Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,001cataloged exploits

40,084CVEs with public exploitation

24,696lab-tested

All Referência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecent popular risk

25,989 exploits

Referência✓ VexDay Proof

blogit! - SQL Injection / File Disclosure / Cross-Site Scripting

CVE-2009-0334—webappsphp

SQL injection vulnerability in index.asp in Katy Whitton BlogIt! allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência

CVE-2017-1000375

CVE-2017-1000375—

NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attacke

28RISK

open ↗

Referência

CVE-2018-17408

CVE-2018-17408—

Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute a

43RISK

open ↗

Referência

CVE-2020-24215

CVE-2020-24215—

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use har

28RISK

open ↗

Referência✓ VexDay Proof

newsReporter 1.1 - 'index.php' Remote File Inclusion

CVE-2006-3988—webappsphp

PHP remote file inclusion vulnerability in index.php in Knusperleicht newsReporter 1.1 and earlier allows remote attacke

23RISK

open ↗

Referência

CVE-2009-2433

CVE-2009-2433—

Stack-based buffer overflow in the AddFavorite method in Microsoft Internet Explorer allows remote attackers to cause a

28RISK

open ↗

Referência✓ VexDay Proof

Uploader & Downloader 3.0 - 'id_user' SQL Injection

CVE-2006-6716—webappsphp

SQL injection vulnerability in administration/administre2.php in Eric GUILLAUME uploader&downloader 3 allows remote atta

23RISK

open ↗

Referência

CVE-2009-4351

CVE-2009-4351—

SQL injection vulnerability in ADMIN/loginaction.php in WSCreator 1.1, when magic_quotes_gpc is disabled, allows remote

23RISK

open ↗

Referência

CVE-2010-4409

CVE-2010-4409—

Integer overflow in the NumberFormatter::getSymbol (aka numfmt_get_symbol) function in PHP 5.3.3 and earlier allows cont

28RISK

open ↗

Referência

CVE-2016-6855

CVE-2016-6855—

Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib befor

28RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component ElearningForce Flash Magazine Deluxe - SQL Injection

CVE-2009-0373—webappsphp

SQL injection vulnerability in the ElearningForce Flash Magazine Deluxe (com_flashmagazinedeluxe) component for Joomla!

23RISK

open ↗

Referência

CVE-2024-9458

CVE-2024-9458MEDIUM

Reservit Hotel < 3.0 - Admin+ Stored XSS

33RISK

open ↗

Referência

CVE-2010-4597

CVE-2010-4597—

Stack-based buffer overflow in the save method in the IntegraXor.Project ActiveX control in igcomm.dll in Ecava IntegraX

28RISK

open ↗

Referência

CVE-2009-3825

CVE-2009-3825—

Multiple directory traversal vulnerabilities in GenCMS 2006 allow remote attackers to include and execute arbitrary loca

23RISK

open ↗

Referência

CVE-2020-29597

CVE-2020-29597—

IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. This vulnerability allows un

60RISK

open ↗

Referência

CVE-2026-108943

CVE-2026-108943MEDIUM

ModelTC LightX2V Tokenizer cosmos3_runner.py AutoTokenizer.from_pretrained code injection

33RISK

open ↗

Referência

CVE-2010-1714

CVE-2010-1714—

Directory traversal vulnerability in the Arcade Games (com_arcadegames) component 1.0 for Joomla! allows remote attacker

43RISK

open ↗

Referência

CVE-2026-15216

CVE-2026-15216HIGH

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

41RISK

open ↗

Referência

CVE-2026-19217

CVE-2026-19217MEDIUM

Royal Elementor Addons < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget

33RISK

open ↗

Referência

CVE-2026-19924

CVE-2026-19924CRITICAL

Tenda AC10 httpd R7WebsSecurityHandler improper authentication

48RISK

open ↗

Referência

CVE-2013-0177

CVE-2013-0177—

Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business

28RISK

open ↗

Referência

CVE-2015-2153

CVE-2015-2153—

The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers t

28RISK

open ↗

Referência

CVE-2016-6855

CVE-2016-6855—

Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib befor

28RISK

open ↗

Referência

AROX School-ERP Pro - Unauthenticated Remote Command Execution (Metasploit)

CVE-2019-13294—remotephp

AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session cont

28RISK

open ↗

Referência

CVE-2026-16494

CVE-2026-16494HIGH

Missing Authorization in GitLab

41RISK

open ↗

Referência✓ VexDay Proof

Invision Gallery 2.0.7 - 'readfile()' / SQL Injection

CVE-2006-5206—webappsphp

SQL injection vulnerability in Invision Gallery 2.0.7 allows remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência

CVE-2016-7241

CVE-2016-7241—

Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of

45RISK

open ↗

Referência

CVE-2010-2259

CVE-2010-2259—

Directory traversal vulnerability in the BF Survey (com_bfsurvey) component for Joomla! allows remote attackers to inclu

43RISK

open ↗

Referência

CVE-2018-19877

CVE-2018-19877—

43RISK

open ↗

Referência

CVE-2013-2227

CVE-2013-2227—

GLPI 0.83.7 has Local File Inclusion in common.tabs.php.

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.