Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
26,041 exploits
Referência
CVE-2020-11699
An issue was discovered in Titan SpamTitan 7.07. Improper validation of the parameter fname on the page certs-x.php woul
23RISK
open ↗Referência
CVE-2026-107789
SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR
33RISK
open ↗Referência
CVE-2026-107788
SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion
33RISK
open ↗Referência
CVE-2026-107506
Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting
41RISK
open ↗Referência✓ VexDay Proof
Neostrada Livebox Router - Remote Network Down (PoC)
The Neostrada Livebox ADSL Router allows remote attackers to cause a denial of service (network outage) via multiple HTT
23RISK
open ↗Referência✓ VexDay Proof
Google Chrome 0.2.149.27 - A HREF Denial of Service
Stack-based buffer overflow in chrome/common/gfx/url_elider.cc in Google Chrome 0.2.149.27 and other versions before 0.2
23RISK
open ↗Referência✓ VexDay Proof
Java SE Runtime Environment JRE 6 Update 13 - Multiple Vulnerabilities
The Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 1
23RISK
open ↗Referência
CVE-2009-4983
Multiple cross-site scripting (XSS) vulnerabilities in Silurus Classifieds 1.0 allow remote attackers to inject arbitrar
23RISK
open ↗Referência
CVE-2010-1349
Integer overflow in Opera 10.10 through 10.50 allows remote attackers to execute arbitrary code via a large Content-Leng
28RISK
open ↗Referência✓ VexDay Proof
GNUEDU 1.3b2 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in gnuedu 1.3b2 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗Referência
CVE-2013-2576
Buffer overflow in Artweaver before 3.1.6 allows remote attackers to cause a denial of service (crash) and possibly exec
23RISK
open ↗Referência
CVE-2016-10043
An issue was discovered in Radisys MRF Web Panel (SWMS) 9.0.1. The MSM_MACRO_NAME POST parameter in /swms/ms.cgi was dis
23RISK
open ↗Referência
CVE-2018-10063
The Convert Forms extension before 2.0.4 for Joomla! is vulnerable to Remote Command Execution using CSV Injection that
23RISK
open ↗Referência
CVE-2020-14461
Zyxel Armor X1 WAP6806 1.00(ABAL.6)C0 devices allow Directory Traversal via the images/eaZy/ URI.
23RISK
open ↗Referência
CVE-2017-17876
Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a u
23RISK
open ↗Referência
CVE-2009-4985
SQL injection vulnerability in browse.php in Accessories Me PHP Affiliate Script 1.4 allows remote attackers to execute
23RISK
open ↗Referência
CVE-2026-105996
Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token
33RISK
open ↗Referência
CVE-2022-26521
Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable
23RISK
open ↗Referência
CVE-2012-1010
Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote
23RISK
open ↗Referência
CVE-2026-105992
Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass
33RISK
open ↗Referência
CVE-2020-9467
Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
28RISK
open ↗Referência✓ VexDay Proof
Simple PHP Blog 0.4.7.1 - Remote Command Execution
Directory traversal vulnerability in install05.php in Simple PHP Blog (SPB) 0.4.7.1 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
D-Link DWL-2000AP 2.11 - ARP Flood Remote Denial of Service
D-LINK DWL-2000AP+ firmware 2.11 allows remote attackers to cause (1) a denial of service (device reset) via a flood of
23RISK
open ↗Referência
CVE-2026-114039
projectworlds Advanced Library Management System report_search.php mysqli_query sql injection
33RISK
open ↗Referência
CVE-2012-2208
Directory traversal vulnerability in upgrade.php in Piwigo before 2.3.4 allows remote attackers to include and execute a
23RISK
open ↗Referência
CVE-2023-27253
A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attac
60RISK
open ↗Referência
CVE-2015-0009
The Group Policy Security Configuration policy implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, W
23RISK
open ↗Referência
CVE-2015-3203
Unrestricted file upload vulnerability in h5ai before 0.25.0 allows remote attackers to execute arbitrary code by upload
23RISK
open ↗Referência
CVE-2015-7259
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.