Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,494 exploits
Referência
CVE-2016-1531
CVE-2016-1531—
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.
38RISK
open ↗
Referência
CVE-2020-37224
CVE-2020-37224HIGH
Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby
41RISK
open ↗
Referência
CVE-2020-37223
CVE-2020-37223HIGH
IObit Uninstaller 9.5.0.15 Unquoted Service Path Privilege Escalation
41RISK
open ↗
Referência
CVE-2020-37222
CVE-2020-37222MEDIUM
Kuicms Php EE 2.0 Persistent Cross-Site Scripting via bbs reply
33RISK
open ↗
Referência
CVE-2009-4186
CVE-2009-4186—
Stack consumption vulnerability in Apple Safari 4.0.3 on Windows allows remote attackers to cause a denial of service (a
23RISK
open ↗
Referência
CVE-2012-0277
CVE-2012-0277—
Heap-based buffer overflow in XnView before 1.99 allows remote attackers to cause a denial of service (application crash
23RISK
open ↗
Referência
CVE-2016-1813
CVE-2016-1813—
The IOAccelSharedUserClient2::page_off_resource method in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1
23RISK
open ↗
Referência
CVE-2026-19976
CVE-2026-19976MEDIUM
COMFAST CF-N1-S mbox-config sub_44A968 command injection
33RISK
open ↗
Referência
CVE-2015-6517
CVE-2015-6517—
Cross-site request forgery (CSRF) vulnerability in phpLiteAdmin 1.1 allows remote attackers to hijack the authentication
23RISK
open ↗
Referência
CVE-2026-88843
CVE-2026-88843HIGH
MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget
41RISK
open ↗
Referência
CVE-2022-24124
CVE-2022-24124—
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as d
50RISK
open ↗
Referência✓ VexDay Proof
Pro Chat Rooms 3.0.3 - SQL Injection
CVE-2008-5070—webappsphp
SQL injection vulnerability in Pro Chat Rooms 3.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execu
23RISK
open ↗
Referência
CVE-2016-5312
CVE-2016-5312—
Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote au
35RISK
open ↗
Referência✓ VexDay Proof
Pixie CMS - Cross-Site Scripting / SQL Injection
CVE-2009-1067—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Pixie CMS 1.01a allows remote attackers to inject arbitrary web
23RISK
open ↗
Referência✓ VexDay Proof
iziContents rc6 - Local/Remote File Inclusion
CVE-2005-4600—webappsphp
Directory traversal vulnerability in tiny_mce_gzip.php in TinyMCE Compressor PHP before 1.06 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Mozilla Firefox XSL - Parsing Remote Memory Corruption (PoC) (1)
CVE-2009-1169—dosmultiple
The txMozillaXSLTProcessor::TransformToDoc function in Mozilla Firefox before 3.0.8 and SeaMonkey before 1.1.16 allows r
28RISK
open ↗
Referência
CVE-2014-4613
CVE-2014-4613—
Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attacke
23RISK
open ↗
Referência
CVE-2014-4663
CVE-2014-4663—
TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2014-9095
CVE-2014-9095—
Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary S
23RISK
open ↗
Referência
CVE-2015-6519
CVE-2015-6519—
SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail
23RISK
open ↗
Referência
CVE-2015-6945
CVE-2015-6945—
Cross-site scripting (XSS) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to inject arbitrary we
23RISK
open ↗
Referência
CVE-2015-6545
CVE-2015-6545—
Cross-site request forgery (CSRF) vulnerability in ajax.php in Cerb before 7.0.4 allows remote attackers to hijack the a
23RISK
open ↗
Referência
CVE-2015-7515
CVE-2015-7515—
The aiptek_probe function in drivers/input/tablet/aiptek.c in the Linux kernel before 4.4 allows physically proximate at
23RISK
open ↗
Referência✓ VexDay Proof
WM Downloader - '.m3u' Local Stack Overflow (PoC)
CVE-2009-1327—doswindows
Stack-based buffer overflow in Mini-stream WM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a
23RISK
open ↗
Referência
CVE-2009-3964
CVE-2009-3964—
SQL injection vulnerability in the NinjaMonials (com_ninjacentral) component 1.1.0 for Joomla! allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
eazyPortal 1.0 - 'cookie' SQL Injection
CVE-2008-1121—webappsphp
SQL injection vulnerability in index.php in eazyPortal 1.0 and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Podcast Generator 1.0 Beta 2 - Remote File Inclusion / File Disclosure
CVE-2008-1124—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Podcast Generator 1.0 BETA 2 and earlier allow remote attackers to
28RISK
open ↗
Referência
Sphider Search Engine - Multiple Vulnerabilities
CVE-2014-5081—webappsphp
sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass
28RISK
open ↗
Referência
CVE-2014-5115
CVE-2014-5115—
Absolute path traversal vulnerability in DirPHP 1.0 allows remote attackers to read arbitrary files via a full pathname
23RISK
open ↗
Referência
CVE-2014-9148
CVE-2014-9148—
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update"
28RISK
open ↗
← previouspage 743 / 884next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.