Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,001cataloged exploits

40,084CVEs with public exploitation

24,696lab-tested

All Referência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecent popular risk

25,989 exploits

Referência✓ VexDay Proof

SourceForge 1.0.4 - 'database.php' Remote File Inclusion

CVE-2006-5562—webappsphp

PHP remote file inclusion vulnerability in include/database.php in SourceForge (aka alexandria) 1.0.4 allows remote atta

23RISK

open ↗

Referência

Centos WebPanel 7 - 'term' SQL Injection

CVE-2020-10230—webappslinux

CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/adm

28RISK

open ↗

Referência

CVE-2020-24223

CVE-2020-24223—

Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.

43RISK

open ↗

Referência

CVE-2022-24715

CVE-2022-24715HIGH

Arbitrary code execution for authenticated users in Icinga Web 2

46RISK

open ↗

Referência✓ VexDay Proof

BitchX 1.1 Final - MODE Remote Heap Overflow

CVE-2007-4584—remotelinux

Stack-based buffer overflow in BitchX 1.1 Final allows remote IRC servers to execute arbitrary code via a long string in

28RISK

open ↗

Referência

CVE-2016-6602

CVE-2016-6602—

ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependen

50RISK

open ↗

Referência✓ VexDay Proof

pecio CMS 1.1.5 - 'index.php?language' Local File Inclusion

CVE-2009-1519—webappsphp

Directory traversal vulnerability in index.php in Pecio CMS 1.1.5 allows remote attackers to read arbitrary files via a

23RISK

open ↗

Referência

CVE-2006-3890

CVE-2006-3890—

Stack-based buffer overflow in the Sky Software FileView ActiveX control, as used in WinZip 10 before build 7245 and in

28RISK

open ↗

Referência

CVE-2015-2825

CVE-2015-2825—

Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager plugin before 2.5.96 for WordPres

28RISK

open ↗

Referência

CVE-2018-15141

CVE-2018-15141—

Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authent

28RISK

open ↗

Referência

CVE-2019-3025

CVE-2019-3025—

Vulnerability in the Oracle Hospitality RES 3700 component of Oracle Food and Beverage Applications. The supported versi

28RISK

open ↗

Referência

CVE-2020-35848

CVE-2020-35848—

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.

60RISK

open ↗

Referência✓ VexDay Proof

mp3SDS 3.0 - '/Core/core.inc.php' Remote File Inclusion

CVE-2006-5613—webappsphp

PHP remote file inclusion in Core/core.inc.php in MP3 Streaming DownSampler (mp3SDS) 3.0, when register_globals is enabl

23RISK

open ↗

Referência✓ VexDay Proof

Mooseguy Blog System 1.0 - 'month' SQL Injection

CVE-2008-0424—webappsphp

SQL injection vulnerability in blog.php in Mooseguy Blog System (MGBS) 1.0 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2026-15034

CVE-2026-15034MEDIUM

flask-dashboard Flask-MonitoringDashboard cross-site request forgery

33RISK

open ↗

Referência

CVE-2015-7246

CVE-2015-7246—

D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root accou

28RISK

open ↗

Referência

CVE-2013-3893

CVE-2013-3893HIGHunder attack

Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 throug

100RISK

open ↗

Referência✓ VexDay Proof

ABC Advertise 1.0 - Admin Password Disclosure

CVE-2009-1550—webappsphp

Zakkis Technology ABC Advertise 1.0 does not properly restrict access to admin.inc.php, which allows remote attackers to

23RISK

open ↗

Referência

CVE-2023-36812

CVE-2023-36812CRITICAL

Remote Code Execution in OpenTSDB

68RISK

open ↗

Referência

CVE-2018-9958

CVE-2018-9958—

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1

50RISK

open ↗

Referência

CVE-2020-5377

CVE-2020-5377CRITICAL

Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities.

60RISK

open ↗

Referência

EasyNas 1.1.0 - OS Command Injection

CVE-2023-0830MEDIUMremotehardware

EasyNAS backup.pl system os command injection

38RISK

open ↗

Referência

CVE-2026-19857

CVE-2026-19857MEDIUM

Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token

33RISK

open ↗

Referência

CVE-2011-0917

CVE-2011-0917—

Buffer overflow in nLDAP.exe in IBM Lotus Domino allows remote attackers to execute arbitrary code via a long string in

28RISK

open ↗

Referência

CVE-2013-3928

CVE-2013-3928—

Stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before 4.11.02 allows remote atta

50RISK

open ↗

Referência

CVE-2026-14797

CVE-2026-14797MEDIUM

CodeAstro Apartment Visitor Management System edit-apartment.php sql injection

33RISK

open ↗

Referência

CVE-2014-4158

CVE-2014-4158—

Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a GET req

28RISK

open ↗

Referência

CVE-2018-9958

CVE-2018-9958—

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1

50RISK

open ↗

Referência

CVE-2015-7944

CVE-2015-7944—

The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11

28RISK

open ↗

Referência✓ VexDay Proof

Alstrasoft Forum Pay Per Post Exchange 2.0 - SQL Injection

CVE-2008-0429—webappsphp

SQL injection vulnerability in index.php in AlstraSoft Forum Pay Per Post Exchange 2.0 allows remote attackers to execut

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.