Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,634cataloged exploits
40,286CVEs with public exploitation
24,696lab-tested
AllReferência 26,110Exploit-DB 24,488GitHub PoC 17,941VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,110 exploits
Referência✓ VexDay Proof
PHPwebnews 0.2 MySQL Edition - 'det' SQL Injection
SQL injection vulnerability in bukutamu.php in phpWebNews 0.2 MySQL Edition allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component SimpleBoard 1.0.1 - Arbitrary File Upload
Unrestricted file upload vulnerability in image_upload.php in the SimpleBoard (com_simpleboard) component 1.0.1 and earl
23RISK
open ↗Referência
CVE-2014-8948
Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows re
23RISK
open ↗Referência
CVE-2015-1060
Open redirect vulnerability in lib/Cake/Controller/Controller.php in AdaptCMS 3.0.3 allows remote attackers to redirect
23RISK
open ↗Referência
CVE-2014-9440
SQL injection vulnerability in browse.php in phpMyRecipes 1.2.2 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência
CVE-2026-86776
KeePass 2.35 through 2.61.1 Memory Exhaustion via KDBX Header Field Size
33RISK
open ↗Referência
CVE-2023-38035
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an
100RISK
open ↗Referência
CVE-2026-85117
Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
33RISK
open ↗Referência✓ VexDay Proof
TuMusika Evolution 1.7R5 - Remote File Disclosure
Multiple directory traversal vulnerabilities in TuMusika Evolution 1.7R5 allow remote attackers to include and execute a
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component Recipes 1.00 - 'id' SQL Injection
SQL injection vulnerability in index.php in the Recipes (com_recipes) 1.00 component for Mambo and Joomla! allows remote
23RISK
open ↗Referência✓ VexDay Proof
EPShop < 3.0 - 'pid' SQL Injection
SQL injection vulnerability in Comsenz EPShop (aka ECShop) before 3.0 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência
CVE-2008-6887
SQL injection vulnerability in detailad.asp in Pre Classified Listings 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗Referência
CVE-2013-2754
Cross-site request forgery (CSRF) vulnerability in Umisoft UMI.CMS before 2.9 build 21905 allows remote attackers to hij
23RISK
open ↗Referência
CVE-2013-2945
SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to
23RISK
open ↗Referência
CVE-2021-46381
Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd]
50RISK
open ↗Referência
CVE-2026-85137
SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection
33RISK
open ↗Referência
CVE-2026-71624
An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class
48RISK
open ↗Referência
CVE-2026-82884
All in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block
33RISK
open ↗Referência✓ VexDay Proof
LoveCMS 1.6.2 Final - Update Settings
LoveCMS 1.6.2 does not require administrative authentication for (1) addblock.php, (2) blocks.php, and (3) themes.php in
23RISK
open ↗Referência✓ VexDay Proof
Getleft 1.2 - Remote Buffer Overflow (PoC)
Multiple buffer overflows in Getleft.exe in Andres Garcia Getleft 1.2 allow remote attackers to cause a denial of servic
23RISK
open ↗Referência✓ VexDay Proof
2532/Gigs 1.2.2 Stable - Remote Authentication Bypass
Multiple SQL injection vulnerabilities in checkuser.php in 2532designs 2532|Gigs 1.2.2 Stable, when magic_quotes_gpc is
23RISK
open ↗Referência✓ VexDay Proof
Zeeways ZeeJobsite 2.0 - Arbitrary File Upload
Unrestricted file upload vulnerability in editresume_next.php in Zeeways ZEEJOBSITE 2.0 allows remote authenticated user
23RISK
open ↗Referência✓ VexDay Proof
TaskDriver 1.3 - Remote Change Admin Password
profileedit.php TaskDriver 1.3 and earlier allows remote attackers to bypass authentication and gain administrative acce
23RISK
open ↗Referência
CVE-2014-9583
common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC
60RISK
open ↗Referência
CVE-2020-10189
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted d
100RISK
open ↗Referência
CVE-2021-3129
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra
100RISK
open ↗Referência
CVE-2021-3129
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra
100RISK
open ↗Referência✓ VexDay Proof
Xerox Phaser 8400 - Remote Reboot (Denial of Service)
The Xerox Phaser 8400 allows remote attackers to cause a denial of service (reboot) via an empty UDP packet to port 1900
35RISK
open ↗Referência
CVE-2014-9641
The tmeext.sys driver before 2.0.0.1015 in Trend Micro Antivirus Plus, Internet Security, and Maximum Security allows lo
23RISK
open ↗Referência
CVE-2026-86674
ningzichun Student Management System login.php session_start session fixiation
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.