Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,001cataloged exploits

40,084CVEs with public exploitation

24,696lab-tested

All Referência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecent popular risk

25,989 exploits

Referência✓ VexDay Proof

IndexScript 3.0 - 'parent_id' SQL Injection

CVE-2008-6179—webappsphp

SQL injection vulnerability in sug_cat.php in IndexScript 3.0 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2009-3663

CVE-2009-3663—

Format string vulnerability in the h_readrequest function in http.c in httpdx Web Server 1.4 allows remote attackers to

28RISK

open ↗

Referência✓ VexDay Proof

Adobe 8.1.4/9.1 - 'customDictionaryOpen()' Code Execution

CVE-2009-1493—remotelinux

The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and

28RISK

open ↗

Referência

CVE-2010-5300

CVE-2010-5300—

Stack-based buffer overflow in Jzip 1.3 through 2.0.0.132900 allows remote attackers to cause a denial of service (crash

28RISK

open ↗

Referência

CVE-2009-4680

CVE-2009-4680—

SQL injection vulnerability in search.php in phpDirectorySource 1.x allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência

CVE-2010-1306

CVE-2010-1306—

Directory traversal vulnerability in the Picasa (com_joomlapicasa2) component 2.0 and 2.0.5 for Joomla! allows remote at

43RISK

open ↗

Referência

CVE-2010-1057

CVE-2010-1057—

Multiple directory traversal vulnerabilities in Phpkobo AdFreely (aka Ad Board Script) 1.01, when magic_quotes_gpc is di

23RISK

open ↗

Referência

CVE-2013-5220

CVE-2013-5220—

goform/login on the HOT HOTBOX router with software 2.1.11 allows remote attackers to cause a denial of service (device

23RISK

open ↗

Referência

CVE-2014-7186

CVE-2014-7186—

The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial o

35RISK

open ↗

Referência✓ VexDay Proof

SourceForge 1.0.4 - 'database.php' Remote File Inclusion

CVE-2006-5562—webappsphp

PHP remote file inclusion vulnerability in include/database.php in SourceForge (aka alexandria) 1.0.4 allows remote atta

23RISK

open ↗

Referência

Centos WebPanel 7 - 'term' SQL Injection

CVE-2020-10230—webappslinux

CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/adm

28RISK

open ↗

Referência

CVE-2020-24223

CVE-2020-24223—

Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.

43RISK

open ↗

Referência

CVE-2022-24715

CVE-2022-24715HIGH

Arbitrary code execution for authenticated users in Icinga Web 2

46RISK

open ↗

Referência✓ VexDay Proof

BitchX 1.1 Final - MODE Remote Heap Overflow

CVE-2007-4584—remotelinux

Stack-based buffer overflow in BitchX 1.1 Final allows remote IRC servers to execute arbitrary code via a long string in

28RISK

open ↗

Referência

CVE-2016-6602

CVE-2016-6602—

ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependen

50RISK

open ↗

Referência✓ VexDay Proof

pecio CMS 1.1.5 - 'index.php?language' Local File Inclusion

CVE-2009-1519—webappsphp

Directory traversal vulnerability in index.php in Pecio CMS 1.1.5 allows remote attackers to read arbitrary files via a

23RISK

open ↗

Referência

CVE-2006-3890

CVE-2006-3890—

Stack-based buffer overflow in the Sky Software FileView ActiveX control, as used in WinZip 10 before build 7245 and in

28RISK

open ↗

Referência

CVE-2015-2825

CVE-2015-2825—

Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager plugin before 2.5.96 for WordPres

28RISK

open ↗

Referência

CVE-2018-15141

CVE-2018-15141—

Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authent

28RISK

open ↗

Referência

CVE-2019-3025

CVE-2019-3025—

Vulnerability in the Oracle Hospitality RES 3700 component of Oracle Food and Beverage Applications. The supported versi

28RISK

open ↗

Referência

CVE-2020-35848

CVE-2020-35848—

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.

60RISK

open ↗

Referência✓ VexDay Proof

mp3SDS 3.0 - '/Core/core.inc.php' Remote File Inclusion

CVE-2006-5613—webappsphp

PHP remote file inclusion in Core/core.inc.php in MP3 Streaming DownSampler (mp3SDS) 3.0, when register_globals is enabl

23RISK

open ↗

Referência✓ VexDay Proof

Mooseguy Blog System 1.0 - 'month' SQL Injection

CVE-2008-0424—webappsphp

SQL injection vulnerability in blog.php in Mooseguy Blog System (MGBS) 1.0 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2026-15034

CVE-2026-15034MEDIUM

flask-dashboard Flask-MonitoringDashboard cross-site request forgery

33RISK

open ↗

Referência

CVE-2015-7246

CVE-2015-7246—

D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root accou

28RISK

open ↗

Referência

CVE-2013-3893

CVE-2013-3893HIGHunder attack

Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 throug

100RISK

open ↗

Referência✓ VexDay Proof

ABC Advertise 1.0 - Admin Password Disclosure

CVE-2009-1550—webappsphp

Zakkis Technology ABC Advertise 1.0 does not properly restrict access to admin.inc.php, which allows remote attackers to

23RISK

open ↗

Referência

CVE-2023-36812

CVE-2023-36812CRITICAL

Remote Code Execution in OpenTSDB

68RISK

open ↗

Referência

CVE-2018-9958

CVE-2018-9958—

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1

50RISK

open ↗

Referência

CVE-2020-5377

CVE-2020-5377CRITICAL

Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities.

60RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.