Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,883cataloged exploits

40,037CVEs with public exploitation

24,696lab-tested

All Referência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecent popular risk

25,887 exploits

Referência✓ VexDay Proof

PHP Blue Dragon CMS 3.0.0 - Remote Code Execution

CVE-2006-4962—webappsphp

Directory traversal vulnerability in pbd_engine.php in Php Blue Dragon 2.9.1 and earlier allows remote attackers to read

23RISK

open ↗

Referência

CVE-2009-3514

CVE-2009-3514—

Multiple SQL injection vulnerabilities in d.net CMS allow remote attackers to execute arbitrary SQL commands via (1) the

23RISK

open ↗

Referência

CVE-2013-4211

CVE-2013-4211—

A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, wh

60RISK

open ↗

Referência

CVE-2020-2230

CVE-2020-2230—

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in

45RISK

open ↗

Referência✓ VexDay Proof

V3 Chat Profiles/Dating Script 3.0.2 - Insecure Cookie Handling

CVE-2008-5784—webappsphp

V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to bypass authentication and gain administrative access b

23RISK

open ↗

Referência

CVE-2026-110655

CVE-2026-110655LOW

miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt

28RISK

open ↗

Referência✓ VexDay Proof

Fuzzylime CMS 3.01 - 'commrss.php' Remote Code Execution

CVE-2008-6833—webappsphp

Directory traversal vulnerability in commsrss.php in fuzzylime (cms) before 3.01b allows remote attackers to include and

23RISK

open ↗

Referência

CVE-2014-2668

CVE-2014-2668—

Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via t

28RISK

open ↗

Referência

CVE-2009-2338

CVE-2009-2338—

Directory traversal vulnerability in includes/startmodules.inc.php in FreeWebshop.org 2.2.9 R2, when register_globals is

23RISK

open ↗

Referência✓ VexDay Proof

Pie Cart Pro - 'Home_Path' Remote File Inclusion

CVE-2006-4970—webappsphp

PHP remote file inclusion vulnerability in enc/content.php in WAHM E-Commerce Pie Cart Pro allows remote attackers to ex

23RISK

open ↗

Referência

CVE-2009-3529

CVE-2009-3529—

SQL injection vulnerability in index.php in RadScripts RadBids Gold 4 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2015-1579

CVE-2015-1579—

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitra

43RISK

open ↗

Referência

CVE-2017-0120

CVE-2017-0120—

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers

28RISK

open ↗

Referência

CVE-2017-14143

CVE-2017-14143—

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, wh

60RISK

open ↗

Referência

CVE-2011-1669

CVE-2011-1669—

Directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote a

43RISK

open ↗

Referência

CVE-2017-14143

CVE-2017-14143—

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, wh

60RISK

open ↗

Referência

CVE-2014-2668

CVE-2014-2668—

Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via t

28RISK

open ↗

Referência

CVE-2016-3715

CVE-2016-3715MEDIUMunder attack

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi

85RISK

open ↗

Referência

CVE-2025-34392

CVE-2025-34392CRITICAL

Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE

53RISK

open ↗

Referência

CVE-2009-4434

CVE-2009-4434—

Directory traversal vulnerability in index.php in IDevSpot iSupport 1.8 and earlier allows remote attackers to read arbi

23RISK

open ↗

Referência

CVE-2021-26929

CVE-2021-26929—

An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library befor

23RISK

open ↗

Referência

CVE-2017-2985

CVE-2017-2985—

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in the ActionScript

28RISK

open ↗

Referência

CVE-2018-0878

CVE-2018-0878LOW

Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Window

33RISK

open ↗

Referência✓ VexDay Proof

gf-3xplorer 2.4 - Cross-Site Scripting / Local File Inclusion

CVE-2007-6476—webappsphp

GF-3XPLORER 2.4 allows remote attackers to obtain configuration information via a direct request to explorer/phpinfo.php

23RISK

open ↗

Referência✓ VexDay Proof

E-topbiz Online Store 1 - 'cat_id' SQL Injection

CVE-2008-5802—webappsphp

SQL injection vulnerability in index.php in E-topbiz Online Store 1.0 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Bitweaver 2.8.1 - Multiple Vulnerabilities

CVE-2012-5193—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 2.8.1 and earlier allow remote attackers to inject arbi

23RISK

open ↗

Referência✓ VexDay Proof

phpQuiz 0.1.2 - SQL Injection / Code Execution

CVE-2006-4978—webappsphp

Multiple SQL injection vulnerabilities in Walter Beschmout PhpQuiz 1.2 and earlier allow remote attackers to execute arb

23RISK

open ↗

Referência

CVE-2009-3543

CVE-2009-3543—

SQL injection vulnerability in _phenotype/admin/login.php in Phenotype CMS before 2.9 allows remote attackers to execute

23RISK

open ↗

Referência

CVE-2016-6272

CVE-2016-6272—

XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing s

28RISK

open ↗

Referência

CVE-2020-24186

CVE-2020-24186CRITICAL

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo

85RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.