Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,883cataloged exploits
40,037CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
25,846 exploits
Referência✓ VexDay Proof
campus virtual-lms - Cross-Site Scripting / SQL Injection
SQL injection vulnerability in news/index.php in Campus Virtual-LMS allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
DM Guestbook 0.4.1 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in DM Guestbook 0.4.1 and earlier allow remote attackers to include and exe
23RISK
open ↗Referência
CVE-2009-4574
SQL injection vulnerability in country_escorts.php in I-Escorts Directory Script allows remote attackers to execute arbi
23RISK
open ↗Referência
CVE-2009-2441
Cross-site scripting (XSS) vulnerability in ogp_show.php in Online Guestbook Pro 5.1 allows remote attackers to inject a
23RISK
open ↗Referência
CVE-2009-4962
Stack-based buffer overflow in Fat Player 0.6b allows remote attackers to execute arbitrary code via a long string in a
50RISK
open ↗Referência
CVE-2009-4588
Heap-based buffer overflow in the WindsPlayerIE.View.1 ActiveX control in WindsPly.ocx 3.5.0.0 Beta, 3.0.0.5, and earlie
50RISK
open ↗Referência
CVE-2014-1683
The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248
50RISK
open ↗Referência
CVE-2014-2268
views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which all
50RISK
open ↗Referência
CVE-2015-2460
ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,
35RISK
open ↗Referência
CVE-2015-7855
The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause
35RISK
open ↗Referência
CVE-2017-15663
In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability. The att
28RISK
open ↗Referência
CVE-2017-15663
In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability. The att
28RISK
open ↗Referência✓ VexDay Proof
Cold BBS - Remote Database Disclosure
Cold BBS stores sensitive information under the web root with insufficient access control, which allows remote attackers
23RISK
open ↗Referência
CVE-2010-1465
Stack-based buffer overflow in Trellian FTP client 3.01, including 3.1.3.1789, allows remote attackers to execute arbitr
50RISK
open ↗Referência
CVE-2021-24146
Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export
50RISK
open ↗Referência
CVE-2010-5081
Stack-based buffer overflow in Mini-Stream RM-MP3 Converter 3.1.2.1 allows remote attackers to execute arbitrary code vi
50RISK
open ↗Referência✓ VexDay Proof
OpenRat 0.8-beta4 - 'tpl_dir' Remote File Inclusion
PHP remote file inclusion vulnerability in themes/default/include/html/insert.inc.php in OpenRat 0.8-beta4 and earlier a
23RISK
open ↗Referência
CVE-2010-5081
Stack-based buffer overflow in Mini-Stream RM-MP3 Converter 3.1.2.1 allows remote attackers to execute arbitrary code vi
50RISK
open ↗Referência
CVE-2026-58457
Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp
48RISK
open ↗Referência
CVE-2009-2451
Multiple SQL injection vulnerabilities in index.php in MIM:InfiniX 1.2.003 and possibly earlier versions allow remote at
23RISK
open ↗Referência✓ VexDay Proof
PHP Classifieds 7.1 - 'detail.php' SQL Injection
SQL injection vulnerability in detail.php in DeltaScripts PHP Classifieds 7.1 and earlier allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component com_colorlab 1.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.color.php in the com_colorlab (aka com_color) 1.0 component for Joomla!
35RISK
open ↗Referência
SugarCRM Enterprise 9.0.0 - Cross-Site Scripting
SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.
43RISK
open ↗Referência✓ VexDay Proof
Social Site Generator 2.0 - Multiple Remote File Disclosure Vulnerabilities
Social Site Generator (SSG) 2.0 allows remote attackers to read arbitrary files via the file parameter to (1) filedload.
23RISK
open ↗Referência
CVE-2018-17254
The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.
60RISK
open ↗Referência
CVE-2026-101162
WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings
33RISK
open ↗Referência
CVE-2017-2986
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the Flash Video (F
35RISK
open ↗Referência
CVE-2009-2566
Stack-based buffer overflow in TFM MMPlayer 2.0, and possibly 2.0.0.30, allows remote attackers to execute arbitrary cod
50RISK
open ↗Referência
CVE-2016-0974
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and
35RISK
open ↗Referência
CVE-2026-101161
WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.