Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits

40,804CVEs with public exploitation

24,696lab-tested

All Referência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecent popular risk

26,494 exploits

Referência

CVE-2015-4065

CVE-2015-4065—

Cross-site scripting (XSS) vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before

23RISK

open ↗

Referência

CVE-2013-1466

CVE-2013-1466—

Multiple cross-site scripting (XSS) vulnerabilities in glFusion before 1.2.2.pl4 allow remote attackers to inject arbitr

23RISK

open ↗

Referência

CVE-2022-24112

CVE-2022-24112CRITICALunder attack

apisix/batch-requests plugin allows overwriting the X-REAL-IP header

100RISK

open ↗

Referência

CVE-2026-5315

CVE-2026-5315MEDIUM

Nothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-bounds

33RISK

open ↗

Referência

CVE-2026-5314

CVE-2026-5314MEDIUM

Nothings stb TTF File stb_truetype.h stbtt_InitFont_internal out-of-bounds

33RISK

open ↗

Referência

CVE-2015-7309

CVE-2015-7309—

The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authent

50RISK

open ↗

Referência

CVE-2009-4625

CVE-2009-4625—

SQL injection vulnerability in the updateOnePage function in components/com_bfsurvey_pro/controller.php in BF Survey Pro

23RISK

open ↗

Referência

CVE-2010-1046

CVE-2010-1046—

Multiple SQL injection vulnerabilities in index.php in Rostermain 1.1 and earlier allow remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

PHPIndexPage 1.0.1 - 'config.php' Remote File Inclusion

CVE-2007-0499—webappsphp

PHP remote file inclusion vulnerability in config.php in Sangwan Kim phpIndexPage 1.0.1 and earlier allows remote attack

23RISK

open ↗

Referência

CVE-2024-8673

CVE-2024-8673CRITICAL

Z-Downloads < 1.11.7 - Admin+ Stored XSS via SVG Upload

63RISK

open ↗

Referência

CVE-2010-2915

CVE-2010-2915—

SQL injection vulnerability in welcome.php in AJ Square AJ HYIP PRIME allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Sendcard 3.4.1 - 'sendcard.php?form' Local File Inclusion

CVE-2007-2471—webappsphp

Directory traversal vulnerability in sendcard.php in Sendcard 3.4.1 and earlier allows remote attackers to read arbitrar

23RISK

open ↗

Referência

CVE-2010-2915

CVE-2010-2915—

SQL injection vulnerability in welcome.php in AJ Square AJ HYIP PRIME allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

XZero Community Classifieds 4.95.11 - Local File Inclusion / SQL Injection

CVE-2007-6566—webappsphp

SQL injection vulnerability in post.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to ex

23RISK

open ↗

Referência

CVE-2010-5047

CVE-2010-5047—

SQL injection vulnerability in page.php in V-EVA Press Release Script allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2026-5312

CVE-2026-5312MEDIUM

D-Link DNS-1550-04 dsk_mgr.cgi Get_current_raidtype access control

33RISK

open ↗

Referência

CVE-2010-5047

CVE-2010-5047—

SQL injection vulnerability in page.php in V-EVA Press Release Script allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

newsmanager 2.0 - Remote File Inclusion / File Disclosure / SQL Injection

CVE-2008-2343—webappsphp

News Manager 2.0 allows remote attackers to bypass restrictions and obtain sensitive information via a direct request to

23RISK

open ↗

Referência

CVE-2012-4873

CVE-2012-4873—

Cross-site scripting (XSS) vulnerability in the file_download function in GNUBoard before 4.34.21 allows remote attacker

23RISK

open ↗

Referência✓ VexDay Proof

Fastpublish CMS 1.9999 - Local File Inclusion / SQL Injection

CVE-2008-4519—webappsphp

Multiple directory traversal vulnerabilities in Fastpublish CMS 1.9999 d allow remote attackers to include and execute a

23RISK

open ↗

Referência

CVE-2013-1466

CVE-2013-1466—

Multiple cross-site scripting (XSS) vulnerabilities in glFusion before 1.2.2.pl4 allow remote attackers to inject arbitr

23RISK

open ↗

Referência

CVE-2015-4072

CVE-2015-4072—

Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote att

23RISK

open ↗

Referência✓ VexDay Proof

Pre Simple CMS - Authentication Bypass

CVE-2008-5058—webappsphp

SQL injection vulnerability in siteadmin/loginsucess.php in Pre Simple CMS allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2008-5336

CVE-2008-5336—

SQL injection vulnerability in index.php in WebStudio CMS allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

RaidenFTPd 2.4 build 3620 - Remote Denial of Service

CVE-2008-6186—doswindows

Stack-based buffer overflow in RaidenFTPD 2.4 build 3620 allows remote authenticated users to cause a denial of service

23RISK

open ↗

Referência

CVE-2019-3501

CVE-2019-3501—

The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards pag

23RISK

open ↗

Referência

CVE-2014-3434

CVE-2014-3434—

Buffer overflow in the sysplant driver in Symantec Endpoint Protection (SEP) Client 11.x and 12.x before 12.1 RU4 MP1b,

23RISK

open ↗

Referência

CVE-2026-101052

CVE-2026-101052MEDIUM

refly-ai refly JWT Token app.config.ts hard-coded credentials

33RISK

open ↗

Referência

CVE-2026-86716

CVE-2026-86716MEDIUM

Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow

33RISK

open ↗

Referência

CVE-2018-8908

CVE-2018-8908—

An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CS

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.