Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,426 exploits
Referência✓ VexDay Proof
CMS Made Simple 1.2.4 Module FileManager - Arbitrary File Upload
CVE-2008-2267—webappsphp
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and e
23RISK
open ↗
Referência
CVE-2016-1819
CVE-2016-1819—
Use-after-free vulnerability in the IOAccelContext2::clientMemoryForType method in Apple iOS before 9.3.2, OS X before 1
23RISK
open ↗
Referência
CVE-2010-1300
CVE-2010-1300—
SQL injection vulnerability in index.php in Yamamah (aka Dove Photo Album) 1.00 allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
PNPHPBB2 < 1.2i - 'ModName' Multiple Local File Inclusions
CVE-2009-0592—webappsphp
Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute
35RISK
open ↗
Referência
CVE-2010-2349
CVE-2010-2349—
H264WebCam 3.7 allows remote attackers to cause a denial of service (crash) via a long URI in a GET request, which trigg
23RISK
open ↗
Referência
CVE-2010-3419
CVE-2010-3419—
Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote atta
23RISK
open ↗
Referência
CVE-2010-4170
CVE-2010-4170—
The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allow
38RISK
open ↗
Referência
CVE-2010-4934
CVE-2010-4934—
SQL injection vulnerability in video.php in Get Tube 4.51 and earlier allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2014-2623
CVE-2014-2623—
Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown
60RISK
open ↗
Referência
CVE-2009-2852
CVE-2009-2852—
WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbi
23RISK
open ↗
Referência
CVE-2009-3574
CVE-2009-3574—
Tuniac 090517c allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a lon
23RISK
open ↗
Referência
CVE-2012-2276
CVE-2012-2276—
The IRM Server in EMC Documentum Information Rights Management 4.x before 4.7.0100 and 5.x before 5.0.1030 allows remote
23RISK
open ↗
Referência
CVE-2015-2090
CVE-2015-2090—
SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 fo
23RISK
open ↗
Referência
CVE-2015-4010
CVE-2015-4010—
Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows rem
23RISK
open ↗
Referência
CVE-2017-13869
CVE-2017-13869—
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS b
23RISK
open ↗
Referência
Veyon 4.4.1 - 'VeyonService' Unquoted Service Path
CVE-2020-15261HIGHlocalwindows
Unquoted service path vulnerability on Veyon
46RISK
open ↗
Referência
CVE-2021-43140
CVE-2021-43140—
SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login.
23RISK
open ↗
Referência✓ VexDay Proof
FlashBB 1.1.8 - 'sendmsg.php' Remote File Inclusion
CVE-2007-3697—webappsphp
PHP remote file inclusion vulnerability in phpbb/sendmsg.php in FlashBB 1.1.8 and earlier allows remote attackers to exe
28RISK
open ↗
Referência
CVE-2014-9175
CVE-2014-9175—
SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote
23RISK
open ↗
Referência
CVE-2014-9175
CVE-2014-9175—
SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote
23RISK
open ↗
Referência
CVE-2012-1002
CVE-2012-1002—
SQL injection vulnerability in author/edit.php in OpenConf 4.x before 4.12 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2015-2090
CVE-2015-2090—
SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 fo
23RISK
open ↗
Referência
CVE-2015-4667
CVE-2015-4667—
Multiple hardcoded credentials in Xsuite 2.x.
28RISK
open ↗
Referência
CVE-2017-18195
CVE-2017-18195—
An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enum
28RISK
open ↗
Referência
CVE-2018-10504
CVE-2018-10504—
The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.
23RISK
open ↗
Referência✓ VexDay Proof
Maian Search 1.1 - Insecure Cookie Handling
CVE-2008-3317—webappsphp
admin/index.php in Maian Search 1.1 and earlier allows remote attackers to bypass authentication and gain administrative
23RISK
open ↗
Referência
CVE-2026-15476
CVE-2026-15476MEDIUM
QILING Disk Master Kernel Driver diskbckp.sys access control
33RISK
open ↗
Referência✓ VexDay Proof
Maian Recipe 1.2 - Insecure Cookie Handling
CVE-2008-3322—webappsphp
admin/index.php in Maian Recipe 1.2 and earlier allows remote attackers to bypass authentication and gain administrative
23RISK
open ↗
Referência
CVE-2018-15768
CVE-2018-15768—
Insecure MySQL Configuration Vulnerability
23RISK
open ↗
Referência
CVE-2016-7400
CVE-2016-7400—
Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗
← previouspage 696 / 881next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.