Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,426 exploits
Referência
CVE-2018-17428
CVE-2018-17428—
An issue was discovered in OPAC EasyWeb Five 5.7. There is SQL injection via the w2001/index.php?scelta=campi biblio par
23RISK
open ↗
Referência
CVE-2019-11416
CVE-2019-11416—
A CSRF issue was discovered on Intelbras IWR 3000N 1.5.0 devices, leading to complete control of the router, as demonstr
23RISK
open ↗
Referência
CVE-2023-36266
CVE-2023-36266—
An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 (fixed in 17.2), and the KeeperFill Brows
23RISK
open ↗
Referência
CVE-2026-96548
CVE-2026-96548MEDIUM
sfturing hosp_order jdbc.properties hard-coded credentials
33RISK
open ↗
Referência
CVE-2026-84091
CVE-2026-84091MEDIUM
SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPN
33RISK
open ↗
Referência
CVE-2005-4696
CVE-2005-4696—
The Microsoft Wireless Zero Configuration system (WZCS) stores WEP keys and pair-wise Master Keys (PMK) of the WPA pre-s
23RISK
open ↗
Referência
CVE-2016-8655
CVE-2016-8655—
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau
43RISK
open ↗
Referência
CVE-2006-1747
CVE-2006-1747—
PHP remote file inclusion vulnerability in Virtual War (VWar) 1.5.0 allows remote attackers to execute arbitrary PHP cod
23RISK
open ↗
Referência
CVE-2013-4950
CVE-2013-4950—
Cross-site scripting (XSS) vulnerability in view.php in Machform 2 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗
Referência
CVE-2011-5228
CVE-2011-5228—
Cross-site scripting (XSS) vulnerability in the Search module (quickstart/search) in appRain CMF 0.1.5 allows remote att
23RISK
open ↗
Referência
CVE-2017-8479
CVE-2017-8479—
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,
23RISK
open ↗
Referência
CVE-2018-10310
CVE-2018-10310—
A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Conse
23RISK
open ↗
Referência
CVE-2026-11530
CVE-2026-11530MEDIUM
imvks786 student_management_system Login index.ph sql injection
33RISK
open ↗
Referência
CVE-2026-3326
CVE-2026-3326HIGH
XStore < 9.7.3 - Unauthenticated SQLi
56RISK
open ↗
Referência
CVE-2018-10310
CVE-2018-10310—
A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Conse
23RISK
open ↗
Referência
CVE-2014-9311
CVE-2014-9311—
Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remo
23RISK
open ↗
Referência✓ VexDay Proof
SoftBB 0.1 - 'cmd' Remote Command Execution
CVE-2006-4632—webappsphp
Multiple SQL injection vulnerabilities in SoftBB 0.1, and possibly earlier, allow remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2015-1422
CVE-2015-1422—
Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2012-2939
CVE-2012-2939—
Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute
23RISK
open ↗
Referência
CVE-2015-2798
CVE-2015-2798—
SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência
CVE-2010-1270
CVE-2010-1270—
SQL injection vulnerability in auktion.php in Multi Auktions Komplett System 2 allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2015-2838
CVE-2015-2838—
Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote
23RISK
open ↗
Referência✓ VexDay Proof
rgboard 3.0.12 - Remote File Inclusioni / Cross-Site Scripting
CVE-2008-2295—webappsphp
Cross-site scripting (XSS) vulnerability in rg_search.php in Rgboard 3.0.12, and possibly earlier versions, allows remot
23RISK
open ↗
Referência✓ VexDay Proof
Zeeways ZeeJobsite 2.0 - 'adid' SQL Injection
CVE-2008-3706—webappsphp
SQL injection vulnerability in bannerclick.php in ZEEJOBSITE 2.0 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência
CVE-2015-1497
CVE-2015-1497—
radexecd.exe in Persistent Systems Radia Client Automation (RCA) 7.9, 8.1, 9.0, and 9.1 allows remote attackers to execu
60RISK
open ↗
Referência
CVE-2017-9123
CVE-2017-9123—
The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of se
23RISK
open ↗
Referência
CVE-2012-2913
CVE-2012-2913—
Multiple cross-site scripting (XSS) vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to
23RISK
open ↗
Referência
CVE-2018-1563
CVE-2018-1563MEDIUM
IBM Sterling B2B Integrator Standard Edition (IBM Sterling File Gateway 2.2.0 through 2.2.6) is vulnerable to cross-site
33RISK
open ↗
Referência
CVE-2014-0476
CVE-2014-0476—
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute a
38RISK
open ↗
Referência
CVE-2023-3845
CVE-2023-3845LOW
mooSocial mooDating URL ajax_invite cross site scripting
43RISK
open ↗
← previouspage 700 / 881next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.