Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,494 exploits
Referência✓ VexDay Proof
phpAtm 1.21 - 'include_location' Remote File Inclusion
CVE-2006-4594—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpAtm) 1.21 and earlier allow remo
23RISK
open ↗
Referência
CVE-2012-2914
CVE-2012-2914—
Cross-site scripting (XSS) vulnerability in captchademo.php in Unijimpe Captcha allows remote attackers to inject arbitr
23RISK
open ↗
Referência✓ VexDay Proof
e107 < 0.75 - 'e107language_e107cookie' Local File Inclusion
CVE-2006-5786—webappsphp
Directory traversal vulnerability in class2.php in e107 0.7.5 and earlier allows remote attackers to read and execute PH
23RISK
open ↗
Referência
CVE-2012-5908
CVE-2012-5908—
Cross-site scripting (XSS) vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remo
23RISK
open ↗
Referência
CVE-2012-6510
CVE-2012-6510—
Multiple cross-site scripting (XSS) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to inject arbi
23RISK
open ↗
Referência✓ VexDay Proof
GPB Bulletin Board - Multiple Remote File Inclusions
CVE-2007-2204—webappsphp
Multiple PHP remote file inclusion vulnerabilities in GPL PHP Board (GPB) unstable-2001.11.14-1 allow remote attackers t
23RISK
open ↗
Referência
CVE-2007-3133
CVE-2007-3133—
SQL injection vulnerability in urunbak.asp in W1L3D4 WEBmarket 0.1 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência
CVE-2014-9101
CVE-2014-9101—
Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall 1.7.0 (build 7907 and 7906) and SkaDate Lite 2.0 (b
23RISK
open ↗
Referência
CVE-2014-9101
CVE-2014-9101—
Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall 1.7.0 (build 7907 and 7906) and SkaDate Lite 2.0 (b
23RISK
open ↗
Referência✓ VexDay Proof
AuraCMS 2.2 - Remote Add Administrator
CVE-2007-6552—webappsphp
Directory traversal vulnerability in index.php in AuraCMS 2.2 allows remote authenticated users to include and execute a
23RISK
open ↗
Referência✓ VexDay Proof
Exero CMS 1.0.1 - 'theme' Multiple Local File Inclusions
CVE-2008-1409—webappsphp
Multiple directory traversal vulnerabilities in the Default theme in Exero CMS 1.0.1 allow remote attackers to include a
23RISK
open ↗
Referência✓ VexDay Proof
OtomiGen.x 2.2 - 'lang' Local File Inclusion
CVE-2008-2782—webappsphp
Multiple directory traversal vulnerabilities in OtomiGenX 2.2 allow remote attackers to include and execute arbitrary lo
23RISK
open ↗
Referência✓ VexDay Proof
syzygyCMS 0.3 - 'index.php' Local File Inclusion
CVE-2008-3593—webappsphp
Directory traversal vulnerability in index.php in SyzygyCMS 0.3 allows remote attackers to include and execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Mini-CMS 1.0.1 - 'index.php' Local File Inclusion
CVE-2008-5593—webappsphp
Multiple directory traversal vulnerabilities in index.php in Mini CMS 1.0.1 allow remote attackers to include and execut
23RISK
open ↗
Referência✓ VexDay Proof
KTP Computer Customer Database CMS 1.0 - Local File Inclusion
CVE-2008-5953—webappsphp
Directory traversal vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, all
23RISK
open ↗
Referência✓ VexDay Proof
emergecolab 1.0 - 'sitecode' Local File Inclusion
CVE-2008-5990—webappsphp
Directory traversal vulnerability in connect/init.inc in emergecolab 1.0 allows remote attackers to include and execute
23RISK
open ↗
Referência
CVE-2015-6911
CVE-2015-6911—
SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2015-4137
CVE-2015-4137—
SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2018-1204
CVE-2018-1204—
Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, an
23RISK
open ↗
Referência
CVE-2012-1027
CVE-2012-1027—
Cross-site scripting (XSS) vulnerability in account-closed.tcl in ]project-open[ (aka ]po[) 3.4.x, 3.5.0.1-2, and possib
23RISK
open ↗
Referência
CVE-2026-101105
CVE-2026-101105MEDIUM
code-projects Matrimonial System Profile Creation Endpoint create_profile processprofile_form sql injection
33RISK
open ↗
Referência
CVE-2026-81742
CVE-2026-81742HIGH
BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation
41RISK
open ↗
Referência
CVE-2019-3999
CVE-2019-3999—
Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, u
38RISK
open ↗
Referência✓ VexDay Proof
Cahier de texte 2.2 - Bypass General Access Protection
CVE-2006-6849—webappsphp
administration/index.php in Cahier de texte (CDT) 2.2 does not properly exit when authentication fails, which allows rem
23RISK
open ↗
Referência
CVE-2015-1400
CVE-2015-1400—
SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows - GDI+ '.ICO' File Remote Denial of Service
CVE-2007-2237—doswindows
Microsoft Windows Graphics Device Interface (GDI+, GdiPlus.dll) allows context-dependent attackers to cause a denial of
28RISK
open ↗
Referência
CVE-2015-4137
CVE-2015-4137—
SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Flat PHP Board 1.2 - Multiple Vulnerabilities
CVE-2007-6396—webappsphp
Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inj
23RISK
open ↗
Referência
CVE-2015-6827
CVE-2015-6827—
Cross-site request forgery (CSRF) vulnerability in Auto-Exchanger 5.1.0 allows remote attackers to hijack the authentica
23RISK
open ↗
Referência✓ VexDay Proof
X7 Chat 2.0.5 - 'day' SQL Injection
CVE-2008-0278—webappsphp
SQL injection vulnerability in index.php in X7 Chat 2.0.5 and possibly earlier allows remote attackers to execute arbitr
23RISK
open ↗
← previouspage 734 / 884next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.