Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,508cataloged exploits
40,258CVEs with public exploitation
24,696lab-tested
AllReferência 26,095Exploit-DB 24,488GitHub PoC 17,831VulnCheck XDB 10,015Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,095 exploits
Referência
CVE-2014-4717
CVE-2014-4717—
Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Share Buttons Adder plugin before 4.5 for WordP
23RISK
open ↗
Referência✓ VexDay Proof
chCounter 3.1.3 - Authentication Bypass
CVE-2009-1347—webappsphp
Multiple SQL injection vulnerabilities in stats/index.php in chCounter 3.1.3 allow remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2010-1946
CVE-2010-1946—
Multiple PHP remote file inclusion vulnerabilities in openMairie Openregistrecil 1.02, when register_globals is enabled,
23RISK
open ↗
Referência
CVE-2026-15375
CVE-2026-15375MEDIUM
Eleveo Call Recording Software LDAP User users_ldap.jsp improper authorization
33RISK
open ↗
Referência
CVE-2010-4771
CVE-2010-4771—
SQL injection vulnerability to viewforum.php in S-CMS 2.5 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2026-19977
CVE-2026-19977CRITICAL
EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication
48RISK
open ↗
Referência
CVE-2026-19970
CVE-2026-19970MEDIUM
Open Asset Import Library Assimp Node MDLLoader.cpp AddBonesToNodeGraph_3DGS_MDL7 heap-based overflow
33RISK
open ↗
Referência
CVE-2026-15274
CVE-2026-15274MEDIUM
lo48576 fbxcel Node Header parser.rs denial of service
33RISK
open ↗
Referência
CVE-2026-15188
CVE-2026-15188MEDIUM
manjurulhoque django-job-portal Employee Dashboard Endpoint views.py EditEmployeeProfileAPIView access control
33RISK
open ↗
Referência
CVE-2026-19969
CVE-2026-19969MEDIUM
Open Asset Import Library Assimp 3DGS MDL7 Model Output Mesh Generator MDLLoader.cpp GenerateOutputMeshes_3DGS_MDL7 buffer overflow
33RISK
open ↗
Referência
CVE-2026-58473
CVE-2026-58473CRITICAL
Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings
48RISK
open ↗
Referência
CVE-2026-15134
CVE-2026-15134MEDIUM
CodeAstro Simple Online Leave Management System index.php sql injection
33RISK
open ↗
Referência✓ VexDay Proof
Seditio CMS Events Plugin - 'c' SQL Injection
CVE-2009-1411—webappsphp
SQL injection vulnerability in events/inc/events.inc.php in the Events plugin for Seditio CMS 1.0 allows remote attacker
23RISK
open ↗
Referência
CVE-2010-4911
CVE-2010-4911—
SQL injection vulnerability in classi/detail.php in PHP Classifieds Ads allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2011-4106
CVE-2011-4106—
TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote a
28RISK
open ↗
Referência
CVE-2026-19855
CVE-2026-19855MEDIUM
Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text
33RISK
open ↗
Referência
CVE-2012-0981
CVE-2012-0981—
Directory traversal vulnerability in phpShowtime 2.0 allows remote attackers to list arbitrary directories and image fil
38RISK
open ↗
Referência✓ VexDay Proof
Xpression News 1.0.1 - 'archives.php' Remote File Disclosure
CVE-2007-1040—webappsphp
Directory traversal vulnerability in archives.php in Xpression News (X-News) 1.0.1 allows remote attackers to include ar
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin wp-Table 1.43 - 'inc_dir' Remote File Inclusion
CVE-2007-2484—webappsphp
PHP remote file inclusion vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin for WordPress,
35RISK
open ↗
Referência✓ VexDay Proof
PStruh-CZ 1.3/1.5 - 'download.asp' File Disclosure
CVE-2007-2486—webappsasp
Directory traversal vulnerability in download.asp in Motobit 1.3 and 1.5 (aka PStruh-CZ) allows remote attackers to read
23RISK
open ↗
Referência✓ VexDay Proof
Xserver 0.1 Alpha - 'POST' Remote Buffer Overflow (PoC)
CVE-2007-3957—doslinux
Buffer overflow in Nipun Jain xserver 0.1 alpha allows remote attackers to cause a denial of service via a POST request
23RISK
open ↗
Referência✓ VexDay Proof
Check New 4.52 - SQL Injection
CVE-2008-5586—webappsphp
SQL injection vulnerability in findoffice.php in Check Up New Generation (aka Check New) 4.52, when magic_quotes_gpc is
23RISK
open ↗
Referência
CVE-2026-86669
CVE-2026-86669MEDIUM
aircheng-org iWebShop-5 systemseller.php login improper authentication
33RISK
open ↗
Referência
CVE-2026-57517
CVE-2026-57517CRITICAL
Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter
48RISK
open ↗
Referência✓ VexDay Proof
Adobe Reader 8.1.4/9.1 - 'GetAnnots()' Remote Code Execution
CVE-2009-1492—remotelinux
The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote
28RISK
open ↗
Referência
CVE-2026-86808
CVE-2026-86808MEDIUM
moltis-org moltis vault.rs vault_recovery_handler missing authentication
33RISK
open ↗
Referência
CVE-2026-90683
CVE-2026-90683MEDIUM
GPAC MP4Box base_scenegraph.c gf_node_unregister assertion
33RISK
open ↗
Referência
CVE-2009-1493
CVE-2009-1493—
The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and
28RISK
open ↗
Referência
CVE-2010-5000
CVE-2010-5000—
SQL injection vulnerability in login/login_index.php in MCLogin System 1.1 and 1.2 allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2026-82536
CVE-2026-82536HIGH
Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator
41RISK
open ↗
← previouspage 219 / 870next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.