Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,634cataloged exploits
40,286CVEs with public exploitation
24,696lab-tested
AllReferência 26,110Exploit-DB 24,488GitHub PoC 17,941VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,110 exploits
Referência
CVE-2026-84745
CVE-2026-84745LOW
The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
28RISK
open ↗
Referência
CVE-2013-0238
CVE-2013-0238—
The try_parse_v4_netmask function in hostmask.c in IRCD-Hybrid before 8.0.6 does not properly validate masks, which allo
23RISK
open ↗
Referência
CVE-2026-16013
CVE-2026-16013MEDIUM
liftoff-sr CIPster cipepath.cc deserialize_symbolic out-of-bounds
33RISK
open ↗
Referência
CVE-2026-11961
CVE-2026-11961HIGH
User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID
41RISK
open ↗
Referência
CVE-2014-8356
CVE-2014-8356—
The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended a
23RISK
open ↗
Referência
CVE-2008-6617
CVE-2008-6617—
Unrestricted file upload vulnerability in adm/visual/upload.php in SiteXS CMS 0.1.1 allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
FluentCMS - 'view.php' SQL Injection
CVE-2008-6642—webappsphp
SQL injection vulnerability in view.php in DotContent FluentCMS 4.x allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2026-49127
CVE-2026-49127HIGH
Music Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24be
41RISK
open ↗
Referência✓ VexDay Proof
Simple Machines Forum (SMF) 1.1.6 - Code Execution
CVE-2008-6657—webappsphp
Cross-site request forgery (CSRF) vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 be
23RISK
open ↗
Referência
CVE-2026-8213
CVE-2026-8213MEDIUM
OSGeo gdal Grid File GDapi.c GDSDfldsrch heap-based overflow
33RISK
open ↗
Referência
CVE-2013-1347
CVE-2013-1347HIGHunder attack
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbit
100RISK
open ↗
Referência✓ VexDay Proof
PHP Image 1.2 - Multiple Remote File Inclusions
CVE-2007-5697—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PHP Image 1.2 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗
Referência
CVE-2015-0779
CVE-2015-0779—
Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11
60RISK
open ↗
Referência
CVE-2017-2445
CVE-2017-2445—
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS bef
23RISK
open ↗
Referência
CVE-2026-24444
CVE-2026-24444CRITICAL
SDMC NE6037 Hardcoded Password via mgmt.php/npcmd.php
48RISK
open ↗
Referência
CVE-2009-4730
CVE-2009-4730—
SQL injection vulnerability in report.php in x10 Adult Media Script 1.7 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2008-0232
CVE-2008-0232—
Multiple SQL injection vulnerabilities in Zero CMS 1.0 Alpha allow remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
OneCMS 2.5 - Blind SQL Injection
CVE-2008-6652—webappsphp
SQL injection vulnerability in asd.php in OneCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the s
23RISK
open ↗
Referência✓ VexDay Proof
xeCMS 1.0.0 RC2 - Insecure Cookie Handling
CVE-2008-6714—webappsphp
admin.php in xeCMS 1.0.0 RC2 and earlier allows remote attackers to bypass authentication and access the admin panel by
28RISK
open ↗
Referência
CVE-2014-8555
CVE-2014-8555—
Directory traversal vulnerability in report/reportViewAction.jsp in Progress Software OpenEdge 11.2 allows remote attack
23RISK
open ↗
Referência
CVE-2009-4751
CVE-2009-4751—
SQL injection vulnerability in anzeiger/start.php in Swinger Club Portal allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2013-1852
CVE-2013-1852—
SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote at
23RISK
open ↗
Referência
CVE-2015-0936
CVE-2015-0936—
Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows remot
60RISK
open ↗
Referência
CVE-2014-8800
CVE-2014-8800—
Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before
23RISK
open ↗
Referência
CVE-2016-20080
CVE-2016-20080MEDIUM
WordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.php
33RISK
open ↗
Referência✓ VexDay Proof
yourplace 1.0.2 - Multiple Vulnerabilities / Remote Code Execution
CVE-2008-6769—webappsphp
Unrestricted file upload vulnerability in upload.php in YourPlace 1.0.2 and earlier allows remote authenticated users to
23RISK
open ↗
Referência
CVE-2019-25753
CVE-2019-25753HIGH
Joomla! Component VMap 1.9.6 SQL Injection via loadmarker
41RISK
open ↗
Referência
CVE-2016-20078
CVE-2016-20078MEDIUM
WordPress IMDb Profile Widget 1.0.8 Local File Inclusion via pic.php
33RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Affiliate - 'cat_id' SQL Injection
CVE-2008-6780—webappsphp
SQL injection vulnerability in directory.php in Scripts for Sites (SFS) SFS EZ Affiliate allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2026-2604
CVE-2026-2604MEDIUM
Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling
33RISK
open ↗
← previouspage 234 / 871next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.