Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,508cataloged exploits

40,258CVEs with public exploitation

24,696lab-tested

All Referência 26,095Exploit-DB 24,488GitHub PoC 17,831VulnCheck XDB 10,015Nuclei 4,547Metasploit 3,532✓ verified onlyrecent popular risk

26,095 exploits

Referência

CVE-2015-8562

CVE-2015-8562—

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbi

60RISK

open ↗

Referência✓ VexDay Proof

ILIAS 3.7.4 - 'ref_id' Blind SQL Injection

CVE-2008-5816—webappsphp

SQL injection vulnerability in repository.php in ILIAS 3.7.4 and earlier allows remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência

CVE-2014-2091

CVE-2014-2091—

Cross-site scripting (XSS) vulnerability in mods/_standard/forums/admin/forum_add.php in ATutor 2.1.1 allows remote auth

23RISK

open ↗

Referência

CVE-2015-1875

CVE-2015-1875—

SQL injection vulnerability in a2billing/customer/iridium_threed.php in Elastix 2.5.0 and earlier allows remote attacker

23RISK

open ↗

Referência

CVE-2009-1329

CVE-2009-1329—

Stack-based buffer overflow in Mini-stream Shadow Stream Recorder 3.0.1.7 allows remote attackers to execute arbitrary c

23RISK

open ↗

Referência

CVE-2015-8562

CVE-2015-8562—

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbi

60RISK

open ↗

Referência

CVE-2010-1112

CVE-2010-1112—

Cross-site scripting (XSS) vulnerability in cat.php in KloNews 2.0 allows remote attackers to inject arbitrary web scrip

23RISK

open ↗

Referência

CVE-2009-3162

CVE-2009-3162—

Cross-site scripting (XSS) vulnerability in Multi Website 1.5 allows remote attackers to inject arbitrary web script or

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Visual Studio 6.0 - 'PDWizard.ocx' Remote Command Execution

CVE-2007-4891—remotewindows

A certain ActiveX control in PDWizard.ocx 6.0.0.9782 and earlier in Microsoft Visual Studio 6.0 exposes dangerous (1) St

35RISK

open ↗

Referência

CVE-2009-3833

CVE-2009-3833—

Cross-site scripting (XSS) vulnerability in index.php in TFTgallery 0.13 allows remote attackers to inject arbitrary web

23RISK

open ↗

Referência

CVE-2009-4858

CVE-2009-4858—

Cross-site scripting (XSS) vulnerability in questiondetail.php in Yahoo Answers Clone allows remote attackers to inject

23RISK

open ↗

Referência

CVE-2009-3901

CVE-2009-3901—

Multiple cross-site scripting (XSS) vulnerabilities in e-Courier CMS allow remote attackers to inject arbitrary web scri

23RISK

open ↗

Referência

CVE-2015-8562

CVE-2015-8562—

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbi

60RISK

open ↗

Referência

CVE-2026-101132

CVE-2026-101132LOW

DeepSeek deepseek-harness Bundle Patch profile.ts loadProfile path traversal

28RISK

open ↗

Referência

CVE-2013-1959

CVE-2013-1959—

kernel/user_namespace.c in the Linux kernel before 3.8.9 does not have appropriate capability requirements for the uid_m

23RISK

open ↗

Referência

CVE-2009-20011

CVE-2009-20011CRITICAL

ContentKeeper Web Appliance < 125.10 RCE via mimencode

63RISK

open ↗

Referência

CVE-2009-20011

CVE-2009-20011CRITICAL

ContentKeeper Web Appliance < 125.10 RCE via mimencode

63RISK

open ↗

Referência

CVE-2015-5148

CVE-2015-5148—

SQL injection vulnerability in LivelyCart 1.2.0 allows remote attackers to execute arbitrary SQL commands via the search

23RISK

open ↗

Referência

CVE-2026-15620

CVE-2026-15620MEDIUM

mosaxiv clawlet tool_web_fetch.go tools.webFetch server-side request forgery

33RISK

open ↗

Referência

CVE-2016-0727

CVE-2016-0727—

The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ub

23RISK

open ↗

Referência

CVE-2017-6953

CVE-2017-6953—

Gemalto SmartDiag Diagnosis Tool v2.5 has a stack-based Buffer Overflow with SEH Overwrite via long "Register a new card

23RISK

open ↗

Referência

Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE

CVE-2025-1974CRITICALremotemultiple

ingress-nginx admission controller RCE escalation

85RISK

open ↗

Referência✓ VexDay Proof

glFusion 1.1.2 - 'COM_applyFilter()/cookies' Blind SQL Injection

CVE-2009-1283—webappsphp

glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows rem

23RISK

open ↗

Referência✓ VexDay Proof

impleo music Collection 2.0 - SQL Injection / Cross-Site Scripting

CVE-2009-2153—webappsphp

Cross-site scripting (XSS) vulnerability in index.php in Impleo Music Collection 2.0 allows remote attackers to inject a

23RISK

open ↗

Referência

CVE-2026-8097

CVE-2026-8097MEDIUM

CodeAstro Online Classroom askquery.php sql injection

33RISK

open ↗

Referência

CVE-2026-8087

CVE-2026-8087MEDIUM

OSGeo gdal GDapi.c GDnentries heap-based overflow

33RISK

open ↗

Referência

CVE-2009-3248

CVE-2009-3248—

Cross-site request forgery (CSRF) vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack

23RISK

open ↗

Referência

CVE-2009-3061

CVE-2009-3061—

SQL injection vulnerability in lesson.php in Alqatari Q R Script 1.0 allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência

CVE-2010-2680

CVE-2010-2680—

Directory traversal vulnerability in the JExtensions JE Section/Property Finder (jesectionfinder) component for Joomla!

38RISK

open ↗

Referência

CVE-2010-4275

CVE-2010-4275—

Multiple cross-site scripting (XSS) vulnerabilities in Radius Manager 3.8.0 allow remote authenticated administrators to

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.