Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits

40,804CVEs with public exploitation

24,696lab-tested

All Referência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecent popular risk

26,494 exploits

Referência

CVE-2010-4924

CVE-2010-4924—

PHP remote file inclusion vulnerability in logic/controller.class.php in clearBudget 0.9.8 allows remote attackers to ex

23RISK

open ↗

Referência

CVE-2012-3837

CVE-2012-3837—

Multiple cross-site scripting (XSS) vulnerabilities in apps/users/registration.template.php in Baby Gekko 1.2.0 and earl

23RISK

open ↗

Referência

CVE-2012-4262

CVE-2012-4262—

Multiple cross-site scripting (XSS) vulnerabilities in myCare2x allow remote attackers to inject arbitrary web script or

23RISK

open ↗

Referência

CVE-2015-4064

CVE-2015-4064—

SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allo

23RISK

open ↗

Referência

CVE-2022-23366

CVE-2022-23366—

HMS v1.0 was discovered to contain a SQL injection vulnerability via patientlogin.php.

23RISK

open ↗

Referência

CVE-2015-4064

CVE-2015-4064—

SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allo

23RISK

open ↗

Referência

CVE-2011-5041

CVE-2011-5041—

Multiple cross-site scripting (XSS) vulnerabilities in Pulse Pro CMS 1.7.2 allow remote attackers to inject arbitrary we

23RISK

open ↗

Referência

CVE-2009-4465

CVE-2009-4465—

DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attac

23RISK

open ↗

Referência

CVE-2018-7465

CVE-2018-7465—

An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by

23RISK

open ↗

Referência

CVE-2026-85418

CVE-2026-85418MEDIUM

Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget

33RISK

open ↗

Referência

CVE-2026-12202

CVE-2026-12202MEDIUM

Intelliants Subrion CMS Blocks Endpoint cross site scripting

33RISK

open ↗

Referência

CVE-2015-4077

CVE-2015-4077—

The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient b

23RISK

open ↗

Referência

CVE-2017-9650

CVE-2017-9650—

An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL

23RISK

open ↗

Referência

CVE-2012-10038

CVE-2012-10038CRITICAL

Auxilium RateMyPet Arbitrary File Upload RCE

63RISK

open ↗

Referência

CVE-2010-3480

CVE-2010-3480—

Directory traversal vulnerability in index.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allows re

23RISK

open ↗

Referência✓ VexDay Proof

Mafia Scum Tools 2.0.0 - 'index.php?gen' Remote File Inclusion

CVE-2007-0501—webappsphp

PHP remote file inclusion vulnerability in index.php in Mafia Scum Tools 2.0.0 in Matthew Wardrop Advanced Random Genera

23RISK

open ↗

Referência✓ VexDay Proof

PHP 4.4.6 - 'ibase_connect()' Local Buffer Overflow

CVE-2007-1475—localwindows

Multiple buffer overflows in the (1) ibase_connect and (2) ibase_pconnect functions in the interbase extension in PHP 4.

23RISK

open ↗

Referência

CVE-2012-6557

CVE-2012-6557—

Multiple cross-site scripting (XSS) vulnerabilities in the AboutMe plugin 1.1.1 for Vanilla Forums allow remote attacker

23RISK

open ↗

Referência

CVE-2013-5640

CVE-2013-5640—

Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (

23RISK

open ↗

Referência✓ VexDay Proof

WordPress Plugin wordTube 1.43 - 'wpPATH' Remote File Inclusion

CVE-2007-2481—webappsphp

PHP remote file inclusion vulnerability in wordtube-button.php in the wordTube 1.43 and earlier plugin for WordPress, wh

35RISK

open ↗

Referência

CVE-2013-5640

CVE-2013-5640—

Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (

23RISK

open ↗

Referência

CVE-2015-4077

CVE-2015-4077—

The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient b

23RISK

open ↗

Referência✓ VexDay Proof

Integramod Nederland 1.4.2 - Remote File Inclusion

CVE-2007-5140—webappsphp

PHP remote file inclusion vulnerability in includes/archive/archive_topic.php in IntegraMOD Nederland 1.4.2 allows remot

23RISK

open ↗

Referência✓ VexDay Proof

teatro 1.6 - 'basePath' Remote File Inclusion

CVE-2007-5780—webappsphp

PHP remote file inclusion vulnerability in pub/pub08_comments.php in teatro 1.6 allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

VHD Web Pack 2.0 - 'index.php' Local File Inclusion

CVE-2008-0609—webappsphp

Directory traversal vulnerability in index.php in DivideConcept VHD Web Pack 2.0 allows remote attackers to include and

23RISK

open ↗

Referência✓ VexDay Proof

LightBlog 9.6 - 'Username' Local File Inclusion

CVE-2008-0840—webappsphp

Directory traversal vulnerability in view_member.php in Public Warehouse LightBlog 9.6 allows remote attackers to includ

23RISK

open ↗

Referência✓ VexDay Proof

GNU/Gallery 1.1.1.0 - 'admin.php' Local File Inclusion

CVE-2008-2353—webappsphp

Directory traversal vulnerability in admin.php in GNU/Gallery 1.1.1.0 and earlier allows remote attackers to include and

23RISK

open ↗

Referência

CVE-2008-5072

CVE-2008-5072—

vsfilter.dll in K-Lite Mega Codec Pack 3.5.7.0 allows remote attackers to cause a denial of service (application crash)

23RISK

open ↗

Referência

CVE-2026-82537

CVE-2026-82537HIGH

Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch

41RISK

open ↗

Referência

CVE-2014-9345

CVE-2014-9345—

SQL injection vulnerability in Guruperl.net Advertise With Pleasure! Professional (aka AWP PRO) 6.6 and earlier allows r

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.