Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,508cataloged exploits
40,258CVEs with public exploitation
24,696lab-tested
AllReferência 26,095Exploit-DB 24,488GitHub PoC 17,831VulnCheck XDB 10,015Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,095 exploits
Referência
CVE-2026-87927
CVE-2026-87927HIGH
MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher
41RISK
open ↗
Referência
CVE-2006-0441
CVE-2006-0441—
Stack-based buffer overflow in Sami FTP Server 2.0.1 allows remote attackers to execute arbitrary code via a long USER c
60RISK
open ↗
Referência✓ VexDay Proof
Apple Mac OSX - 'mount_smbfs' Local Stack Buffer Overflow
CVE-2007-3876—localosx
Stack-based buffer overflow in SMB in Apple Mac OS X 10.4.11 allows local users to execute arbitrary code via (1) a long
23RISK
open ↗
Referência✓ VexDay Proof
Seditio CMS Events Plugin - 'c' SQL Injection
CVE-2009-1411—webappsphp
SQL injection vulnerability in events/inc/events.inc.php in the Events plugin for Seditio CMS 1.0 allows remote attacker
23RISK
open ↗
Referência
CVE-2010-4911
CVE-2010-4911—
SQL injection vulnerability in classi/detail.php in PHP Classifieds Ads allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Check New 4.52 - SQL Injection
CVE-2008-5586—webappsphp
SQL injection vulnerability in findoffice.php in Check Up New Generation (aka Check New) 4.52, when magic_quotes_gpc is
23RISK
open ↗
Referência
CVE-2026-86669
CVE-2026-86669MEDIUM
aircheng-org iWebShop-5 systemseller.php login improper authentication
33RISK
open ↗
Referência
CVE-2026-57517
CVE-2026-57517CRITICAL
Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter
48RISK
open ↗
Referência✓ VexDay Proof
Adobe Reader 8.1.4/9.1 - 'GetAnnots()' Remote Code Execution
CVE-2009-1492—remotelinux
The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote
28RISK
open ↗
Referência
CVE-2026-86808
CVE-2026-86808MEDIUM
moltis-org moltis vault.rs vault_recovery_handler missing authentication
33RISK
open ↗
Referência
CVE-2026-90683
CVE-2026-90683MEDIUM
GPAC MP4Box base_scenegraph.c gf_node_unregister assertion
33RISK
open ↗
Referência
CVE-2009-1493
CVE-2009-1493—
The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and
28RISK
open ↗
Referência
CVE-2010-5000
CVE-2010-5000—
SQL injection vulnerability in login/login_index.php in MCLogin System 1.1 and 1.2 allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2026-82536
CVE-2026-82536HIGH
Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator
41RISK
open ↗
Referência
CVE-2026-86668
CVE-2026-86668MEDIUM
aircheng-org iWebShop-5 pic.php uploadFile cross site scripting
33RISK
open ↗
Referência
CVE-2026-86667
CVE-2026-86667MEDIUM
aircheng-org iWebShop-5 member.php member_list sql injection
33RISK
open ↗
Referência
CVE-2026-86672
CVE-2026-86672MEDIUM
ningzichun Student Management System Backup example.7z information disclosure
33RISK
open ↗
Referência✓ VexDay Proof
SerWeb 2.0.0 dev1 2007-02-20 - Multiple Local/Remote File Inclusion Vulnerabilities
CVE-2007-6290—webappsphp
Multiple directory traversal vulnerabilities in js/get_js.php in SERWeb 2.0.0 dev1 and earlier allow remote attackers to
23RISK
open ↗
Referência
CVE-2014-5083
CVE-2014-5083—
A Command Execution vulnerability exists in Sphider before 1.3.6 due to insufficient sanitization of fwrite to conf.php,
23RISK
open ↗
Referência
CVE-2010-5023
CVE-2010-5023—
SQL injection vulnerability in index.asp in Digital Interchange Calendar 5.8.5 allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2023-4966
CVE-2023-4966CRITICALunder attackransomware
Unauthenticated sensitive information disclosure
100RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Cmimarketplace - 'viewit' Directory Traversal
CVE-2009-1496—webappsphp
Directory traversal vulnerability in the Cmi Marketplace (com_cmimarketplace) component 0.1 for Joomla! allows remote at
38RISK
open ↗
Referência
CVE-2010-5024
CVE-2010-5024—
SQL injection vulnerability in manage/add_user.php in CuteSITE CMS 1.2.3 and 1.5.0 allows remote authenticated users, wi
23RISK
open ↗
Referência
CVE-2010-5026
CVE-2010-5026—
SQL injection vulnerability in winners.php in Science Fair In A Box (SFIAB) 2.0.6 and 2.2.0 allows remote attackers to e
23RISK
open ↗
Referência
CVE-2012-1210
CVE-2012-1210—
SQL injection vulnerability in pfile/file.php in Powie pFile 1.02 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_lowcosthotels - Blind SQL Injection
CVE-2008-5875—webappsphp
SQL injection vulnerability in the com_lowcosthotels component in the Hotel Booking Reservation System (aka HBS) for Joo
23RISK
open ↗
Referência
CVE-2012-1217
CVE-2012-1217—
Multiple cross-site scripting (XSS) vulnerabilities in STHS v2 Web Portal 2.2 allow remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2010-5037
CVE-2010-5037—
SQL injection vulnerability in article.php in SenseSites CommonSense CMS allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2013-5573
CVE-2013-5573—
Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inj
23RISK
open ↗
Referência
CVE-2014-1683
CVE-2014-1683—
The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248
50RISK
open ↗
← previouspage 225 / 870next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.