Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,876cataloged exploits
40,033CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,446VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
25,846 exploits
Referência
CVE-2014-8499
CVE-2014-8499—
Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Servi
50RISK
open ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RISK
open ↗
Referência✓ VexDay Proof
Techno Dreams Guestbook 1.0 - 'key' SQL Injection
CVE-2006-5640—webappsasp
SQL injection vulnerability in guestbookview.asp in Techno Dreams Guest Book 1.0 earlier allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2015-3124
CVE-2015-3124—
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows
35RISK
open ↗
Referência
CVE-2016-0801
CVE-2016-0801—
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
35RISK
open ↗
Referência✓ VexDay Proof
WEBBDOMAIN WebShop 1.02 - SQL Injection / Cross-Site Scripting
CVE-2008-6268—webappsphp
SQL injection vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote attackers to e
23RISK
open ↗
Referência
CVE-2017-5375
CVE-2017-5375—
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. T
35RISK
open ↗
Referência
CVE-2019-15813
CVE-2019-15813—
Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arb
35RISK
open ↗
Referência
CVE-2020-14871
CVE-2020-14871CRITICALunder attack
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported ve
100RISK
open ↗
Referência
CVE-2020-8195
CVE-2020-8195MEDIUMunder attack
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.1
75RISK
open ↗
Referência✓ VexDay Proof
RevSense 1.0 - Authentication Bypass
CVE-2008-6310—webappsphp
SQL injection vulnerability in index.php in W3matter RevSense 1.0 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência
CVE-2026-100304
CVE-2026-100304MEDIUM
TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check
33RISK
open ↗
Referência
CVE-2026-12907
CVE-2026-12907LOW
RTMKit Addons for Elementor < 2.0.9 - Author+ Site-Wide Theme Builder Template Creation and Activation
28RISK
open ↗
Referência
CVE-2026-90509
CVE-2026-90509MEDIUM
dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials
33RISK
open ↗
Referência✓ VexDay Proof
CFMBLOG - 'categorynbr' Blind SQL Injection
CVE-2008-6322—webappsasp
SQL injection vulnerability in index.cfm in CFMSource CFMBlog allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component SOBI2 RC 2.8.2 - SQL Injection
CVE-2009-0380—webappsphp
SQL injection vulnerability in the Sigsiu Online Business Index 2 (SOBI2, com_sobi2) RC 2.8.2 component for Joomla! and
23RISK
open ↗
Referência✓ VexDay Proof
EgyPlus 7ml 1.0.1 - Authentication Bypass
CVE-2009-2167—webappsphp
Multiple SQL injection vulnerabilities in cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier, when magic_quo
23RISK
open ↗
Referência
CVE-2013-1306
CVE-2013-1306—
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a cr
35RISK
open ↗
Referência
CVE-2020-14871
CVE-2020-14871CRITICALunder attack
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported ve
100RISK
open ↗
Referência✓ VexDay Proof
Techno Dreams Announcement - 'key' SQL Injection
CVE-2006-5641—webappsasp
SQL injection vulnerability in MainAnnounce2.asp in Techno Dreams Announcement allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2017-6187
CVE-2017-6187—
Buffer overflow in the built-in web server in DiskSavvy Enterprise 9.4.18 allows remote attackers to execute arbitrary c
50RISK
open ↗
Referência
CVE-2018-19458
CVE-2018-19458—
In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI UR
50RISK
open ↗
Referência
CVE-2026-92366
CVE-2026-92366MEDIUM
code-projects Matrimonial System Regular Search search.php sql injection
33RISK
open ↗
Referência
CVE-2009-2276
CVE-2009-2276—
SQL injection vulnerability in voteforus.php in the Vote For Us extension 1.0.1 and earlier for PunBB allows remote atta
23RISK
open ↗
Referência
CVE-2015-3337
CVE-2015-3337—
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
50RISK
open ↗
Referência
CVE-2015-8048
CVE-2015-8048—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and
35RISK
open ↗
Referência
CVE-2016-4227
CVE-2016-4227—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RISK
open ↗
Referência
CVE-2018-14716
CVE-2018-14716—
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because reques
35RISK
open ↗
Referência
CVE-2010-4321
CVE-2010-4321—
Stack-based buffer overflow in an ActiveX control in ienipp.ocx in Novell iPrint Client 5.52 allows remote attackers to
50RISK
open ↗
Referência
CVE-2022-40684
CVE-2022-40684CRITICALunder attackransomware
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
100RISK
open ↗
← previouspage 106 / 862next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.