjacking
CVE-2009-0374—remotewindows
Google Chrome 1.0.154.43 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action th
23RISK
open ↗
Referência✓ VexDay Proof
snetworks PHP Classifieds 5.0 - Remote File Inclusion
CVE-2008-0137—webappsphp
PHP remote file inclusion vulnerability in config.inc.php in SNETWORKS PHP CLASSIFIEDS 5.0 allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2013-1347
CVE-2013-1347HIGHunder attack
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbit
100RISK
open ↗
Referência
CVE-2008-5072
CVE-2008-5072—
vsfilter.dll in K-Lite Mega Codec Pack 3.5.7.0 allows remote attackers to cause a denial of service (application crash)
23RISK
open ↗
Referência
CVE-2018-7465
CVE-2018-7465—
An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by
23RISK
open ↗
Referência
CVE-2026-12202
CVE-2026-12202MEDIUM
Intelliants Subrion CMS Blocks Endpoint cross site scripting
33RISK
open ↗
Referência
CVE-2009-4465
CVE-2009-4465—
DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attac
23RISK
open ↗
Referência
CVE-2015-4077
CVE-2015-4077—
The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient b
23RISK
open ↗
Referência
CVE-2017-9650
CVE-2017-9650—
An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL
23RISK
open ↗
Referência
CVE-2013-5640
CVE-2013-5640—
Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (
23RISK
open ↗
Referência
CVE-2013-5640
CVE-2013-5640—
Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (
23RISK
open ↗
Referência
CVE-2010-3480
CVE-2010-3480—
Directory traversal vulnerability in index.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allows re
23RISK
open ↗
Referência
CVE-2015-4077
CVE-2015-4077—
The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient b
23RISK
open ↗
Referência
CVE-2026-15383
CVE-2026-15383MEDIUM
Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header
33RISK
open ↗
Referência✓ VexDay Proof
GNU/Gallery 1.1.1.0 - 'admin.php' Local File Inclusion
CVE-2008-2353—webappsphp
Directory traversal vulnerability in admin.php in GNU/Gallery 1.1.1.0 and earlier allows remote attackers to include and
23RISK
open ↗
Referência
CVE-2012-6557
CVE-2012-6557—
Multiple cross-site scripting (XSS) vulnerabilities in the AboutMe plugin 1.1.1 for Vanilla Forums allow remote attacker
23RISK
open ↗
Referência
CVE-2011-5041
CVE-2011-5041—
Multiple cross-site scripting (XSS) vulnerabilities in Pulse Pro CMS 1.7.2 allow remote attackers to inject arbitrary we
23RISK
open ↗
Referência
CVE-2012-10038
CVE-2012-10038CRITICAL
Auxilium RateMyPet Arbitrary File Upload RCE
63RISK
open ↗
Referência✓ VexDay Proof
MyBlog: PHP and MySQL Blog/CMS software - SQL Injection / Cross-Site Scripting
CVE-2008-2963—webappsphp
Multiple SQL injection vulnerabilities in MyBlog allow remote attackers to execute arbitrary SQL commands via the (1) vi
23RISK
open ↗
← previouspage 643 / 756next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.