Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,634cataloged exploits
40,286CVEs with public exploitation
24,696lab-tested
AllReferência 26,110Exploit-DB 24,488GitHub PoC 17,941VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,110 exploits
Referência
CVE-2014-8361
CVE-2014-8361CRITICALunder attack
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClien
100RISK
open ↗
Referência
CVE-2016-4808
CVE-2016-4808—
Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attack
23RISK
open ↗
Referência
CVE-2021-40539
CVE-2021-40539CRITICALunder attackransomware
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resulta
100RISK
open ↗
Referência
CVE-2019-3929
CVE-2019-3929CRITICALunder attack
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Ba
100RISK
open ↗
Referência
CVE-2026-109176
CVE-2026-109176MEDIUM
MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files
33RISK
open ↗
Referência
CVE-2026-19934
CVE-2026-19934MEDIUM
itsourcecode Hospital Management System vieworder.php sql injection
33RISK
open ↗
Referência
CVE-2019-25676
CVE-2019-25676HIGH
Ask Expert Script 3.0.5 Cross Site Scripting SQL Injection
41RISK
open ↗
Referência
CVE-2017-8489
CVE-2017-8489—
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,
23RISK
open ↗
Referência
CVE-2026-109175
CVE-2026-109175MEDIUM
MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList
33RISK
open ↗
Referência✓ VexDay Proof
DoSePa 1.0.4 - 'textview.php' Information Disclosure
CVE-2006-6028—webappsphp
Directory traversal vulnerability in textview.php in Anton Vlasov DoSePa 1.0.4 allows remote attackers to read arbitrary
23RISK
open ↗
Referência
CVE-2009-2441
CVE-2009-2441—
Cross-site scripting (XSS) vulnerability in ogp_show.php in Online Guestbook Pro 5.1 allows remote attackers to inject a
23RISK
open ↗
Referência
CVE-2017-8537
CVE-2017-8537—
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Serve
28RISK
open ↗
Referência
CVE-2009-2477
CVE-2009-2477—
js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1
50RISK
open ↗
Referência
CVE-2009-4697
CVE-2009-4697—
Multiple cross-site scripting (XSS) vulnerabilities in index.php in RadNICS Gold 5 allow remote attackers to inject arbi
23RISK
open ↗
Referência
CVE-2017-9791
CVE-2017-9791CRITICALunder attack
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passe
100RISK
open ↗
Referência
CVE-2018-15473
CVE-2018-15473MEDIUM
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
70RISK
open ↗
Referência
CVE-2026-14760
CVE-2026-14760MEDIUM
radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free
33RISK
open ↗
Referência
CVE-2023-27100
CVE-2023-27100CRITICAL
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22
48RISK
open ↗
Referência
CVE-2026-14759
CVE-2026-14759MEDIUM
radareorg radare2 RBinJava Line Number Table class.c r_bin_java_inner_classes_attr_calc_size heap-based overflow
33RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke NukeAI Module 3b - 'util.php' Remote File Inclusion
CVE-2006-6202—webappsphp
PHP remote file inclusion vulnerability in modules/NukeAI/util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Pro
23RISK
open ↗
Referência✓ VexDay Proof
S9Y Serendipity 1.0.3 - 'comment.php' Local File Inclusion
CVE-2006-6242—webappsphp
Multiple directory traversal vulnerabilities in Serendipity 1.0.3 and earlier allow remote attackers to read or include
23RISK
open ↗
Referência
CVE-2026-108819
CVE-2026-108819MEDIUM
agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources
33RISK
open ↗
Referência✓ VexDay Proof
HomePH Design 2.10 RC2 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2008-2982—webappsphp
Multiple directory traversal vulnerabilities in HomePH Design 2.10 RC2, when register_globals is enabled, allow remote a
23RISK
open ↗
Referência
CVE-2026-108812
CVE-2026-108812MEDIUM
SEMCMS SEMCMS_User.php user improper authorization
33RISK
open ↗
Referência
CVE-2012-3152
CVE-2012-3152CRITICALunder attack
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and
100RISK
open ↗
Referência✓ VexDay Proof
Bea Weblogic Apache Connector - Code Execution / Denial of Service
CVE-2008-3257—remotewindows
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10
60RISK
open ↗
Referência✓ VexDay Proof
Miniweb 2.0 - Authentication Bypass
CVE-2008-6582—webappsphp
SQL injection vulnerability in index.php in Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
2WIRE DSL Router - 'xslt' Denial of Service
CVE-2008-6605—doshardware
Cross-site request forgery (CSRF) vulnerability in the xslt script in the web-based management interface on the 2wire 17
23RISK
open ↗
Referência
CVE-2026-89299
CVE-2026-89299HIGH
WP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter
41RISK
open ↗
Referência
CVE-2026-14689
CVE-2026-14689MEDIUM
CodeAstro Apartment Visitor Management System add-apartment.php sql injection
33RISK
open ↗
← previouspage 246 / 871next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.