Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,508cataloged exploits
40,258CVEs with public exploitation
24,696lab-tested
AllReferência 26,095Exploit-DB 24,488GitHub PoC 17,831VulnCheck XDB 10,015Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,095 exploits
Referência✓ VexDay Proof
Xilisoft Video Converter Wizard 3 - '.cue' Stack Buffer Overflow (PoC)
Stack-based buffer overflow in ape_plugin.plg in Xilisoft Video Converter 3.1.53.0704n and 5.1.23.0402 allows remote att
23RISK
open ↗Referência
CVE-2010-4834
Multiple SQL injection vulnerabilities in index.php in OneOrZero AIMS 2.6.0 Members Edition and 2.7.0 Trial Edition allo
23RISK
open ↗Referência
CVE-2026-87921
Rizwan17 inventory-management-system manage.php update_record sql injection
33RISK
open ↗Referência
CVE-2026-87927
MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher
41RISK
open ↗Referência
CVE-2006-0441
Stack-based buffer overflow in Sami FTP Server 2.0.1 allows remote attackers to execute arbitrary code via a long USER c
60RISK
open ↗Referência✓ VexDay Proof
Apple Mac OSX - 'mount_smbfs' Local Stack Buffer Overflow
Stack-based buffer overflow in SMB in Apple Mac OS X 10.4.11 allows local users to execute arbitrary code via (1) a long
23RISK
open ↗Referência
CVE-2011-4106
TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote a
28RISK
open ↗Referência
CVE-2026-19855
Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text
33RISK
open ↗Referência
CVE-2012-0981
Directory traversal vulnerability in phpShowtime 2.0 allows remote attackers to list arbitrary directories and image fil
38RISK
open ↗Referência✓ VexDay Proof
Xpression News 1.0.1 - 'archives.php' Remote File Disclosure
Directory traversal vulnerability in archives.php in Xpression News (X-News) 1.0.1 allows remote attackers to include ar
23RISK
open ↗Referência✓ VexDay Proof
WordPress Plugin wp-Table 1.43 - 'inc_dir' Remote File Inclusion
PHP remote file inclusion vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin for WordPress,
35RISK
open ↗Referência✓ VexDay Proof
PStruh-CZ 1.3/1.5 - 'download.asp' File Disclosure
Directory traversal vulnerability in download.asp in Motobit 1.3 and 1.5 (aka PStruh-CZ) allows remote attackers to read
23RISK
open ↗Referência✓ VexDay Proof
Xserver 0.1 Alpha - 'POST' Remote Buffer Overflow (PoC)
Buffer overflow in Nipun Jain xserver 0.1 alpha allows remote attackers to cause a denial of service via a POST request
23RISK
open ↗Referência✓ VexDay Proof
Check New 4.52 - SQL Injection
SQL injection vulnerability in findoffice.php in Check Up New Generation (aka Check New) 4.52, when magic_quotes_gpc is
23RISK
open ↗Referência
CVE-2026-86669
aircheng-org iWebShop-5 systemseller.php login improper authentication
33RISK
open ↗Referência
CVE-2026-57517
Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter
48RISK
open ↗Referência✓ VexDay Proof
Adobe Reader 8.1.4/9.1 - 'GetAnnots()' Remote Code Execution
The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote
28RISK
open ↗Referência
CVE-2026-86808
moltis-org moltis vault.rs vault_recovery_handler missing authentication
33RISK
open ↗Referência
CVE-2009-1493
The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and
28RISK
open ↗Referência
CVE-2010-5000
SQL injection vulnerability in login/login_index.php in MCLogin System 1.1 and 1.2 allows remote attackers to execute ar
23RISK
open ↗Referência
CVE-2026-82536
Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator
41RISK
open ↗Referência
CVE-2026-86672
ningzichun Student Management System Backup example.7z information disclosure
33RISK
open ↗Referência✓ VexDay Proof
Falt4 CMS rc4 10.9.2007 - Multiple Vulnerabilities
SQL injection vulnerability in (1) index.php, and possibly (2) admin/index.php, in Falt4Extreme RC4 10.9.2007 allows rem
23RISK
open ↗Referência
Sanitized XenForo write-up and proof of concept for CVE-2026-73316.
XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider
41RISK
open ↗Referência✓ VexDay Proof
Microsoft GDI Plugin - '.png' Infinite Loop Denial of Service (PoC)
GDI+ in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (infinite loop) via a PNG file tha
28RISK
open ↗Referência
Sanitized XenForo write-up and proof of concept for CVE-2026-73315.
XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler
41RISK
open ↗Referência✓ VexDay Proof
TemaTres 1.0.3 - Blind SQL Injection
Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magic_quotes_gpc is disabled, allow remote atta
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.