Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
26,041 exploits
Referência
CVE-2016-9722
CVE-2016-9722—
IBM QRadar 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be r
43RISK
open ↗
Referência
CVE-2018-10956
CVE-2018-10956—
IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal.
50RISK
open ↗
Referência
CVE-2018-10956
CVE-2018-10956—
IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal.
50RISK
open ↗
Referência
CVE-2019-9053
CVE-2019-9053—
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve
35RISK
open ↗
Referência
CVE-2023-23408
CVE-2023-23408MEDIUM
Azure Apache Ambari Spoofing Vulnerability
33RISK
open ↗
Referência
CVE-2026-92431
CVE-2026-92431LOW
Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration
28RISK
open ↗
Referência
CVE-2011-4878
CVE-2011-4878—
Directory traversal vulnerability in miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2
28RISK
open ↗
Referência✓ VexDay Proof
LoveCMS 1.6.2 Final - Remote Code Execution
CVE-2008-3509—webappsphp
LoveCMS 1.6.2 does not require administrative authentication for (1) addblock.php, (2) blocks.php, and (3) themes.php in
23RISK
open ↗
Referência
CVE-2008-4128
CVE-2008-4128HIGHunder attack
Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the
83RISK
open ↗
Referência
CVE-2009-4749
CVE-2009-4749—
Multiple SQL injection vulnerabilities in PHP Live! 3.2.1 and 3.2.2 allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
Solaris 9 PortBind - XDR-DECODE 'taddr2uaddr()' Remote Denial of Service
CVE-2008-4619—dossolaris
The RPC subsystem in Sun Solaris 9 allows remote attackers to cause a denial of service (daemon crash) via a crafted req
28RISK
open ↗
Referência✓ VexDay Proof
WordPress MU < 1.3.2 - 'active_plugins' Code Execution
CVE-2008-5695—webappsphp
wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests
28RISK
open ↗
Referência
CVE-2010-3894
CVE-2010-3894—
Stack-based buffer overflow in the Java_com_ibm_es_oss_CryptionNative_ESEncrypt function in /opt/IBM/es/lib/libffq.crypt
28RISK
open ↗
Referência✓ VexDay Proof
CF_Calendar - 'calendarevent.cfm' SQL Injection
CVE-2008-6319—webappsasp
SQL injection vulnerability in calendarevent.cfm in CF_Calendar allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
wbblog - Cross-Site Scripting / SQL Injection
CVE-2007-1481—webappsphp
SQL injection vulnerability in index.php in WBBlog allows remote attackers to execute arbitrary SQL commands via the e_i
23RISK
open ↗
Referência✓ VexDay Proof
Hannon Hill Cascade Server - (Authenticated) Command Execution
CVE-2009-1088—webappscgi
Hannon Hill Cascade Server 5.7 and other versions allows remote authenticated users to execute arbitrary programs or Jav
28RISK
open ↗
Referência
CVE-2009-2261
CVE-2009-2261—
PeaZIP 2.6.1, 2.5.1, and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .z
50RISK
open ↗
Referência
CVE-2010-2688
CVE-2010-2688—
SQL injection vulnerability in detail.asp in Site2Nite Boat Classifieds allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2020-28687
CVE-2020-28687—
The edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upl
28RISK
open ↗
Referência
CVE-2026-104246
CVE-2026-104246MEDIUM
Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments
33RISK
open ↗
Referência
CVE-2013-5758
CVE-2013-5758—
cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by
28RISK
open ↗
Referência
CVE-2014-8673
CVE-2014-8673—
Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in
28RISK
open ↗
Referência
CVE-2010-2696
CVE-2010-2696—
SQL injection vulnerability in gallery/index.php in Sijio Community Software allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2015-7039
CVE-2015-7039—
Buffer overflow in libc in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows rem
28RISK
open ↗
Referência
CVE-2010-3595
CVE-2010-3595—
Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 all
28RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Ynews 1.0.0 - 'id' SQL Injection
CVE-2008-0653—webappsphp
SQL injection vulnerability in index.php in the Ynews (com_ynews) 1.0.0 component for Joomla! allows remote attackers to
23RISK
open ↗
Referência
CVE-2017-15118
CVE-2017-15118HIGH
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client
46RISK
open ↗
Referência
CVE-2021-33990
CVE-2021-33990CRITICAL
Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The
53RISK
open ↗
Referência
CVE-2026-91074
CVE-2026-91074MEDIUM
BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute
33RISK
open ↗
Referência✓ VexDay Proof
propertymax pro free - SQL Injection / Cross-Site Scripting
CVE-2009-1951—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in PropertyMax Pro FREE 0.3 allows remote attackers to inject arbi
23RISK
open ↗
← previouspage 160 / 869next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.