Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits

40,804CVEs with public exploitation

24,696lab-tested

All Referência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecent popular risk

26,494 exploits

Referência

CVE-2010-2905

CVE-2010-2905—

SQL injection vulnerability in info.php in ScriptsFeed and BrotherScripts (BS) Scripts Directory allows remote attackers

23RISK

open ↗

Referência

CVE-2010-5057

CVE-2010-5057—

SQL injection vulnerability in detResolucion.php in CMS Ariadna 1.1 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência

CVE-2010-1062

CVE-2010-1062—

Directory traversal vulnerability in codelib/sys/common.inc.php in Phpkobo Free Real Estate Contact Form 1.09, when magi

23RISK

open ↗

Referência

CVE-2013-1306

CVE-2013-1306—

Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a cr

35RISK

open ↗

Referência

CVE-2015-4039

CVE-2015-4039—

Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authent

23RISK

open ↗

Referência✓ VexDay Proof

EQdkp 1.3.1 - 'Referer Spoof' Remote Database Backup

CVE-2007-0760—webappsphp

EQdkp 1.3.1 and earlier authenticates administrative requests by verifying that the HTTP Referer header specifies an adm

23RISK

open ↗

Referência

CVE-2007-1580

CVE-2007-1580—

FTPDMIN 0.96 allows remote attackers to cause a denial of service (daemon crash) via a LIST command for a Windows drive

23RISK

open ↗

Referência✓ VexDay Proof

ABC-View Manager 1.42 - '.psp' Local Buffer Overflow

CVE-2007-2284—localwindows

Buffer overflow in ABC-View Manager 1.42 allows user-assisted remote attackers to execute arbitrary code via a crafted .

23RISK

open ↗

Referência✓ VexDay Proof

hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities

CVE-2007-6501—webappsasp

Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to enable

23RISK

open ↗

Referência✓ VexDay Proof

The Everything Development System Pre-1.0 - SQL Injection

CVE-2008-0724—webappsphp

The Everything Development Engine in The Everything Development System Pre-1.0 and earlier stores passwords in cleartext

23RISK

open ↗

Referência✓ VexDay Proof

Simple Customer 1.2 - 'contact.php' SQL Injection

CVE-2008-6081—webappsphp

SQL injection vulnerability in contact.php in Simple Customer 1.2 allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência

CVE-2022-41073

CVE-2022-41073HIGHunder attackransomware

Windows Print Spooler Elevation of Privilege Vulnerability

71RISK

open ↗

Referência

CVE-2018-18794

CVE-2018-18794—

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.

23RISK

open ↗

Referência

CVE-2012-5899

CVE-2012-5899—

Cross-site scripting (XSS) vulnerability in admin/action/objects.php in SAMEDIA LandShop 0.9.2 allows remote attackers t

23RISK

open ↗

Referência

CVE-2018-18794

CVE-2018-18794—

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.

23RISK

open ↗

Referência

CVE-2013-1362

CVE-2013-1362—

Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote att

60RISK

open ↗

Referência

CVE-2013-5117

CVE-2013-5117—

SQL injection vulnerability in the RSS page (DNNArticleRSS.aspx) in the ZLDNN DNNArticle module before 10.1 for DotNetNu

23RISK

open ↗

Referência✓ VexDay Proof

Pixie CMS - Cross-Site Scripting / SQL Injection

CVE-2009-1066—webappsphp

SQL injection vulnerability in the referral function in admin/lib/lib_logs.php in Pixie CMS 1.01a allows remote attacker

23RISK

open ↗

Referência

CVE-2018-6023

CVE-2018-6023—

Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi act

23RISK

open ↗

Referência

CVE-2018-12739

CVE-2018-12739—

In BEESCMS 4.0, CSRF allows administrators to be added arbitrarily, a related issue to CVE-2018-10266.

23RISK

open ↗

Referência

CVE-2018-6023

CVE-2018-6023—

Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi act

23RISK

open ↗

Referência

CVE-2026-19439

CVE-2026-19439HIGH

Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details

41RISK

open ↗

Referência

CVE-2012-2588

CVE-2012-2588—

Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component RWCards 3.0.11 - Local File Inclusion

CVE-2008-6172—webappsphp

Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla!

43RISK

open ↗

Referência

CVE-2009-3542

CVE-2009-3542—

Directory traversal vulnerability in ls.php in LittleSite (aka LS or LittleSite.php) 0.1 allows remote attackers to incl

23RISK

open ↗

Referência

CVE-2010-2910

CVE-2010-2910—

SQL injection vulnerability in the Ozio Gallery (com_oziogallery) component for Joomla! allows remote attackers to execu

23RISK

open ↗

Referência

CVE-2010-4924

CVE-2010-4924—

PHP remote file inclusion vulnerability in logic/controller.class.php in clearBudget 0.9.8 allows remote attackers to ex

23RISK

open ↗

Referência

CVE-2012-3837

CVE-2012-3837—

Multiple cross-site scripting (XSS) vulnerabilities in apps/users/registration.template.php in Baby Gekko 1.2.0 and earl

23RISK

open ↗

Referência

CVE-2012-4262

CVE-2012-4262—

Multiple cross-site scripting (XSS) vulnerabilities in myCare2x allow remote attackers to inject arbitrary web script or

23RISK

open ↗

Referência

CVE-2015-4064

CVE-2015-4064—

SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allo

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.