Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,634cataloged exploits
40,286CVEs with public exploitation
24,696lab-tested
AllReferência 26,110Exploit-DB 24,488GitHub PoC 17,941VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,110 exploits
Referência
CVE-2025-34110
CVE-2025-34110CRITICAL
ColoradoFTP Server <= 1.3 Build 8 Path Traversal Information Disclosure
63RISK
open ↗
Referência
CVE-2025-34110
CVE-2025-34110CRITICAL
ColoradoFTP Server <= 1.3 Build 8 Path Traversal Information Disclosure
63RISK
open ↗
Referência
CVE-2005-3686
CVE-2005-3686—
SQL injection vulnerability in search.inc.php in Unclassified NewsBoard before 1.5.3 Patch 4 allows remote attackers to
23RISK
open ↗
Referência
CVE-2026-55391
CVE-2026-55391HIGH
datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
41RISK
open ↗
Referência
CVE-2025-2907
CVE-2025-2907CRITICAL
Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update
63RISK
open ↗
Referência
CVE-2023-3048
CVE-2023-3048CRITICAL
IDOR in TMT's Lockcell
48RISK
open ↗
Referência
CVE-2026-14821
CVE-2026-14821LOW
Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion
28RISK
open ↗
Referência
CVE-2011-1100
CVE-2011-1100—
Multiple SQL injection vulnerabilities in admin/index.php in Pixelpost 1.7.3 allow remote authenticated users to execute
23RISK
open ↗
Referência
CVE-2015-8421
CVE-2015-8421—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and
35RISK
open ↗
Referência✓ VexDay Proof
Invision Power Board 2.1 < 2.1.6 - SQL Injection (1)
CVE-2006-7071—webappsphp
SQL injection vulnerability in classes/class_session.php in Invision Power Board (IPB) 2.1 up to 2.1.6 allows remote att
23RISK
open ↗
Referência
CVE-2026-108611
CVE-2026-108611MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint
33RISK
open ↗
Referência✓ VexDay Proof
GlobalLink 2.7.0.8 - 'glItemCom.dll SetInfo()' Heap Overflow
CVE-2007-4802—remotewindows
Multiple heap-based buffer overflows in GlobalLink 2.7.0.8 allow remote attackers to execute arbitrary code via (1) a lo
23RISK
open ↗
Referência
CVE-2010-2510
CVE-2010-2510—
SQL injection vulnerability in customize.php in 2daybiz Web Template Software allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2009-4791
CVE-2009-4791—
Multiple SQL injection vulnerabilities in Family Connections (aka FCMS) before 1.8.2 allow remote attackers to execute a
23RISK
open ↗
Referência
CVE-2026-104653
CVE-2026-104653MEDIUM
Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions
33RISK
open ↗
Referência
CVE-2014-9445
CVE-2014-9445—
SQL injection vulnerability in incl/create.inc.php in Installatron GQ File Manager 0.2.5 allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2026-86233
CVE-2026-86233MEDIUM
itsourcecode Sales and Inventory System us_del.php sql injection
33RISK
open ↗
Referência
CVE-2015-4658
CVE-2015-4658—
Multiple SQL injection vulnerabilities in admin/login.php in Milw0rm Clone Script 1.0 allow remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
PHPRaid < 3.0.7 - 'rss.php?PHPraid_dir' Remote File Inclusion
CVE-2006-3317—webappsphp
PHP remote file inclusion vulnerability in phpRaid 3.0.6 allows remote attackers to execute arbitrary code via a URL in
28RISK
open ↗
Referência
CVE-2013-6767
CVE-2013-6767—
Stack-based buffer overflow in pepoly.dll in Quick Heal AntiVirus Pro 7.0.0.1 allows local users to execute arbitrary co
23RISK
open ↗
Referência
CVE-2017-2455
CVE-2017-2455—
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS bef
23RISK
open ↗
Referência
CVE-2010-4236
CVE-2010-4236—
Untrusted search path vulnerability in estaskwrapper in IBM OmniFind Enterprise Edition before 9.1 allows local users to
23RISK
open ↗
Referência
CVE-2013-6767
CVE-2013-6767—
Stack-based buffer overflow in pepoly.dll in Quick Heal AntiVirus Pro 7.0.0.1 allows local users to execute arbitrary co
23RISK
open ↗
Referência✓ VexDay Proof
NetVIOS 2.0 - 'page.asp' SQL Injection
CVE-2006-5954—webappsasp
SQL injection vulnerability in page.asp in NetVIOS 2.0 and earlier allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência
CVE-2026-104652
CVE-2026-104652MEDIUM
Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image ID
33RISK
open ↗
Referência✓ VexDay Proof
vBulletin 3.6.4 - 'inlinemod.php?postids' SQL Injection
CVE-2007-1292—webappsphp
SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, mi
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft SQL Server - Distributed Management Objects 'sqldmo.dll' Buffer Overflow (PoC)
CVE-2007-4814—doswindows
Buffer overflow in the SQLServer ActiveX control in the Distributed Management Objects OLE DLL (sqldmo.dll) 2000.085.200
35RISK
open ↗
Referência
CVE-2010-2674
CVE-2010-2674—
SQL injection vulnerability in index.php in TSOKA:CMS 1.1, 1.9, and 2.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2010-2676
CVE-2010-2676—
Multiple directory traversal vulnerabilities in index.php in Open Web Analytics (OWA) 1.2.3 might allow remote attackers
23RISK
open ↗
Referência
CVE-2026-10220
CVE-2026-10220MEDIUM
NousResearch hermes-agent skills_tool.py skill_view injection
33RISK
open ↗
← previouspage 241 / 871next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.