Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
25,846 exploits
Referência
CVE-2014-8499
CVE-2014-8499—
Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Servi
50RISK
open ↗
Referência
CVE-2017-16885
CVE-2017-16885—
Improper Permissions Handling in the Portal on FiberHome LM53Q1 VH519R05C01S38 devices (intended for obtaining informati
35RISK
open ↗
Referência
CVE-2017-5375
CVE-2017-5375—
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. T
35RISK
open ↗
Referência✓ VexDay Proof
N/X WCMS 4.1 - 'nxheader.inc.php' Remote File Inclusion
CVE-2006-5625—webappsphp
PHP remote file inclusion vulnerability in wwwdev/nxheader.inc.php in N/X 2002 Professional Edition Web Content Manageme
23RISK
open ↗
Referência✓ VexDay Proof
Cyberfolio 7.12.2 - 'theme' Local File Inclusion
CVE-2008-6265—webappsphp
Directory traversal vulnerability in portfolio/css.php in Cyberfolio 7.12.2 and earlier allows remote attackers to inclu
23RISK
open ↗
Referência
CVE-2009-4461
CVE-2009-4461—
Multiple cross-site scripting (XSS) vulnerabilities in FlatPress 0.909 allow remote attackers to inject arbitrary web sc
23RISK
open ↗
Referência
CVE-2026-92923
CVE-2026-92923MEDIUM
Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_data
33RISK
open ↗
Referência
CVE-2026-92437
CVE-2026-92437MEDIUM
Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion
33RISK
open ↗
Referência
CVE-2012-1784
CVE-2012-1784—
SQL injection vulnerability in MyJobList 0.1.3 allows remote attackers to execute arbitrary SQL commands via the eid par
23RISK
open ↗
Referência
CVE-2026-91078
CVE-2026-91078HIGH
TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN
41RISK
open ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RISK
open ↗
Referência
CVE-2015-3124
CVE-2015-3124—
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows
35RISK
open ↗
Referência
CVE-2016-0801
CVE-2016-0801—
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
35RISK
open ↗
Referência✓ VexDay Proof
WEBBDOMAIN WebShop 1.02 - SQL Injection / Cross-Site Scripting
CVE-2008-6268—webappsphp
SQL injection vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote attackers to e
23RISK
open ↗
Referência✓ VexDay Proof
Techno Dreams Guestbook 1.0 - 'key' SQL Injection
CVE-2006-5640—webappsasp
SQL injection vulnerability in guestbookview.asp in Techno Dreams Guest Book 1.0 earlier allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2017-5375
CVE-2017-5375—
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. T
35RISK
open ↗
Referência
CVE-2019-15813
CVE-2019-15813—
Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arb
35RISK
open ↗
Referência
CVE-2020-14871
CVE-2020-14871CRITICALunder attack
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported ve
100RISK
open ↗
Referência
CVE-2020-14871
CVE-2020-14871CRITICALunder attack
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported ve
100RISK
open ↗
Referência
CVE-2026-90509
CVE-2026-90509MEDIUM
dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials
33RISK
open ↗
Referência
CVE-2020-8195
CVE-2020-8195MEDIUMunder attack
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.1
75RISK
open ↗
Referência✓ VexDay Proof
RevSense 1.0 - Authentication Bypass
CVE-2008-6310—webappsphp
SQL injection vulnerability in index.php in W3matter RevSense 1.0 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência
CVE-2026-12907
CVE-2026-12907LOW
RTMKit Addons for Elementor < 2.0.9 - Author+ Site-Wide Theme Builder Template Creation and Activation
28RISK
open ↗
Referência
CVE-2026-100304
CVE-2026-100304MEDIUM
TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check
33RISK
open ↗
Referência✓ VexDay Proof
CFMBLOG - 'categorynbr' Blind SQL Injection
CVE-2008-6322—webappsasp
SQL injection vulnerability in index.cfm in CFMSource CFMBlog allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2026-90502
CVE-2026-90502MEDIUM
stilleshan ServerStatus Stats Generation main.cpp cross site scripting
33RISK
open ↗
Referência✓ VexDay Proof
Techno Dreams Announcement - 'key' SQL Injection
CVE-2006-5641—webappsasp
SQL injection vulnerability in MainAnnounce2.asp in Techno Dreams Announcement allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component SOBI2 RC 2.8.2 - SQL Injection
CVE-2009-0380—webappsphp
SQL injection vulnerability in the Sigsiu Online Business Index 2 (SOBI2, com_sobi2) RC 2.8.2 component for Joomla! and
23RISK
open ↗
Referência
CVE-2013-1306
CVE-2013-1306—
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a cr
35RISK
open ↗
Referência
CVE-2016-4227
CVE-2016-4227—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RISK
open ↗
← previouspage 101 / 862next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.