Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,494 exploits
Referência✓ VexDay Proof
mBlog 1.2 - 'page' Remote File Disclosure
CVE-2007-6582—webappsphp
Directory traversal vulnerability in index.php in mBlog 1.2 allows remote attackers to read arbitrary files via a .. (do
23RISK
open ↗
Referência✓ VexDay Proof
artmedic weblog 1.0 - Multiple Local File Inclusions
CVE-2008-0798—webappsphp
Multiple directory traversal vulnerabilities in artmedic webdesign weblog 1.0, when magic_quotes_gpc is disabled, allow
23RISK
open ↗
Referência
CVE-2012-6043
CVE-2012-6043—
Cross-site scripting (XSS) vulnerability in downloads.php in PHP-Fusion 7.02.04 allows remote attackers to inject arbitr
23RISK
open ↗
Referência
CVE-2013-1469
CVE-2013-1469—
Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbit
35RISK
open ↗
Referência✓ VexDay Proof
moziloCMS 1.10.1 - 'download.php' Arbitrary Download File
CVE-2008-3589—webappsphp
Directory traversal vulnerability in download.php in moziloCMS 1.10.1, when magic_quotes_gpc is disabled, allows remote
23RISK
open ↗
Referência
CVE-2015-4084
CVE-2015-4084—
Cross-site scripting (XSS) vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
TinyCMS 1.1.2 - 'templater.php' Local File Inclusion
CVE-2008-4740—webappsphp
Directory traversal vulnerability in templater.php in the ZZ_Templater module in TinyCMS 1.1.2, when register_globals is
23RISK
open ↗
Referência
CVE-2016-5237
CVE-2016-5237—
Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to m
23RISK
open ↗
Referência
CVE-2009-4426
CVE-2009-4426—
Multiple directory traversal vulnerabilities in Ignition 1.2, when magic_quotes_gpc is disabled, allow remote attackers
23RISK
open ↗
Referência
CVE-2009-4723
CVE-2009-4723—
Directory traversal vulnerability in confirm.php in Netpet CMS 1.9 allows remote attackers to include and execute arbitr
23RISK
open ↗
Referência
CVE-2010-5003
CVE-2010-5003—
SQL injection vulnerability in the AutarTimonial (com_autartimonial) component 1.0.8 for Joomla! allows remote attackers
23RISK
open ↗
Referência
CVE-2026-5311
CVE-2026-5311MEDIUM
D-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control
33RISK
open ↗
Referência
CVE-2026-5310
CVE-2026-5310LOW
Enter Software Iperius Backup IperiusAccounts.ini hard-coded key
28RISK
open ↗
Referência
CVE-2018-11404
CVE-2018-11404—
DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter.
23RISK
open ↗
Referência
CVE-2023-5212
CVE-2023-5212CRITICAL
AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file
48RISK
open ↗
Referência
CVE-2026-101017
CVE-2026-101017MEDIUM
Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition
33RISK
open ↗
Referência
CVE-2014-9528
CVE-2014-9528—
SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListControlle
23RISK
open ↗
Referência
CVE-2009-3507
CVE-2009-3507—
Directory traversal vulnerability in modules.php in CMSphp 0.21 allows remote attackers to include and execute arbitrary
23RISK
open ↗
Referência
Sanitized XenForo write-up and proof of concept for CVE-2026-73321.
CVE-2026-73321HIGH
XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser
41RISK
open ↗
Referência✓ VexDay Proof
DynamicPAD 1.02.18 - 'HomeDir' Remote File Inclusion
CVE-2007-2527—webappsphp
Multiple PHP remote file inclusion vulnerabilities in DynamicPAD before 1.03.31 allow remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2010-5003
CVE-2010-5003—
SQL injection vulnerability in the AutarTimonial (com_autartimonial) component 1.0.8 for Joomla! allows remote attackers
23RISK
open ↗
Referência
CVE-2015-7601
CVE-2015-7601—
Directory traversal vulnerability in PCMan's FTP Server 2.0.7 allows remote attackers to read arbitrary files via a ..//
50RISK
open ↗
Referência
CVE-2009-3823
CVE-2009-3823—
Directory traversal vulnerability in myhtml.php in Mobilelib GOLD 3.0, when magic_quotes_gpc is enabled, allows remote a
23RISK
open ↗
Referência
CVE-2012-5331
CVE-2012-5331—
Directory traversal vulnerability in asaanCart 0.9 allows remote attackers to include arbitrary local files via a .. (do
23RISK
open ↗
Referência
CVE-2014-9528
CVE-2014-9528—
SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListControlle
23RISK
open ↗
Referência
CVE-2009-4426
CVE-2009-4426—
Multiple directory traversal vulnerabilities in Ignition 1.2, when magic_quotes_gpc is disabled, allow remote attackers
23RISK
open ↗
Referência
CVE-2010-1924
CVE-2010-1924—
SQL injection vulnerability in index.php in Hi Web Wiesbaden Live Shopping Multi Portal System allows remote attackers t
23RISK
open ↗
Referência
CVE-2014-3216
CVE-2014-3216—
GOM Media Player 2.2.57.5189 and earlier allows remote attackers to cause a denial of service (crash) via a crafted .ogg
23RISK
open ↗
Referência
CVE-2018-17310
CVE-2018-17310—
On the RICOH MP C1803 JPN printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of add
23RISK
open ↗
Referência
CVE-2015-7767
CVE-2015-7767—
Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code or cause a denial of
23RISK
open ↗
← previouspage 724 / 884next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.