Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,139cataloged exploits

40,879CVEs with public exploitation

24,696lab-tested

All Referência 26,555Exploit-DB 24,489GitHub PoC 18,366VulnCheck XDB 10,605Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

26,559 exploits

Referência

CVE-2023-3342

CVE-2023-3342CRITICAL

User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload

48RISK

open ↗

Referência

CVE-2008-6278

CVE-2008-6278—

Multiple cross-site scripting (XSS) vulnerabilities in product.php in RakhiSoftware Price Comparison Script (aka Shoppin

23RISK

open ↗

Referência

CVE-2026-94360

CVE-2026-94360MEDIUM

Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks

33RISK

open ↗

Referência

CVE-2010-1091

CVE-2010-1091—

Multiple cross-site scripting (XSS) vulnerabilities in contact.php in phpMySite allow remote attackers to inject arbitra

23RISK

open ↗

Referência

CVE-2010-1872

CVE-2010-1872—

Cross-site scripting (XSS) vulnerability in cPlayer.php in FlashCard 2.6.5 and 3.0.1 allows remote attackers to inject a

23RISK

open ↗

Referência

CVE-2026-94254

CVE-2026-94254MEDIUM

SellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_prices' Parameter

33RISK

open ↗

Referência

CVE-2010-2256

CVE-2010-2256—

Multiple cross-site scripting (XSS) vulnerabilities in Pay Per Minute Video Chat Script 2.0 and 2.1 allow remote attacke

23RISK

open ↗

Referência

CVE-2017-17598

CVE-2017-17598—

Affiliate MLM Script 1.0 has SQL Injection via the product-category.php key parameter.

23RISK

open ↗

Referência✓ VexDay Proof

DD-WRT HTTPd Daemon/Service - Remote Command Execution

CVE-2008-6974—remotehardware

Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp1 and earlier allow remote attack

23RISK

open ↗

Referência

CVE-2009-2569

CVE-2009-2569—

Multiple cross-site scripting (XSS) vulnerabilities in Verlihub Control Panel (VHCP) 1.7e allow remote attackers to inje

23RISK

open ↗

Referência

CVE-2009-4382

CVE-2009-4382—

Cross-site scripting (XSS) vulnerability in module.php in PHPFABER CMS, possibly 1.3.36, allows remote attackers to inje

23RISK

open ↗

Referência

CVE-2009-4813

CVE-2009-4813—

Cross-site scripting (XSS) vulnerability in myps.php in MyBB (aka MyBulletinBoard) 1.4.10 allows remote attackers to inj

23RISK

open ↗

Referência

CVE-2010-0675

CVE-2010-0675—

Cross-site scripting (XSS) vulnerability in index.php in BGSvetionik BGS CMS 2.2.1 allows remote attackers to inject arb

23RISK

open ↗

Referência

CVE-2010-2256

CVE-2010-2256—

Multiple cross-site scripting (XSS) vulnerabilities in Pay Per Minute Video Chat Script 2.0 and 2.1 allow remote attacke

23RISK

open ↗

Referência

CVE-2009-4382

CVE-2009-4382—

Cross-site scripting (XSS) vulnerability in module.php in PHPFABER CMS, possibly 1.3.36, allows remote attackers to inje

23RISK

open ↗

Referência

CVE-2009-4934

CVE-2009-4934—

Cross-site scripting (XSS) vulnerability in index.php in Online Photo Pro 2.0 allows remote attackers to inject arbitrar

23RISK

open ↗

Referência

CVE-2012-1017

CVE-2012-1017—

Multiple SQL injection vulnerabilities in base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allow rem

23RISK

open ↗

Referência

CVE-2025-25037

CVE-2025-25037CRITICAL

Aquatronica Controller System Complete Information Disclosure

63RISK

open ↗

Referência

CVE-2025-25037

CVE-2025-25037CRITICAL

Aquatronica Controller System Complete Information Disclosure

63RISK

open ↗

Referência

CVE-2022-50796

CVE-2022-50796CRITICAL

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgi

48RISK

open ↗

Referência

CVE-2012-10037

CVE-2012-10037CRITICAL

PhpTax pfilez Parameter Exec Remote Code Injection

63RISK

open ↗

Referência

CVE-2012-10037

CVE-2012-10037CRITICAL

PhpTax pfilez Parameter Exec Remote Code Injection

63RISK

open ↗

Referência

CVE-2012-10037

CVE-2012-10037CRITICAL

PhpTax pfilez Parameter Exec Remote Code Injection

63RISK

open ↗

Referência

CVE-2012-3834

CVE-2012-3834—

SQL injection vulnerability in forensics/base_qry_main.php in AlienVault Open Source Security Information Management (OS

23RISK

open ↗

Referência

CVE-2012-6434

CVE-2012-6434—

Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attacke

23RISK

open ↗

Referência

CVE-2013-6162

CVE-2013-6162—

Cross-site scripting (XSS) vulnerability in Code-Crafters Ability Mail Server 3.1.1 allows remote attackers to inject ar

23RISK

open ↗

Referência

CVE-2017-17617

CVE-2017-17617—

Foodspotting Clone Script 1.0 has SQL Injection via the quicksearch.php q parameter.

23RISK

open ↗

Referência

CVE-2020-14946

CVE-2020-14946—

downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and e

23RISK

open ↗

Referência

CVE-2009-2618

CVE-2009-2618—

SQL injection vulnerability in the Surveys (aka NS-Polls) module in MDPro (MD-Pro) 1.083.x allows remote attackers to ex

23RISK

open ↗

Referência

CVE-2013-10066

CVE-2013-10066CRITICAL

Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File Upload

63RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.