Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,426 exploits
Referência
CVE-2026-96896
CVE-2026-96896HIGH
Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request
41RISK
open ↗
Referência
CVE-2023-28771
CVE-2023-28771CRITICALunder attack
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware vers
100RISK
open ↗
Referência✓ VexDay Proof
Trawler Web CMS 1.8.1 - Multiple Remote File Inclusions
CVE-2006-5495—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Trawler Web CMS 1.8.1 and earlier allow remote attackers to execut
23RISK
open ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHunder attack
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHunder attack
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗
Referência
CVE-2008-2565
CVE-2008-2565—
Multiple SQL injection vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
CiBlog 3.1 - 'id' SQL Injection
CVE-2008-2971—webappsphp
SQL injection vulnerability in links-extern.php in CiBlog 3.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
KwsPHP 1.3.456 Module Galerie - 'id_gal' SQL Injection
CVE-2008-6197—webappsphp
SQL injection vulnerability in index.php in the galerie module for KwsPHP 1.3.456 allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
2532/Gigs 1.2.2 - Arbitrary Database Backup/Download
CVE-2008-6199—webappsphp
2532designs 2532|Gigs 1.2.2 and earlier allows remote attackers to trigger a backup and obtain sensitive information via
23RISK
open ↗
Referência✓ VexDay Proof
FretsWeb 1.2 - Multiple Local File Inclusions
CVE-2009-2109—webappsphp
Multiple directory traversal vulnerabilities in FretsWeb 1.2 allow remote attackers to read arbitrary files via director
23RISK
open ↗
Referência✓ VexDay Proof
PHPFK 7.03 - 'page_bottom.php' Local File Inclusion
CVE-2009-2112—webappsphp
Directory traversal vulnerability in include/page_bottom.php in phpFK 7.03 allows remote attackers to include and execut
23RISK
open ↗
Referência✓ VexDay Proof
TekBase All-in-One 3.1 - Multiple SQL Injections
CVE-2009-2120—webappsphp
Multiple SQL injection vulnerabilities in TekBase All-in-One 3.1 allow remote authenticated users to execute arbitrary S
23RISK
open ↗
Referência
CVE-2010-2334
CVE-2010-2334—
Directory traversal vulnerability in themes/default/download.php in Yamamah Photo Gallery 1.00, as distributed before 20
23RISK
open ↗
Referência
CVE-2016-1105
CVE-2016-1105—
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsof
35RISK
open ↗
Referência
CVE-2010-0802
CVE-2010-0802—
SQL injection vulnerability in index.php in (nv2) Awards 1.1.0, a modification for Invision Power Board, allows remote a
23RISK
open ↗
Referência
CVE-2016-4534
CVE-2016-4534—
The McAfee VirusScan Console (mcconsol.exe) in McAfee VirusScan Enterprise 8.8.0 before Hotfix 1123565 (8.8.0.1546) on W
23RISK
open ↗
Referência
CVE-2023-3187
CVE-2023-3187MEDIUM
PHPGurukul Teachers Record Management System Profile Picture changeimage.php unrestricted upload
33RISK
open ↗
Referência✓ VexDay Proof
Essentia Web Server 2.15 - GET Remote Denial of Service
CVE-2006-5850—doswindows
Stack-based buffer overflow in Essentia Web Server 2.15 for Windows allows remote attackers to execute arbitrary code vi
23RISK
open ↗
Referência
CVE-2008-6392
CVE-2008-6392—
SQL injection vulnerability in showads.php in Z1Exchange allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Referência
CVE-2023-33592
CVE-2023-33592—
Lost and Found Information System v1.0 was discovered to contain a SQL injection vulnerability via the component /php-lf
23RISK
open ↗
Referência
CVE-2009-2255
CVE-2009-2255—
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which a
35RISK
open ↗
Referência
CVE-2026-14210
CVE-2026-14210MEDIUM
Insufficient Granularity of Access Control in GitLab
33RISK
open ↗
Referência
CVE-2009-2257
CVE-2009-2257—
The administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to bypass authentic
23RISK
open ↗
Referência
CVE-2026-13169
CVE-2026-13169HIGH
Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR
41RISK
open ↗
Referência✓ VexDay Proof
PHPWebThings 1.4 - 'msg'/'forum' SQL Injection
CVE-2005-4218—webappsphp
SQL injection vulnerability in forum.php in PHPWebThings 1.4 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2022-30333
CVE-2022-30333CRITICALunder attackransomware
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
100RISK
open ↗
Referência
CVE-2026-93975
CVE-2026-93975MEDIUM
code-projects Assessment Management User Editing edit-user.php cross site scripting
33RISK
open ↗
Referência✓ VexDay Proof
Rama CMS 0.68 - Cookie: lang Local File Inclusion
CVE-2006-5894—webappsphp
Directory traversal vulnerability in lang.php in Rama CMS 0.68 and earlier, when register_globals is enabled, allows rem
23RISK
open ↗
Referência
CVE-2026-12375
CVE-2026-12375CRITICAL
Uncanny Automator Pro 7.3.0.5 - Backdoor via Compromised Vendor Update Server
48RISK
open ↗
Referência
CVE-2026-82842
CVE-2026-82842HIGH
SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching
41RISK
open ↗
← previouspage 705 / 881next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.