Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,388cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
26,070 exploits
Referência✓ VexDay Proof
PHP-Nuke Module PostGuestbook 0.6.1 - 'tpl_pgb_moddir' Remote File Inclusion
PHP remote file inclusion vulnerability in styles/internal/header.php in the PostGuestbook 0.6.1 module for PHP-Nuke all
23RISK
open ↗Referência
CVE-2018-15839
D-Link DIR-615 devices have a buffer overflow via a long Authorization HTTP header.
35RISK
open ↗Referência★ 1
CVE-2026-21876 PoC: WAF charset bypass (Flask, ASP.NET and Spring Boot stands)
OWASP CRS has multipart bypass using multiple content-type parts
53RISK
open ↗Referência✓ VexDay Proof
mxBB Module FAQ & RULES 2.0.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in faq.php in the FAQ & RULES 2.0.0 and earlier module for mxBB allows remote at
23RISK
open ↗Referência
CVE-2015-2701
Cross-site request forgery (CSRF) vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of
23RISK
open ↗Referência
CVE-2015-2746
The network diagnostics tool (CommandLineServlet) in the Appliance Manager command line utility (CLU) in Websense TRITON
28RISK
open ↗Referência
CVE-2016-7786
Sophos Cyberoam UTM CR25iNG 10.6.3 MR-5 allows remote authenticated users to bypass intended access restrictions via dir
23RISK
open ↗Referência
CVE-2017-15957
my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.
23RISK
open ↗Referência
CVE-2020-13118
An issue was discovered in Mikrotik-Router-Monitoring-System through 2018-10-22. SQL Injection exists in check_community
23RISK
open ↗Referência
CVE-2026-84096
WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fields
41RISK
open ↗Referência
CVE-2026-90597
itsourcecode Sales and Inventory System sup_edit1.php sql injection
33RISK
open ↗Referência✓ VexDay Proof
X-Forum 0.6.2 - Remote Command Execution
Static code injection vulnerability in X-Forum 0.6.2 allows remote authenticated administrators to inject arbitrary PHP
23RISK
open ↗Referência
CVE-2010-2034
Directory traversal vulnerability in the Percha Image Attach (com_perchaimageattach) component 1.1 for Joomla! allows re
43RISK
open ↗Referência
CVE-2009-4906
Cross-site request forgery (CSRF) vulnerability in index.php in Acc PHP eMail 1.1 allows remote attackers to hijack the
23RISK
open ↗Referência
CVE-2009-4906
Cross-site request forgery (CSRF) vulnerability in index.php in Acc PHP eMail 1.1 allows remote attackers to hijack the
23RISK
open ↗Referência✓ VexDay Proof
Quake 3 Engine 1.32b - 'R_RemapShader()' Remote Client Buffer Overflow
Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Castle Wolfenstein 1.41, and (3) Quake III
23RISK
open ↗Referência
CVE-2014-8690
Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, an
23RISK
open ↗Referência
CVE-2014-8690
Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, an
23RISK
open ↗Referência
CVE-2015-2746
The network diagnostics tool (CommandLineServlet) in the Appliance Manager command line utility (CLU) in Websense TRITON
28RISK
open ↗Referência
CVE-2015-2789
Unquoted Windows search path vulnerability in the Foxit Cloud Safe Update Service in the Cloud plugin in Foxit Reader 6.
23RISK
open ↗Referência
CVE-2018-17383
SQL Injection exists in the Collection Factory 4.1.9 component for Joomla! via the filter_order or filter_order_Dir para
23RISK
open ↗Referência
CVE-2018-17383
SQL Injection exists in the Collection Factory 4.1.9 component for Joomla! via the filter_order or filter_order_Dir para
23RISK
open ↗Referência✓ VexDay Proof
phpBB User Viewed Posts Tracker 1.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/functions_user_viewed_posts.php in the Nivisec User Viewed Posts Tra
23RISK
open ↗Referência✓ VexDay Proof
MiniBB 2.0.5 - 'Language' Local File Inclusion
Directory traversal vulnerability in index.php in MiniBB 2.0.5 allows remote attackers to read arbitrary files via a ..
23RISK
open ↗Referência
CVE-2011-4714
Directory traversal vulnerability in Virtual Vertex Muster before 6.20 allows remote attackers to read arbitrary files v
23RISK
open ↗Referência✓ VexDay Proof
IP Reg 0.3 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Ip Reg 0.3 allow remote attackers to execute arbitrary SQL commands via the vl
23RISK
open ↗Referência
CVE-2014-9605
WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass aut
23RISK
open ↗Referência
CVE-2015-2508
The Adobe Type Manager Library in Microsoft Windows 10 allows local users to gain privileges via a crafted application,
23RISK
open ↗Referência
CVE-2009-4093
Multiple cross-site scripting (XSS) vulnerabilities in comments.php in Simplog 0.9.3.2, and possibly earlier, allow remo
23RISK
open ↗Referência
CVE-2026-97895
krayin laravel-crm User Management UserController.php privileges management
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.