Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,137cataloged exploits
35,961CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,657GitHub PoC 14,424VulnCheck XDB 8,773Nuclei 4,340Metasploit 3,485✓ verified onlyrecentpopularrisk
22,657 exploits
Referência
CVE-2015-5452
CVE-2015-5452—
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
xGB 2.0 - 'xGB.php' Remote Security Bypass
CVE-2007-4637—webappsphp
xGB.php in xGB 2.0 does not require authentication for an admin edit action, which allows remote attackers to make unspe
23RISK
open ↗
Referência
CVE-2010-4400
CVE-2010-4400—
SQL injection vulnerability in _rights.php in DynPG CMS 4.2.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2010-4400
CVE-2010-4400—
SQL injection vulnerability in _rights.php in DynPG CMS 4.2.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2013-5716
CVE-2013-5716—
Gretech GOM Media Player 2.2.53.5169 and possibly earlier allows remote attackers to cause a denial of service (applicat
23RISK
open ↗
Referência
CVE-2010-0754
CVE-2010-0754—
Cross-site scripting (XSS) vulnerability in index.php/Special/Main/Templates in WikyBlog 1.7.2 and 1.7.3 rc2 allows remo
23RISK
open ↗
Referência
CVE-2010-0754
CVE-2010-0754—
Cross-site scripting (XSS) vulnerability in index.php/Special/Main/Templates in WikyBlog 1.7.2 and 1.7.3 rc2 allows remo
23RISK
open ↗
Referência
CVE-2010-4874
CVE-2010-4874—
Multiple cross-site scripting (XSS) vulnerabilities in users.php in NinkoBB 1.3 RC5 allow remote attackers to inject arb
23RISK
open ↗
Referência
CVE-2010-4874
CVE-2010-4874—
Multiple cross-site scripting (XSS) vulnerabilities in users.php in NinkoBB 1.3 RC5 allow remote attackers to inject arb
23RISK
open ↗
Referência
CVE-2010-3137
CVE-2010-3137—
Untrusted search path vulnerability in Nullsoft Winamp 5.581, and probably other versions, allows local users, and possi
23RISK
open ↗
Referência
CVE-2015-5453
CVE-2015-5453—
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
50RISK
open ↗
Referência
CVE-2025-12735
CVE-2025-12735CRITICAL
CVE-2025-12735
48RISK
open ↗
Referência
CVE-2009-4657
CVE-2009-4657—
The administrator package for Xerver 4.32 does not require authentication, which allows remote attackers to alter applic
23RISK
open ↗
Referência
CVE-2013-10038
CVE-2013-10038CRITICAL
FlashChat Arbitrary File Upload RCE
63RISK
open ↗
Referência✓ VexDay Proof
Papoo CMS 3.x - 'pfadhier' Local File Inclusion
CVE-2009-0735—webappsphp
Directory traversal vulnerability in lib/classes/message_class.php in Papoo CMS 3.6, when register_globals is enabled an
23RISK
open ↗
Referência
CVE-2017-15958
CVE-2017-15958—
D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.
23RISK
open ↗
Referência
CVE-2017-15958
CVE-2017-15958—
D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.
23RISK
open ↗
Referência✓ VexDay Proof
XM Easy Personal FTP Server 1.0 - 'Port' Remote Overflow (PoC)
CVE-2006-2226—doswindows
Buffer overflow in XM Easy Personal FTP Server 4.2 and 5.0.1 allows remote authenticated users to cause a denial of serv
23RISK
open ↗
Referência✓ VexDay Proof
MySpeach 2.1b - 'up.php' Remote File Inclusion
CVE-2007-0498—webappsphp
PHP remote file inclusion vulnerability in up.php in MySpeach 2.1 beta and possibly earlier allows remote attackers to e
23RISK
open ↗
Referência✓ VexDay Proof
iziContents rc6 - Local/Remote File Inclusion
CVE-2007-5053—webappsphp
Multiple incomplete blacklist vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2016-0400
CVE-2016-0400—
CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0
23RISK
open ↗
Referência
CVE-2009-4993
CVE-2009-4993—
PHP remote file inclusion vulnerability in home.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
zFeeder 1.6 - 'admin.php' Admin Bypass
CVE-2009-0807—webappsphp
zFeeder 1.6 allows remote attackers to gain administrative access via a direct request to admin.php.
23RISK
open ↗
Referência
CVE-2015-4118
CVE-2015-4118—
SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated user
23RISK
open ↗
Referência✓ VexDay Proof
phpBB Ajax Shoutbox 0.0.5 - Remote File Inclusion
CVE-2006-5312—webappsphp
PHP remote file inclusion vulnerability in shoutbox.php in the Ajax Shoutbox 0.0.5 and earlier module for phpBB allows r
23RISK
open ↗
Referência
CVE-2021-41556
CVE-2021-41556CRITICAL
sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that ca
48RISK
open ↗
Referência✓ VexDay Proof
MiniGal b13 - Remote Code Execution
CVE-2007-2145—webappsphp
The imagecomments function in classes.php in MiniGal b13 allows remote attackers to inject arbitrary PHP code into a fil
23RISK
open ↗
Referência
CVE-2013-5039
CVE-2013-5039—
Cross-site request forgery (CSRF) vulnerability in goform/wlanBasicSecurity on the HOT HOTBOX router with software 2.1.1
23RISK
open ↗
Referência
CVE-2012-0899
CVE-2012-0899—
Cross-site scripting (XSS) vulnerability in referencement/sites_inscription.php in Annuaire PHP allows remote attackers
23RISK
open ↗
Referência
CVE-2010-2016
CVE-2010-2016—
SQL injection vulnerability in details.php in Iceberg CMS allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
← previouspage 654 / 756next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.