Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,494 exploits
Referência
CVE-2010-5289
CVE-2010-5289—
Buffer overflow in the Authenticate method in the INCREDISPOOLERLib.Pop ActiveX control in ImSpoolU.dll in IncrediMail 2
23RISK
open ↗
Referência✓ VexDay Proof
iScripts Socialware - 'id' SQL Injection
CVE-2008-1772—webappsphp
iScripts SocialWare stores passwords in cleartext in a database, which allows context-dependent attackers to obtain sens
23RISK
open ↗
Referência
CVE-2012-2940
CVE-2012-2940—
MediaChance Real-DRAW PRO 5.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted (
23RISK
open ↗
Referência✓ VexDay Proof
BtiTracker 1.4.7 / xbtit 2.0.542 - SQL Injection
CVE-2008-3784—webappsphp
SQL injection vulnerability in scrape.php in BtiTracker 1.4.7 and earlier and xBtiTracker 2.0.542 and earlier allows rem
23RISK
open ↗
Referência
CVE-2012-5228
CVE-2012-5228—
Cross-site scripting (XSS) vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions befo
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component PAX Gallery 0.1 - Blind SQL Injection
CVE-2008-5811—webappsphp
SQL injection vulnerability in the PaxGallery (com_paxgallery) component 0.1 for Joomla! allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2013-6058
CVE-2013-6058—
SQL injection vulnerability in appRain CMF 3.0.2 and earlier allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2014-9243
CVE-2014-9243—
Multiple cross-site scripting (XSS) vulnerabilities in WebsiteBaker 2.8.3 allow remote attackers to inject arbitrary web
23RISK
open ↗
Referência
CVE-2011-10026
CVE-2011-10026CRITICAL
Spreecommerce < 0.50.x API RCE
63RISK
open ↗
Referência
CVE-2011-10026
CVE-2011-10026CRITICAL
Spreecommerce < 0.50.x API RCE
63RISK
open ↗
Referência
CVE-2014-9113
CVE-2014-9113—
CCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engagement) 7.1 and earlier uses weak permissions (Authenticated Use
23RISK
open ↗
Referência
CVE-2015-2803
CVE-2015-2803—
SQL injection vulnerability in mod1/index.php in the Akronymmanager (sb_akronymmanager) extension before 7.0.0 for TYPO3
23RISK
open ↗
Referência
CVE-2009-0760
CVE-2009-0760—
Team Board 1.x and 2.x stores sensitive information under the web root with insufficient access control, which allows re
23RISK
open ↗
Referência
CVE-2023-33383
CVE-2023-33383—
Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition t
23RISK
open ↗
Referência✓ VexDay Proof
XAMPP for Windows 1.6.0a - 'mssql_connect()' Remote Buffer Overflow
CVE-2007-2079—remotewindows
The ADONewConnection Connect function in adodb.php in XAMPP 1.6.0a and earlier for Windows uses untrusted input for the
23RISK
open ↗
Referência
CVE-2010-5055
CVE-2010-5055—
SQL injection vulnerability in index.php in Almnzm 2.1 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2012-1049
CVE-2012-1049—
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ADManager Plus 5.2 Build 5210 allow remote attackers
23RISK
open ↗
Referência
CVE-2019-19726
CVE-2019-19726—
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be
38RISK
open ↗
Referência
CVE-2019-19726
CVE-2019-19726—
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be
38RISK
open ↗
Referência
CVE-2026-102366
CVE-2026-102366LOW
mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints
28RISK
open ↗
Referência
CVE-2013-6872
CVE-2013-6872—
SQL injection vulnerability in managetimetracker.php in Collabtive before 1.2 allows remote authenticated users to execu
23RISK
open ↗
Referência✓ VexDay Proof
OTManager CMS 24a - Local File Inclusion / Cross-Site Scripting
CVE-2008-5201—webappsphp
Directory traversal vulnerability in index.php in OTManager CMS 24a allows remote attackers to include and execute arbit
23RISK
open ↗
Referência
CVE-2010-5055
CVE-2010-5055—
SQL injection vulnerability in index.php in Almnzm 2.1 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2013-6872
CVE-2013-6872—
SQL injection vulnerability in managetimetracker.php in Collabtive before 1.2 allows remote authenticated users to execu
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_hbssearch 1.0 - Blind SQL Injection
CVE-2008-5865—webappsphp
SQL injection vulnerability in the com_hbssearch component 1.0 in the Hotel Booking Reservation System (aka HBS) 1.0.0 f
23RISK
open ↗
Referência
CVE-2014-3868
CVE-2014-3868—
Multiple SQL injection vulnerabilities in ZeusCart 4.x.
23RISK
open ↗
Referência
CVE-2015-2803
CVE-2015-2803—
SQL injection vulnerability in mod1/index.php in the Akronymmanager (sb_akronymmanager) extension before 7.0.0 for TYPO3
23RISK
open ↗
Referência
CVE-2019-9625
CVE-2019-9625—
JBMC DirectAdmin 1.55 allows CSRF via the /CMD_ACCOUNT_ADMIN URI to create a new admin account.
23RISK
open ↗
Referência
CVE-2025-65008
CVE-2025-65008CRITICAL
OS Command Injection in WODESYS WD-R608U router
48RISK
open ↗
Referência✓ VexDay Proof
Mini-stream RM-MP3 Converter 3.0.0.7 - '.m3u' Local Stack Overflow (PoC)
CVE-2009-1328—doswindows
Stack-based buffer overflow in Mini-stream RM-MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary code vi
23RISK
open ↗
← previouspage 723 / 884next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.