Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,494 exploits
Referência✓ VexDay Proof
The Everything Development System Pre-1.0 - SQL Injection
CVE-2008-0724—webappsphp
The Everything Development Engine in The Everything Development System Pre-1.0 and earlier stores passwords in cleartext
23RISK
open ↗
Referência✓ VexDay Proof
Simple Customer 1.2 - 'contact.php' SQL Injection
CVE-2008-6081—webappsphp
SQL injection vulnerability in contact.php in Simple Customer 1.2 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência
CVE-2022-41073
CVE-2022-41073HIGHunder attackransomware
Windows Print Spooler Elevation of Privilege Vulnerability
71RISK
open ↗
Referência
CVE-2018-18794
CVE-2018-18794—
School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.
23RISK
open ↗
Referência
CVE-2012-5899
CVE-2012-5899—
Cross-site scripting (XSS) vulnerability in admin/action/objects.php in SAMEDIA LandShop 0.9.2 allows remote attackers t
23RISK
open ↗
Referência
CVE-2018-18794
CVE-2018-18794—
School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.
23RISK
open ↗
Referência
CVE-2013-1362
CVE-2013-1362—
Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote att
60RISK
open ↗
Referência
CVE-2013-5117
CVE-2013-5117—
SQL injection vulnerability in the RSS page (DNNArticleRSS.aspx) in the ZLDNN DNNArticle module before 10.1 for DotNetNu
23RISK
open ↗
Referência✓ VexDay Proof
Pixie CMS - Cross-Site Scripting / SQL Injection
CVE-2009-1066—webappsphp
SQL injection vulnerability in the referral function in admin/lib/lib_logs.php in Pixie CMS 1.01a allows remote attacker
23RISK
open ↗
Referência
CVE-2018-6023
CVE-2018-6023—
Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi act
23RISK
open ↗
Referência
CVE-2018-12739
CVE-2018-12739—
In BEESCMS 4.0, CSRF allows administrators to be added arbitrarily, a related issue to CVE-2018-10266.
23RISK
open ↗
Referência
CVE-2018-6023
CVE-2018-6023—
Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi act
23RISK
open ↗
Referência
CVE-2026-19439
CVE-2026-19439HIGH
Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details
41RISK
open ↗
Referência
CVE-2012-2588
CVE-2012-2588—
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component RWCards 3.0.11 - Local File Inclusion
CVE-2008-6172—webappsphp
Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla!
43RISK
open ↗
Referência
CVE-2009-3542
CVE-2009-3542—
Directory traversal vulnerability in ls.php in LittleSite (aka LS or LittleSite.php) 0.1 allows remote attackers to incl
23RISK
open ↗
Referência
CVE-2010-2910
CVE-2010-2910—
SQL injection vulnerability in the Ozio Gallery (com_oziogallery) component for Joomla! allows remote attackers to execu
23RISK
open ↗
Referência
CVE-2010-4924
CVE-2010-4924—
PHP remote file inclusion vulnerability in logic/controller.class.php in clearBudget 0.9.8 allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2012-3837
CVE-2012-3837—
Multiple cross-site scripting (XSS) vulnerabilities in apps/users/registration.template.php in Baby Gekko 1.2.0 and earl
23RISK
open ↗
Referência
CVE-2012-4262
CVE-2012-4262—
Multiple cross-site scripting (XSS) vulnerabilities in myCare2x allow remote attackers to inject arbitrary web script or
23RISK
open ↗
Referência
CVE-2015-4064
CVE-2015-4064—
SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allo
23RISK
open ↗
Referência
CVE-2022-23366
CVE-2022-23366—
HMS v1.0 was discovered to contain a SQL injection vulnerability via patientlogin.php.
23RISK
open ↗
Referência
CVE-2015-4064
CVE-2015-4064—
SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allo
23RISK
open ↗
Referência
CVE-2011-5041
CVE-2011-5041—
Multiple cross-site scripting (XSS) vulnerabilities in Pulse Pro CMS 1.7.2 allow remote attackers to inject arbitrary we
23RISK
open ↗
Referência
CVE-2009-4465
CVE-2009-4465—
DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attac
23RISK
open ↗
Referência
CVE-2018-7465
CVE-2018-7465—
An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by
23RISK
open ↗
Referência
CVE-2026-85418
CVE-2026-85418MEDIUM
Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget
33RISK
open ↗
Referência
CVE-2026-12202
CVE-2026-12202MEDIUM
Intelliants Subrion CMS Blocks Endpoint cross site scripting
33RISK
open ↗
Referência
CVE-2015-4077
CVE-2015-4077—
The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient b
23RISK
open ↗
Referência
CVE-2017-9650
CVE-2017-9650—
An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL
23RISK
open ↗
← previouspage 736 / 884next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.