Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,508cataloged exploits
40,258CVEs with public exploitation
24,696lab-tested
AllReferência 26,095Exploit-DB 24,488GitHub PoC 17,831VulnCheck XDB 10,015Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,095 exploits
Referência
CVE-2026-88898
AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint
41RISK
open ↗Referência✓ VexDay Proof
PHPPeanuts 1.3 Beta - 'Inspect.php' Remote File Inclusion
PHP remote file inclusion vulnerability in pntUnit/Inspect.php in phpPeanuts 1.1 and earlier allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
VerliAdmin 0.3 - 'language.php' Local File Inclusion
Directory traversal vulnerability in language.php in VerliAdmin 0.3 and earlier, when magic_quotes_gpc is disabled, allo
23RISK
open ↗Referência✓ VexDay Proof
pragmaMX Module Landkarten 2.1 (Windows) - Local File Inclusion
Directory traversal vulnerability in inc/map.func.php in pragmaMX Landkarten 2.1 module allows remote attackers to inclu
23RISK
open ↗Referência
CVE-2006-5521
PHP remote file inclusion vulnerability in DNS/RR.php in Net_DNS 0.03 and earlier allows remote attackers to execute arb
23RISK
open ↗Referência
CVE-2014-3848
The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to o
23RISK
open ↗Referência
CVE-2017-11309
Buffer overflow in the SoftConsole client in Avaya IP Office before 10.1.1 allows remote servers to execute arbitrary co
23RISK
open ↗Referência
CVE-2011-0504
Multiple cross-site scripting (XSS) vulnerabilities in VaM Shop 1.6, 1.6.1, and probably earlier versions llow remote at
23RISK
open ↗Referência
CVE-2018-1002005
These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in bft_list.html.php:4
23RISK
open ↗Referência
CVE-2020-8495
In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate se
41RISK
open ↗Referência
CVE-2010-2617
Cross-site scripting (XSS) vulnerability in bible.php in PHP Bible Search allows remote attackers to inject arbitrary we
23RISK
open ↗Referência
CVE-2026-115506
libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay
41RISK
open ↗Referência
CVE-2010-4283
PHP remote file inclusion vulnerability in extras/pandora_diag.php in Pandora FMS before 3.1.1 allows remote attackers t
23RISK
open ↗Referência
CVE-2014-2587
SQL injection vulnerability in jsp/reports/ReportsAudit.jsp in McAfee Asset Manager 6.6 allows remote authenticated user
23RISK
open ↗Referência
CVE-2014-3848
The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to o
23RISK
open ↗Referência
CVE-2017-11309
Buffer overflow in the SoftConsole client in Avaya IP Office before 10.1.1 allows remote servers to execute arbitrary co
23RISK
open ↗Referência✓ VexDay Proof
Joomla! 1.5.x - 'Token' Remote Admin Change Password
components/com_user/models/reset.php in Joomla! 1.5 through 1.5.5 does not properly validate reset tokens, which allows
23RISK
open ↗Referência✓ VexDay Proof
wbstreet 1.0 - SQL Injection / File Disclosure
Wbstreet (aka PHPSTREET Webboard) 1.0 stores sensitive information under the web root with insufficient access control,
23RISK
open ↗Referência✓ VexDay Proof
Joomla! / Mambo Component SWmenu 4.0 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the SWmenu (com_swmenupro and com_swmenufree) 4.0 component for Ma
28RISK
open ↗Referência✓ VexDay Proof
PHP-Generics 1.0.0 Beta - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in PHP-Generics 1.0 beta allow remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Glossword 1.8.1 - 'custom_vars.php' Remote File Inclusion
PHP remote file inclusion vulnerability in custom_vars.php in GlossWord 1.8.1 allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
CounterPath X-Lite 3.x - SIP phone Remote Denial of Service
CounterPath X-Lite 3.0 34025, and possibly eyeBeam, allows remote attackers to cause a denial of service (device crash)
23RISK
open ↗Referência✓ VexDay Proof
eCentrex VOIP Client module - 'uacomx.ocx 2.0.1' Remote Buffer Overflow
Buffer overflow in the IUAComFormX ActiveX control in uacomx.ocx 2.0.1 in the eCentrex VOIP Client module allows remote
23RISK
open ↗Referência
CVE-2016-4004
Directory traversal vulnerability in Dell OpenManage Server Administrator (OMSA) 8.2 allows remote authenticated adminis
23RISK
open ↗Referência
CVE-2012-6644
Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.6 allow remote attackers to inject arbitrary web scr
23RISK
open ↗Referência
CVE-2013-3639
Multiple cross-site scripting (XSS) vulnerabilities in Xaraya 2.4.0-b1 and earlier allow remote attackers to inject arbi
23RISK
open ↗Referência
CVE-2018-0715
Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inje
23RISK
open ↗Referência
CVE-2026-17530
AstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization
33RISK
open ↗Referência✓ VexDay Proof
Kim Websites 1.0 - Authentication Bypass
Multiple SQL injection vulnerabilities in login.php in Kim Websites 1.0 allow remote attackers to execute arbitrary SQL
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.