Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,388cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
26,070 exploits
Referência✓ VexDay Proof
aflog 1.01 - Multiple Insecure Cookie Handling Vulnerabilities
CVE-2008-4784—webappsphp
aflog 1.01 allows remote attackers to bypass authentication and gain administrative access by setting the aflog_auth_a c
23RISK
open ↗
Referência
CVE-2018-0745
CVE-2018-0745—
The Windows kernel in Windows 10 version 1703. Windows 10 version 1709, and Windows Server, version 1709 allows an infor
23RISK
open ↗
Referência
CVE-2026-77770
CVE-2026-77770CRITICAL
miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator
48RISK
open ↗
Referência
CVE-2019-1344
CVE-2019-1344—
An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memo
23RISK
open ↗
Referência
CVE-2010-4719
CVE-2010-4719—
Directory traversal vulnerability in JRadio (com_jradio) component before 1.5.1 for Joomla! allows remote attackers to r
43RISK
open ↗
Referência
CVE-2013-5099
CVE-2013-5099—
Cross-site scripting (XSS) vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote at
23RISK
open ↗
Referência
CVE-2012-0901
CVE-2012-0901—
Cross-site scripting (XSS) vulnerability in yousaytoo.php in YouSayToo auto-publishing plugin 1.0 for WordPress allows r
38RISK
open ↗
Referência
CVE-2023-28293
CVE-2023-28293HIGH
Windows Kernel Elevation of Privilege Vulnerability
41RISK
open ↗
Referência✓ VexDay Proof
eMeeting Online Dating Software 5.2 - SQL Injection
CVE-2007-3609—webappsphp
Multiple SQL injection vulnerabilities in eMeeting Online Dating Software 5.2 allow remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2026-11875
CVE-2026-11875MEDIUM
WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie Forgery
33RISK
open ↗
Referência
CVE-2026-19977
CVE-2026-19977CRITICAL
EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication
48RISK
open ↗
Referência
CVE-2026-23698
CVE-2026-23698HIGH
Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload
41RISK
open ↗
Referência
CVE-2014-4717
CVE-2014-4717—
Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Share Buttons Adder plugin before 4.5 for WordP
23RISK
open ↗
Referência✓ VexDay Proof
chCounter 3.1.3 - Authentication Bypass
CVE-2009-1347—webappsphp
Multiple SQL injection vulnerabilities in stats/index.php in chCounter 3.1.3 allow remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2010-1946
CVE-2010-1946—
Multiple PHP remote file inclusion vulnerabilities in openMairie Openregistrecil 1.02, when register_globals is enabled,
23RISK
open ↗
Referência
CVE-2026-15375
CVE-2026-15375MEDIUM
Eleveo Call Recording Software LDAP User users_ldap.jsp improper authorization
33RISK
open ↗
Referência
CVE-2026-19970
CVE-2026-19970MEDIUM
Open Asset Import Library Assimp Node MDLLoader.cpp AddBonesToNodeGraph_3DGS_MDL7 heap-based overflow
33RISK
open ↗
Referência
CVE-2010-4771
CVE-2010-4771—
SQL injection vulnerability to viewforum.php in S-CMS 2.5 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2026-15274
CVE-2026-15274MEDIUM
lo48576 fbxcel Node Header parser.rs denial of service
33RISK
open ↗
Referência
CVE-2026-15188
CVE-2026-15188MEDIUM
manjurulhoque django-job-portal Employee Dashboard Endpoint views.py EditEmployeeProfileAPIView access control
33RISK
open ↗
Referência
CVE-2026-58473
CVE-2026-58473CRITICAL
Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings
48RISK
open ↗
Referência
CVE-2026-19969
CVE-2026-19969MEDIUM
Open Asset Import Library Assimp 3DGS MDL7 Model Output Mesh Generator MDLLoader.cpp GenerateOutputMeshes_3DGS_MDL7 buffer overflow
33RISK
open ↗
Referência
CVE-2026-15134
CVE-2026-15134MEDIUM
CodeAstro Simple Online Leave Management System index.php sql injection
33RISK
open ↗
Referência✓ VexDay Proof
Seditio CMS Events Plugin - 'c' SQL Injection
CVE-2009-1411—webappsphp
SQL injection vulnerability in events/inc/events.inc.php in the Events plugin for Seditio CMS 1.0 allows remote attacker
23RISK
open ↗
Referência
CVE-2010-4911
CVE-2010-4911—
SQL injection vulnerability in classi/detail.php in PHP Classifieds Ads allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Check New 4.52 - SQL Injection
CVE-2008-5586—webappsphp
SQL injection vulnerability in findoffice.php in Check Up New Generation (aka Check New) 4.52, when magic_quotes_gpc is
23RISK
open ↗
Referência
CVE-2026-82536
CVE-2026-82536HIGH
Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator
41RISK
open ↗
Referência
CVE-2026-57517
CVE-2026-57517CRITICAL
Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter
48RISK
open ↗
Referência✓ VexDay Proof
Adobe Reader 8.1.4/9.1 - 'GetAnnots()' Remote Code Execution
CVE-2009-1492—remotelinux
The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote
28RISK
open ↗
Referência
CVE-2026-86668
CVE-2026-86668MEDIUM
aircheng-org iWebShop-5 pic.php uploadFile cross site scripting
33RISK
open ↗
← previouspage 183 / 869next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.