Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,508cataloged exploits

40,258CVEs with public exploitation

24,696lab-tested

All Referência 26,095Exploit-DB 24,488GitHub PoC 17,831VulnCheck XDB 10,015Nuclei 4,547Metasploit 3,532✓ verified onlyrecent popular risk

26,095 exploits

Referência✓ VexDay Proof

WordPress Core 2.2 - 'xmlrpc.php' SQL Injection

CVE-2007-3140—webappsphp

SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

Jasmine CMS 1.0 - SQL Injection / Remote Code Execution

CVE-2007-3312—webappsphp

Directory traversal vulnerability in admin/plugin_manager.php in Jasmine CMS 1.0 allows remote authenticated administrat

23RISK

open ↗

Referência

CVE-2018-1120

CVE-2018-1120LOW

A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory

28RISK

open ↗

Referência✓ VexDay Proof

ChartDirector 4.1 - 'viewsource.php' File Disclosure

CVE-2008-1782—webappsphp

phpdemo/viewsource.php in Advanced Software Engineering ChartDirector 4.1 allows remote attackers to read sensitive file

23RISK

open ↗

Referência

CVE-2025-34515

CVE-2025-34515CRITICAL

Ilevia EVE X1 Server 4.7.18.0.eden Root Privilege Escalation

48RISK

open ↗

Referência

CVE-2009-3335

CVE-2009-3335—

SQL injection vulnerability in the TurtuShout component 0.11 for Joomla! allows remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência

CVE-2026-90648

CVE-2026-90648HIGH

wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platfor

41RISK

open ↗

Referência

CVE-2026-73698

CVE-2026-73698HIGH

FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action

41RISK

open ↗

Referência

CVE-2009-4841

CVE-2009-4841—

Heap-based buffer overflow in the SonicMediaPlayer ActiveX control in SonicMediaPlayer.dll in Roxio CinePlayer 3.2 allow

23RISK

open ↗

Referência✓ VexDay Proof

DS-IPN.NET Digital Sales IPN - Database Disclosure

CVE-2009-0328—webappsasp

ROBS-PROJECTS Digital Sales IPN (aka DS-IPN.NET or DS-IPN Paypal Shop) stores sensitive information under the web root w

23RISK

open ↗

Referência✓ VexDay Proof

Prozilla Top 100 1.2 - Arbitrary Delete Stats

CVE-2008-1785—webappsphp

delete.php in Prozilla Top 100 1.2 allows remote authenticated users to delete statistics and accounts of arbitrary user

23RISK

open ↗

Referência

CVE-2015-1577

CVE-2015-1577—

Directory traversal vulnerability in u5admin/deletefile.php in u5CMS before 3.9.4 allows remote attackers to write to ar

23RISK

open ↗

Referência

CVE-2016-2226

CVE-2016-2226—

Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2018-8057

CVE-2018-8057—

A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in a

28RISK

open ↗

Referência

CVE-2020-3950

CVE-2020-3950HIGHunder attack

VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for

86RISK

open ↗

Referência

CVE-2026-80440

CVE-2026-80440MEDIUM

Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders

33RISK

open ↗

Referência

CVE-2026-79632

CVE-2026-79632MEDIUM

WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission

33RISK

open ↗

Referência✓ VexDay Proof

Absolute News Manager 5.1 - Insecure Cookie Handling

CVE-2008-6856—webappsphp

Xigla Software Absolute News Manager.NET 5.1 allows remote attackers to bypass authentication and gain administrative ac

23RISK

open ↗

Referência

CVE-2009-4204

CVE-2009-4204—

SQL injection vulnerability in read.php in Flashlight Free Edition allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência

CVE-2010-0458

CVE-2010-0458—

Multiple SQL injection vulnerabilities in NetArt Media Blog System 1.5 allow remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2010-2143

CVE-2010-2143—

Directory traversal vulnerability in index.php in Symphony CMS 2.0.7 allows remote attackers to read arbitrary files and

23RISK

open ↗

Referência

CVE-2010-4861

CVE-2010-4861—

SQL injection vulnerability in asearch.php in webSPELL 4.2.1 allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência

CVE-2010-2354

CVE-2010-2354—

SQL injection vulnerability in subscribe.php in Pilot Group (PG) eLMS Pro allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

Jupiter CMS 1.1.5 - '/index.php' Local/Remote File Inclusion

CVE-2007-0987—webappsphp

Directory traversal vulnerability in index.php in Jupiter CMS 1.1.5 allows remote attackers to include and execute arbit

23RISK

open ↗

Referência

CVE-2009-4205

CVE-2009-4205—

Directory traversal vulnerability in admin.php in Flashlight Free Edition allows remote attackers to include and execute

23RISK

open ↗

Referência

CVE-2009-4434

CVE-2009-4434—

Directory traversal vulnerability in index.php in IDevSpot iSupport 1.8 and earlier allows remote attackers to read arbi

23RISK

open ↗

Referência

CVE-2026-112059

CVE-2026-112059MEDIUM

libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR

33RISK

open ↗

Referência

CVE-2026-112054

CVE-2026-112054MEDIUM

Schroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Transform Parsing

33RISK

open ↗

Referência

CVE-2025-15691

CVE-2025-15691MEDIUM

WPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in Forms

33RISK

open ↗

Referência✓ VexDay Proof

Faq Administrator 2.1 - 'faq_reply.php' Remote File Inclusion

CVE-2006-5637—webappsphp

PHP remote file inclusion vulnerability in faq_reply.php in Faq Administrator 2.1b allows remote attackers to execute ar

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.