Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,634cataloged exploits

40,286CVEs with public exploitation

24,696lab-tested

All Referência 26,110Exploit-DB 24,488GitHub PoC 17,941VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecent popular risk

26,110 exploits

Referência

CVE-2026-91022

CVE-2026-91022MEDIUM

Motors < 1.4.124 - Listing Manager+ Stored XSS via Badge Color

33RISK

open ↗

Referência

CVE-2009-4857

CVE-2009-4857—

Cross-site scripting (XSS) vulnerability in login.php in PHP Photo Vote 1.3F allows remote attackers to inject arbitrary

23RISK

open ↗

Referência

CVE-2015-4066

CVE-2015-4066—

Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow rem

23RISK

open ↗

Referência

CVE-2026-85016

CVE-2026-85016MEDIUM

Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter

33RISK

open ↗

Referência✓ VexDay Proof

EZContents CMS 2.0.0 - Multiple SQL Injections

CVE-2008-2135—webappsphp

Multiple SQL injection vulnerabilities in VisualShapers ezContents 2.0.0 allow remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

WordPress Plugin Download Manager 0.2 - Arbitrary File Upload

CVE-2008-3362—webappsphp

Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress a

28RISK

open ↗

Referência

CVE-2008-6898

CVE-2008-6898—

Buffer overflow in the XHTTP Module 4.1.0.0 in the ActiveX control for SaschArt SasCam Webcam Server 2.6.5 allows remote

50RISK

open ↗

Referência

CVE-2008-3371

CVE-2008-3371—

Directory traversal vulnerability in install/help.php in TalkBack 2.3.5, and other versions before 2.3.6.2, allows remot

23RISK

open ↗

Referência

CVE-2016-7224

CVE-2016-7224—

Virtual Hard Disk Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 151

23RISK

open ↗

Referência

CVE-2018-11412

CVE-2018-11412—

In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untruste

28RISK

open ↗

Referência

CVE-2018-11509

CVE-2018-11509—

ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applicat

28RISK

open ↗

Referência✓ VexDay Proof

Bubla 1.0.0rc2 - '/bu/process.php' Remote File Inclusion

CVE-2006-6809—webappsphp

Multiple PHP remote file inclusion vulnerabilities in process.php in Vladimir Menshakov buratinable templator (aka bubla

23RISK

open ↗

Referência

CVE-2016-7225

CVE-2016-7225—

Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to

23RISK

open ↗

Referência

CVE-2026-90953

CVE-2026-90953MEDIUM

Image Optimizer by Elementor < 1.7.7 - Subscriber+ Attachment Metadata and Site Statistics Disclosure via Discarded REST Permission Callbacks

33RISK

open ↗

Referência✓ VexDay Proof

My PHP Indexer 1.0 - 'index.php' Local File Download

CVE-2008-6183—webappsphp

Multiple directory traversal vulnerabilities in index.php in My PHP Indexer 1.0 allow remote attackers to read arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

2532/Gigs 1.2.2 Stable - Multiple Vulnerabilities

CVE-2008-6902—webappsphp

Unrestricted file upload vulnerability in upload_flyer.php in 2532designs 2532|Gigs 1.2.2 Stable allows remote attackers

23RISK

open ↗

Referência

CVE-2010-4940

CVE-2010-4940—

SQL injection vulnerability in index.php in WAnewsletter 2.1.2 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2013-4900

CVE-2013-4900—

Directory traversal vulnerability in DeWeS web server 0.4.2 and possibly earlier, as used in Twilight CMS, allows remote

23RISK

open ↗

Referência

CVE-2012-4260

CVE-2012-4260—

Multiple SQL injection vulnerabilities in myCare2x allow remote attackers to execute arbitrary SQL commands via the (1)

23RISK

open ↗

Referência✓ VexDay Proof

Bubla 0.9.2 - 'bu_dir' Multiple Remote File Inclusions

CVE-2006-6867—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Vladimir Menshakov buratinable templator (aka bubla) 0.9.1 allow r

23RISK

open ↗

Referência

CVE-2023-33440

CVE-2023-33440HIGH

Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_u

61RISK

open ↗

Referência

CVE-2015-7568

CVE-2015-7568—

SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the a

23RISK

open ↗

Referência

CVE-2007-3703

CVE-2007-3703—

Stack-based buffer overflow in a certain ActiveX control in sasatl.dll 1.5.0.531 in Zenturi Program Checker (ProgramChec

23RISK

open ↗

Referência

CVE-2018-0743

CVE-2018-0743—

Windows Subsystem for Linux in Windows 10 version 1703, Windows 10 version 1709, and Windows Server, version 1709 allows

23RISK

open ↗

Referência

CVE-2012-6522

CVE-2012-6522—

Directory traversal vulnerability in the getContent function in codes/wcms.php in w-CMS 2.01 allows remote attackers to

23RISK

open ↗

Referência

CVE-2026-96899

CVE-2026-96899MEDIUM

Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

33RISK

open ↗

Referência

CVE-2013-1803

CVE-2013-1803—

Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência

CVE-2026-96897

CVE-2026-96897MEDIUM

Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache

33RISK

open ↗

Referência✓ VexDay Proof

MailEnable 3.13 SMTP Service - 'VRFY/EXPN' Denial of Service

CVE-2008-1275—doswindows

Multiple unspecified vulnerabilities in the SMTP service in MailEnable Standard Edition 1.x, Professional Edition 3.x an

23RISK

open ↗

Referência

CVE-2015-7568

CVE-2015-7568—

SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the a

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.