Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,139cataloged exploits

40,879CVEs with public exploitation

24,696lab-tested

All Referência 26,555Exploit-DB 24,489GitHub PoC 18,366VulnCheck XDB 10,605Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

26,555 exploits

Referência

CVE-2010-1111

CVE-2010-1111—

Multiple cross-site scripting (XSS) vulnerabilities in Jokes Complete Website allow remote attackers to inject arbitrary

23RISK

open ↗

Referência

CVE-2011-0748

CVE-2011-0748—

Multiple cross-site request forgery (CSRF) vulnerabilities in phpList before 2.10.13 allow remote attackers to hijack th

23RISK

open ↗

Referência

CVE-2009-3592

CVE-2009-3592—

Cross-site scripting (XSS) vulnerability in customer/home.php in Qualiteam X-Cart allows remote attackers to inject arbi

23RISK

open ↗

Referência

CVE-2015-7865

CVE-2015-7865—

nvSCPAPISvr.exe in the Stereoscopic 3D Driver Service in the NVIDIA GPU graphics driver R340 before 341.92, R352 before

23RISK

open ↗

Referência

CVE-2009-4596

CVE-2009-4596—

Cross-site scripting (XSS) vulnerability in index.php in PHP Inventory 1.2 allows remote attackers to inject arbitrary w

23RISK

open ↗

Referência

CVE-2023-3342

CVE-2023-3342CRITICAL

User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload

48RISK

open ↗

Referência

CVE-2008-6278

CVE-2008-6278—

Multiple cross-site scripting (XSS) vulnerabilities in product.php in RakhiSoftware Price Comparison Script (aka Shoppin

23RISK

open ↗

Referência

CVE-2026-94360

CVE-2026-94360MEDIUM

Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks

33RISK

open ↗

Referência

CVE-2010-1091

CVE-2010-1091—

Multiple cross-site scripting (XSS) vulnerabilities in contact.php in phpMySite allow remote attackers to inject arbitra

23RISK

open ↗

Referência

CVE-2010-1872

CVE-2010-1872—

Cross-site scripting (XSS) vulnerability in cPlayer.php in FlashCard 2.6.5 and 3.0.1 allows remote attackers to inject a

23RISK

open ↗

Referência

CVE-2026-94254

CVE-2026-94254MEDIUM

SellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_prices' Parameter

33RISK

open ↗

Referência

CVE-2010-2256

CVE-2010-2256—

Multiple cross-site scripting (XSS) vulnerabilities in Pay Per Minute Video Chat Script 2.0 and 2.1 allow remote attacke

23RISK

open ↗

Referência

CVE-2017-17598

CVE-2017-17598—

Affiliate MLM Script 1.0 has SQL Injection via the product-category.php key parameter.

23RISK

open ↗

Referência✓ VexDay Proof

DD-WRT HTTPd Daemon/Service - Remote Command Execution

CVE-2008-6974—remotehardware

Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp1 and earlier allow remote attack

23RISK

open ↗

Referência

CVE-2009-2569

CVE-2009-2569—

Multiple cross-site scripting (XSS) vulnerabilities in Verlihub Control Panel (VHCP) 1.7e allow remote attackers to inje

23RISK

open ↗

Referência

CVE-2009-4382

CVE-2009-4382—

Cross-site scripting (XSS) vulnerability in module.php in PHPFABER CMS, possibly 1.3.36, allows remote attackers to inje

23RISK

open ↗

Referência

CVE-2009-4813

CVE-2009-4813—

Cross-site scripting (XSS) vulnerability in myps.php in MyBB (aka MyBulletinBoard) 1.4.10 allows remote attackers to inj

23RISK

open ↗

Referência

CVE-2010-0675

CVE-2010-0675—

Cross-site scripting (XSS) vulnerability in index.php in BGSvetionik BGS CMS 2.2.1 allows remote attackers to inject arb

23RISK

open ↗

Referência

CVE-2010-2256

CVE-2010-2256—

Multiple cross-site scripting (XSS) vulnerabilities in Pay Per Minute Video Chat Script 2.0 and 2.1 allow remote attacke

23RISK

open ↗

Referência

CVE-2009-4382

CVE-2009-4382—

Cross-site scripting (XSS) vulnerability in module.php in PHPFABER CMS, possibly 1.3.36, allows remote attackers to inje

23RISK

open ↗

Referência

CVE-2009-4934

CVE-2009-4934—

Cross-site scripting (XSS) vulnerability in index.php in Online Photo Pro 2.0 allows remote attackers to inject arbitrar

23RISK

open ↗

Referência

CVE-2012-1017

CVE-2012-1017—

Multiple SQL injection vulnerabilities in base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allow rem

23RISK

open ↗

Referência

CVE-2025-25037

CVE-2025-25037CRITICAL

Aquatronica Controller System Complete Information Disclosure

63RISK

open ↗

Referência

CVE-2025-25037

CVE-2025-25037CRITICAL

Aquatronica Controller System Complete Information Disclosure

63RISK

open ↗

Referência

CVE-2022-50796

CVE-2022-50796CRITICAL

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgi

48RISK

open ↗

Referência

CVE-2012-10037

CVE-2012-10037CRITICAL

PhpTax pfilez Parameter Exec Remote Code Injection

63RISK

open ↗

Referência

CVE-2012-10037

CVE-2012-10037CRITICAL

PhpTax pfilez Parameter Exec Remote Code Injection

63RISK

open ↗

Referência

CVE-2012-10037

CVE-2012-10037CRITICAL

PhpTax pfilez Parameter Exec Remote Code Injection

63RISK

open ↗

Referência

CVE-2012-3834

CVE-2012-3834—

SQL injection vulnerability in forensics/base_qry_main.php in AlienVault Open Source Security Information Management (OS

23RISK

open ↗

Referência

CVE-2012-6434

CVE-2012-6434—

Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attacke

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.