Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits

40,804CVEs with public exploitation

24,696lab-tested

All Referência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecent popular risk

26,494 exploits

Referência

CVE-2010-2622

CVE-2010-2622—

SQL injection vulnerability in the Joomanager component, possibly 1.1.1, for Joomla! allows remote attackers to execute

23RISK

open ↗

Referência

CVE-2016-8807

CVE-2016-8807—

For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3

23RISK

open ↗

Referência✓ VexDay Proof

All Club CMS 0.0.2 - Remote Database Configuration Retrieve

CVE-2008-7069—webappsphp

All Club CMS (ACCMS) 0.0.2 and earlier stores sensitive information under the web root with insufficient access control,

23RISK

open ↗

Referência

Multi Language Olx Clone Script - Cross-Site Scripting

CVE-2018-6845—webappsphp

PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field.

23RISK

open ↗

Referência

CVE-2021-42053

CVE-2021-42053—

The Unicorn framework through 0.35.3 for Django allows XSS via component.name.

23RISK

open ↗

Referência✓ VexDay Proof

Ixprim CMS 1.2 - Blind SQL Injection

CVE-2006-6755—webappsphp

Ixprim 1.2 allows remote attackers to obtain sensitive information via a direct request for kernel/plugins/fckeditor2/ix

23RISK

open ↗

Referência✓ VexDay Proof

TinyWebGallery 1.7.6 - Local File Inclusion / Remote Code Execution

CVE-2009-1911—webappsphp

Directory traversal vulnerability in .include/init.php (aka admin/_include/init.php) in QuiXplorer 2.3.2 and earlier, as

23RISK

open ↗

Referência

CVE-2010-0942

CVE-2010-0942—

Directory traversal vulnerability in the jVideoDirect (com_jvideodirect) component for Joomla! allows remote attackers t

38RISK

open ↗

Referência

CVE-2010-1701

CVE-2010-1701—

SQL injection vulnerability in browse.html in PHP Video Battle Script allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

MyBloggie 2.1.6 - Multiple SQL Injections

CVE-2007-1899—webappsphp

Multiple SQL injection vulnerabilities in myWebland myBloggie 2.1.6 allow remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência

CVE-2012-1934

CVE-2012-1934—

SQL injection vulnerability in admin/country/edit.php in Newscoop before 3.5.5 and 4.x before 4 RC4 allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities

CVE-2007-6499—webappsasp

Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to uninsta

23RISK

open ↗

Referência✓ VexDay Proof

Prozilla Topsites 1.0 - Arbitrary Edit/Add Users

CVE-2008-1784—webappsphp

Prozilla Topsites 1.0 allows remote attackers to perform administrative actions via a direct request to (1) addu.php, (2

23RISK

open ↗

Referência

CVE-2014-0864

CVE-2014-0864—

Multiple cross-site request forgery (CSRF) vulnerabilities in Executer in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5

23RISK

open ↗

Referência

CVE-2015-3302

CVE-2015-3302—

The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1

28RISK

open ↗

Referência

CVE-2015-3306

CVE-2015-3306CRITICALunder attack

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and

100RISK

open ↗

Referência

CVE-2015-3306

CVE-2015-3306CRITICALunder attack

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and

100RISK

open ↗

Referência✓ VexDay Proof

realm CMS 2.3 - Multiple Vulnerabilities

CVE-2008-2682—webappsphp

_RealmAdmin/login.asp in Realm CMS 2.3 and earlier allows remote attackers to bypass authentication and access admin pag

23RISK

open ↗

Referência✓ VexDay Proof

Natterchat 1.12 - Database Disclosure

CVE-2008-5602—webappsasp

Natterchat 1.12 stores sensitive information under the web root with insufficient access control, which allows remote at

23RISK

open ↗

Referência

CVE-2008-6279

CVE-2008-6279—

RakhiSoftware Price Comparison Script (aka Shopping Cart) allows remote attackers to obtain sensitive information via an

23RISK

open ↗

Referência

CVE-2016-5195

CVE-2016-5195HIGHunder attack

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

open ↗

Referência✓ VexDay Proof

OpenForum 0.66 Beta - Remote Reset Admin Password

CVE-2008-7066—webappsphp

OpenForum 0.66 Beta allows remote attackers to bypass authentication and reset passwords of other users via a direct req

23RISK

open ↗

Referência

CVE-2018-9173

CVE-2018-9173—

Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows rem

23RISK

open ↗

Referência✓ VexDay Proof

NuralStorm Webmail 0.98b - 'process.php' Remote File Inclusion

CVE-2006-5386—webappsphp

PHP remote file inclusion vulnerability in process.php in NuralStorm Webmail 0.98b and earlier, when register_globals is

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_bookJoomlas 0.1 - SQL Injection

CVE-2009-1263—webappsphp

SQL injection vulnerability in sub_commententry.php in the BookJoomlas (com_bookjoomlas) component 0.1 for Joomla! allow

23RISK

open ↗

Referência✓ VexDay Proof

Ultimate HelpDesk - Cross-Site Scripting / Local File Disclosure

CVE-2006-6381—webappsasp

Directory traversal vulnerability in getfile.asp in Ultimate HelpDesk allows remote attackers to read arbitrary files vi

23RISK

open ↗

Referência

CVE-2009-3317

CVE-2009-3317—

PHP remote file inclusion vulnerability in pages/pageHeader.php in OpenSiteAdmin 0.9.7 BETA allows remote attackers to e

23RISK

open ↗

Referência✓ VexDay Proof

ASP-Nuke Community 1.5 - Cookie Privilege Escalation

CVE-2006-7152—webappsasp

default.asp in ASP-Nuke Community 1.5 and earlier allows remote attackers to gain privileges by setting certain pseudo c

23RISK

open ↗

Referência

CVE-2026-58377

CVE-2026-58377HIGH

JeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret Keys

41RISK

open ↗

Referência✓ VexDay Proof

McGallery 0.5b - 'download.php' Arbitrary File Download

CVE-2007-1478—webappsphp

download.php in McGallery 0.5b allows remote attackers to read arbitrary files and obtain script source code via the fil

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.