Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,494 exploits
Referência
CVE-2010-3484
CVE-2010-3484—
SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2018-13441
CVE-2018-13441—
qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows atta
23RISK
open ↗
Referência
CVE-2012-2573
CVE-2012-2573—
Multiple cross-site scripting (XSS) vulnerabilities in T-dah WebMail 3.2.0-2.3 allow remote attackers to inject arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
PHPNS 1.1 - 'shownews.php?id' SQL Injection
CVE-2007-4628—webappsphp
SQL injection vulnerability in shownews.php in phpns 1.1 allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Referência✓ VexDay Proof
Pc4Uploader 9.0 - Blind SQL Injection
CVE-2009-1742—webappsphp
code.php in PC4Arb Pc4 Uploader 9.0 and earlier makes it easier for remote attackers to conduct SQL injection attacks vi
23RISK
open ↗
Referência✓ VexDay Proof
Acoustica Mixcraft 4.2 Build 98 - 'mx4' Local Buffer Overflow
CVE-2008-3877—localwindows
Stack-based buffer overflow in Acoustica Mixcraft 4.1 Build 96 and 4.2 Build 98 allows user-assisted attackers to execut
23RISK
open ↗
Referência
CVE-2009-2775
CVE-2009-2775—
SQL injection vulnerability in linkout.php in PHPArcadeScript (PHP Arcade Script) 4.0 allows remote attackers to execute
23RISK
open ↗
Referência
CVE-2010-2038
CVE-2010-2038—
Cross-site scripting (XSS) vulnerability in include/tool/editing_files.php in gpEasy CMS 1.6.2 allows remote authenticat
23RISK
open ↗
Referência
CVE-2010-3484
CVE-2010-3484—
SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2011-4806
CVE-2011-4806—
Multiple cross-site scripting (XSS) vulnerabilities in main.php in phpAlbum 0.4.1.16 and earlier allow remote attackers
23RISK
open ↗
Referência
SPBAS Business Automation Software 2012 - Multiple Vulnerabilities
CVE-2013-4665—webappsphp
SPBAS Business Automation Software 2012 has CSRF.
23RISK
open ↗
Referência
CVE-2015-1364
CVE-2015-1364—
SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.
23RISK
open ↗
Referência
CVE-2016-3653
CVE-2016-3653—
Multiple cross-site request forgery (CSRF) vulnerabilities in management scripts in Symantec Endpoint Protection Manager
23RISK
open ↗
Referência
CVE-2026-110010
CVE-2026-110010MEDIUM
MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' Parameter
33RISK
open ↗
Referência
CVE-2026-108646
CVE-2026-108646MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/category/importExcel
33RISK
open ↗
Referência
CVE-2017-18078
CVE-2017-18078—
systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the
23RISK
open ↗
Referência
CVE-2015-8420
CVE-2015-8420—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and
35RISK
open ↗
Referência
CVE-2017-10204
CVE-2017-10204—
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version
23RISK
open ↗
Referência✓ VexDay Proof
Gravity Board X 2.0 Beta - SQL Injection / (Authenticated) Code Execution
CVE-2009-1277—webappsphp
SQL injection vulnerability in index.php in Gravity Board X (GBX) 2.0 BETA allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2017-18078
CVE-2017-18078—
systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the
23RISK
open ↗
Referência
CVE-2019-15627
CVE-2019-15627—
Versions 10.0, 11.0 and 12.0 of the Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, w
23RISK
open ↗
Referência
CVE-2026-108614
CVE-2026-108614MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXls
33RISK
open ↗
Referência
CVE-2026-108613
CVE-2026-108613MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint
33RISK
open ↗
Referência✓ VexDay Proof
Cahier de texte 2.0 - 'lire.php' SQL Injection
CVE-2006-5221—webappsphp
Multiple SQL injection vulnerabilities in Cahier de texte 2.0 allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2013-10064
CVE-2013-10064CRITICAL
ActFax 5.01 RAW Server Buffer Overflow
63RISK
open ↗
Referência✓ VexDay Proof
UStore 1.0 - 'detail.asp' SQL Injection
CVE-2006-5891—webappsasp
SQL injection vulnerability in detail.asp in Superfreaker Studios UStore 1.0 allows remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Estate Agent Manager 1.3 - 'default.asp' Authentication Bypass
CVE-2006-5934—webappsasp
SQL injection vulnerability in admin/default.asp in Estate Agent Manager 1.3 and earlier allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2014-2847
CVE-2014-2847—
SQL injection vulnerability in default.asp in CIS Manager CMS allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2014-8359
CVE-2014-8359—
Untrusted search path vulnerability in Huawei Mobile Partner for Windows 23.009.05.03.1014 allows local users to execute
23RISK
open ↗
Referência
CVE-2010-2616
CVE-2010-2616—
SQL injection vulnerability in bible.php in PHP Bible Search, probably 0.99, allows remote attackers to execute arbitrar
23RISK
open ↗
← previouspage 721 / 884next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.