Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,150cataloged exploits
39,601CVEs with public exploitation
24,695lab-tested
AllReferência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecentpopularrisk
25,557 exploits
Referência✓ VexDay Proof
HP Data Protector 4.00-SP1b43064 - Remote Memory Leak/Denial of Service (Metasploit)
CVE-2009-0714—doswindows
Unspecified vulnerability in the dpwinsup module (dpwinsup.dll) for dpwingad (dpwingad.exe) in HP Data Protector Express
35RISK
open ↗
Referência✓ VexDay Proof
Potato News 1.0.0 - Local File Inclusion
CVE-2009-0722—webappsphp
Directory traversal vulnerability in admin.php in Potato News 1.0.0 allows remote attackers to include and execute arbit
23RISK
open ↗
Referência
CVE-2019-16172
CVE-2019-16172—
LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, Su
23RISK
open ↗
Referência✓ VexDay Proof
Free Arcade Script 1.0 - Local File Inclusion Command Execution
CVE-2009-0731—webappsphp
Directory traversal vulnerability in pages/play.php in Free Arcade Script 1.0 allows remote attackers to include and exe
23RISK
open ↗
Referência
CVE-2017-5753
CVE-2017-5753MEDIUM
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of
55RISK
open ↗
Referência✓ VexDay Proof
b1gbb 2.24.0 - SQL Injection / Cross-Site Scripting
CVE-2007-3589—webappsphp
Multiple SQL injection vulnerabilities in b1gbb 2.24.0 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência✓ VexDay Proof
AIOCP 1.4 - 'poll_id' SQL Injection
CVE-2008-4782—webappsphp
SQL injection vulnerability in public/code/cp_polls_results.php in All In One Control Panel (AIOCP) 1.4 allows remote at
23RISK
open ↗
Referência
CVE-2010-2513
CVE-2010-2513—
SQL injection vulnerability in the JE Ajax Event Calendar (com_jeajaxeventcalendar) component 1.0.5 for Joomla! allows r
23RISK
open ↗
Referência✓ VexDay Proof
Papoo CMS 3.x - 'pfadhier' Local File Inclusion
CVE-2009-0735—webappsphp
Directory traversal vulnerability in lib/classes/message_class.php in Papoo CMS 3.6, when register_globals is enabled an
23RISK
open ↗
Referência✓ VexDay Proof
Kipper 2.01 - Cross-Site Scripting / Local File Inclusion / File Disclosure
CVE-2009-0763—webappsphp
Cross-site scripting (XSS) vulnerability in default.php in Kipper 2.01 allows remote attackers to inject arbitrary web s
23RISK
open ↗
Referência
CVE-2023-36845
CVE-2023-36845CRITICALunder attack
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
100RISK
open ↗
Referência
CVE-2023-36845
CVE-2023-36845CRITICALunder attack
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
100RISK
open ↗
Referência
CVE-2021-44077
CVE-2021-44077CRITICALunder attack
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014
100RISK
open ↗
Referência
CVE-2011-5177
CVE-2011-5177—
Multiple cross-site scripting (XSS) vulnerabilities in admin/controller.php in eSyndiCat Pro 2.3.05 allow remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
EnjoySAP ActiveX kweditcontrol.kwedit.1 - Remote Stack Overflow (PoC)
CVE-2007-3608—doswindows
Multiple unspecified vulnerabilities in ActiveX controls in the EnjoySAP SAP GUI allow remote attackers to create certai
23RISK
open ↗
Referência
CVE-2008-4844
CVE-2008-4844—
Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet
50RISK
open ↗
Referência
CVE-2008-6396
CVE-2008-6396—
Cross-site scripting (XSS) vulnerability in account.php in Celerondude Uploader 6.1 allows remote attackers to inject ar
23RISK
open ↗
Referência✓ VexDay Proof
celerbb 0.0.2 - Multiple Vulnerabilities
CVE-2009-0852—webappsphp
showme.php in CelerBB 0.0.2 allows remote attackers to obtain "reserved information" via the user parameter.
23RISK
open ↗
Referência✓ VexDay Proof
OneOrZero Helpdesk 1.6.5.7 - Local File Inclusion
CVE-2009-0886—webappsphp
Directory traversal vulnerability in login.php in OneOrZero Helpdesk 1.6.5.7 and earlier allows remote attackers to read
23RISK
open ↗
Referência✓ VexDay Proof
WordPress MU < 2.7 - 'HOST' HTTP Header Cross-Site Scripting
CVE-2009-1030—webappsphp
Cross-site scripting (XSS) vulnerability in the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPr
23RISK
open ↗
Referência✓ VexDay Proof
Pixie CMS - Cross-Site Scripting / SQL Injection
CVE-2009-1067—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Pixie CMS 1.01a allows remote attackers to inject arbitrary web
23RISK
open ↗
Referência✓ VexDay Proof
Icarus 2.0 - '.pgn' Local Stack Overflow (SEH)
CVE-2009-1071—localwindows
Stack-based buffer overflow in Icarus 2.0 allows remote attackers to cause a denial of service (application crash) or ex
23RISK
open ↗
Referência✓ VexDay Proof
Moodle < 1.6.9/1.7.7/1.8.9/1.9.5 - File Disclosure
CVE-2009-1171—webappsphp
The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allows user-assist
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft DirectX SAMI File Parsing - Remote Stack Overflow
CVE-2007-3901—remotewindows
Stack-based buffer overflow in the DirectShow Synchronized Accessible Media Interchange (SAMI) parser in quartz.dll for
50RISK
open ↗
Referência
CVE-2026-7219
CVE-2026-7219HIGH
Totolink N300RT formIpQoS buffer overflow
41RISK
open ↗
Referência✓ VexDay Proof
Opera 9.64 - 7400 nested elements XML Parsing Remote Crash
CVE-2009-1234—dosmultiple
Opera 9.64 allows remote attackers to cause a denial of service (application crash) via an XML document containing a lon
23RISK
open ↗
Referência✓ VexDay Proof
Sepal SPBOARD 4.5 - 'board.cgi' Remote Command Execution
CVE-2008-4873—webappscgi
board.cgi in Sepal SPBOARD 4.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the fil
23RISK
open ↗
Referência✓ VexDay Proof
LinkedIn Toolbar 3.0.2.1098 - Remote Buffer Overflow
CVE-2007-3955—remotewindows
Buffer overflow in the IEToolbar.IEContextMenu.1 ActiveX control in LinkedInIEToolbar.dll in the LinkedIn Toolbar 3.0.2.
23RISK
open ↗
Referência✓ VexDay Proof
Apple Mac OSX xnu 1228.3.13 - 'Profil' Kernel Memory Leak/Denial of Service (PoC)
CVE-2009-1237—dososx
Multiple memory leaks in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allow local users to cause a den
23RISK
open ↗
Referência✓ VexDay Proof
Data Dynamics ActiveBar - ActiveX 'actbar3.ocx 3.1' Insecure Methods
CVE-2007-3883—remotewindows
The Data Dynamics ActiveBar ActiveX control (actbar3.ocx) 3.2 and earlier allows remote attackers to create or overwrite
23RISK
open ↗
← previouspage 16 / 852next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.