Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,426 exploits
Referência✓ VexDay Proof
WikkiTikkiTavi 1.11 - Arbitrary '.PHP' File Upload
CVE-2009-0602—webappsphp
Unrestricted file upload vulnerability in upload.php in WikkiTikkiTavi 1.11 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Simple PHP News 1.0 - Remote Command Execution
CVE-2009-0643—webappsphp
Static code injection vulnerability in post.php in Simple PHP News 1.0 final allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2014-8596
CVE-2014-8596—
Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2011-5196
CVE-2011-5196—
Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Journal Sys
23RISK
open ↗
Referência
CVE-2014-8681
CVE-2014-8681—
SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.
23RISK
open ↗
Referência
CVE-2022-0543
CVE-2022-0543CRITICALunder attack
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
100RISK
open ↗
Referência
CVE-2016-0891
CVE-2016-0891—
Multiple cross-site request forgery (CSRF) vulnerabilities in administrative pages in EMC ViPR SRM before 3.7 allow remo
23RISK
open ↗
Referência✓ VexDay Proof
BlueBird Pre-Release - Authentication Bypass
CVE-2009-0740—webappsphp
SQL injection vulnerability in login.php in BlueBird Prelease allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2012-0277
CVE-2012-0277—
Heap-based buffer overflow in XnView before 1.99 allows remote attackers to cause a denial of service (application crash
23RISK
open ↗
Referência
CVE-2022-27412
CVE-2022-27412—
Explore CMS v1.0 was discovered to contain a SQL injection vulnerability via a /page.php?id= request.
23RISK
open ↗
Referência
CVE-2016-1531
CVE-2016-1531—
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.
38RISK
open ↗
Referência
CVE-2026-19976
CVE-2026-19976MEDIUM
COMFAST CF-N1-S mbox-config sub_44A968 command injection
33RISK
open ↗
Referência
CVE-2009-4186
CVE-2009-4186—
Stack consumption vulnerability in Apple Safari 4.0.3 on Windows allows remote attackers to cause a denial of service (a
23RISK
open ↗
Referência
CVE-2020-37225
CVE-2020-37225MEDIUM
Powie's WHOIS Domain Check 0.9.31 Persistent Cross-Site Scripting
33RISK
open ↗
Referência
CVE-2014-8801
CVE-2014-8801—
Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress
28RISK
open ↗
Referência
CVE-2020-37224
CVE-2020-37224HIGH
Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby
41RISK
open ↗
Referência
CVE-2020-37223
CVE-2020-37223HIGH
IObit Uninstaller 9.5.0.15 Unquoted Service Path Privilege Escalation
41RISK
open ↗
Referência
CVE-2020-37222
CVE-2020-37222MEDIUM
Kuicms Php EE 2.0 Persistent Cross-Site Scripting via bbs reply
33RISK
open ↗
Referência✓ VexDay Proof
Kipper 2.01 - Cross-Site Scripting / Local File Inclusion / File Disclosure
CVE-2009-0763—webappsphp
Cross-site scripting (XSS) vulnerability in default.php in Kipper 2.01 allows remote attackers to inject arbitrary web s
23RISK
open ↗
Referência✓ VexDay Proof
Imera ImeraIEPlugin - ActiveX Control Remote Code Execution
CVE-2009-0813—remotewindows
Insecure method vulnerability in the ImeraIEPlugin ActiveX control (ImeraIEPlugin.dll 1.0.2.54) in Imera TeamLinks Clien
23RISK
open ↗
Referência
CVE-2016-1813
CVE-2016-1813—
The IOAccelSharedUserClient2::page_off_resource method in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1
23RISK
open ↗
Referência
CVE-2015-6517
CVE-2015-6517—
Cross-site request forgery (CSRF) vulnerability in phpLiteAdmin 1.1 allows remote attackers to hijack the authentication
23RISK
open ↗
Referência
CVE-2014-9095
CVE-2014-9095—
Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary S
23RISK
open ↗
Referência
CVE-2016-5312
CVE-2016-5312—
Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote au
35RISK
open ↗
Referência
CVE-2022-24124
CVE-2022-24124—
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as d
50RISK
open ↗
Referência
CVE-2026-88843
CVE-2026-88843HIGH
MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget
41RISK
open ↗
Referência
CVE-2015-6945
CVE-2015-6945—
Cross-site scripting (XSS) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to inject arbitrary we
23RISK
open ↗
Referência✓ VexDay Proof
iziContents rc6 - Local/Remote File Inclusion
CVE-2005-4600—webappsphp
Directory traversal vulnerability in tiny_mce_gzip.php in TinyMCE Compressor PHP before 1.06 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Pro Chat Rooms 3.0.3 - SQL Injection
CVE-2008-5070—webappsphp
SQL injection vulnerability in Pro Chat Rooms 3.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
Pixie CMS - Cross-Site Scripting / SQL Injection
CVE-2009-1067—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Pixie CMS 1.01a allows remote attackers to inject arbitrary web
23RISK
open ↗
← previouspage 706 / 881next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.