Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,634cataloged exploits
40,286CVEs with public exploitation
24,696lab-tested
AllReferência 26,110Exploit-DB 24,488GitHub PoC 17,941VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,110 exploits
Referência
CVE-2022-37061
CVE-2022-37061—
All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This
60RISK
open ↗
Referência✓ VexDay Proof
Back-End CMS 0.7.2.2 - 'BE_config.php' Remote File Inclusion
CVE-2006-2682—webappsphp
PHP remote file inclusion vulnerability in BE_config.php in Back-End CMS 0.7.2.1 and earlier allows remote attackers to
23RISK
open ↗
Referência
CVE-2015-20128
CVE-2015-20128HIGH
FooSun DotNetCMS 1.0 / 2.0 SQL Injection via City_ajax.aspx
41RISK
open ↗
Referência✓ VexDay Proof
AssoCIateD CMS 1.1.3 - 'ROOT_PATH' Remote File Inclusion
CVE-2006-2841—webappsphp
Multiple PHP remote file inclusion vulnerabilities in AssoCIateD (aka ACID) CMS 1.1.3 allow remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Redaxo 3.2 - 'INCLUDE_PATH' Remote File Inclusion
CVE-2006-2844—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code vi
23RISK
open ↗
Referência✓ VexDay Proof
phpAddressBook 2.11 - Multiple Local File Inclusions
CVE-2008-1492—webappsphp
Multiple directory traversal vulnerabilities in CoronaMatrix phpAddressBook 2.11 allow remote attackers to include and e
23RISK
open ↗
Referência
CVE-2015-20125
CVE-2015-20125HIGH
Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php
41RISK
open ↗
Referência
CVE-2014-125133
CVE-2014-125133HIGH
NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php
41RISK
open ↗
Referência
CVE-2012-20003
CVE-2012-20003MEDIUM
Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php
33RISK
open ↗
Referência
CVE-2026-113411
CVE-2026-113411MEDIUM
Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme
33RISK
open ↗
Referência
CVE-2026-113394
CVE-2026-113394MEDIUM
DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal
33RISK
open ↗
Referência✓ VexDay Proof
BulletProof FTP Client 2009 - '.bps' Local Buffer Overflow (SEH)
CVE-2008-5754—localwindows
Stack-based buffer overflow in BulletProof FTP Client allows user-assisted attackers to execute arbitrary code via a .bp
23RISK
open ↗
Referência✓ VexDay Proof
Pragyan CMS 2.6.4 - Multiple SQL Injections
CVE-2009-1480—webappsphp
SQL injection vulnerability in index.php Pragyan CMS 2.6.4 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
Flatchat 3.0 - 'pmscript.php' Local File Inclusion
CVE-2009-1486—webappsphp
Directory traversal vulnerability in pmscript.php in Flatchat 3.0 allows remote attackers to include and execute arbitra
23RISK
open ↗
Referência
CVE-2012-1790
CVE-2012-1790—
Absolute path traversal vulnerability in Webgrind 1.0 and 1.0.2 allows remote attackers to read arbitrary files via a fu
23RISK
open ↗
Referência✓ VexDay Proof
fungamez rc1 - Authentication Bypass / Local File Inclusion
CVE-2009-1488—webappsphp
Directory traversal vulnerability in admin/load.php in FunGamez RC1 allows remote attackers to include and execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
fungamez rc1 - Authentication Bypass / Local File Inclusion
CVE-2009-1489—webappsphp
includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by set
23RISK
open ↗
Referência
CVE-2026-112100
CVE-2026-112100MEDIUM
DeepPavlov multitask_preprocessor.py MultiTaskPipelinePreprocessor.__init__ code injection
33RISK
open ↗
Referência
CVE-2022-4395
CVE-2022-4395CRITICAL
Membership For WooCommerce < 2.1.7 - Unauthenticated Arbitrary File Upload
53RISK
open ↗
Referência✓ VexDay Proof
DZCP (deV!L_z Clanportal) 1.34 - 'id' SQL Injection
CVE-2006-3347—webappsphp
SQL injection vulnerability in index.php in deV!Lz Clanportal DZCP 1.3.4 allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
Prozilla Forum Service - 'forum' SQL Injection
CVE-2008-1789—webappsphp
SQL injection vulnerability in forum.php in Prozilla Forum allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2017-12635
CVE-2017-12635—
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB be
60RISK
open ↗
Referência
CVE-2026-112093
CVE-2026-112093MEDIUM
subhajitkhan online-clinic-management-system feedback.php cross site scripting
33RISK
open ↗
Referência
CVE-2022-44877
CVE-2022-44877CRITICALunder attack
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execut
100RISK
open ↗
Referência✓ VexDay Proof
XnView 1.93.6 - '.taac' Local Buffer Overflow
CVE-2008-2427—localwindows
Stack-based buffer overflow in NConvert 4.92, GFL SDK 2.82, and XnView 1.93.6 on Windows and 1.70 on Linux and FreeBSD a
28RISK
open ↗
Referência✓ VexDay Proof
DELTAScripts PHP Classifieds 7.5 - SQL Injection
CVE-2008-5805—webappsphp
SQL injection vulnerability in detail.php in DeltaScripts PHP Classifieds 7.5 and earlier allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Grabit 1.7.2 Beta 3 - '.nzb' Local Buffer Overflow (SEH)
CVE-2009-1586—localwindows
Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2026-15209
CVE-2026-15209MEDIUM
JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR
33RISK
open ↗
Referência✓ VexDay Proof
FlushCMS 1.0.0-pre2 - 'class.rich.php' Remote File Inclusion
CVE-2006-3754—webappsphp
PHP remote file inclusion vulnerability in Include/editor/rich_files/class.rich.php in FlushCMS 1.0.0-pre2 and earlier a
23RISK
open ↗
Referência✓ VexDay Proof
MD-Pro 1.0.76 - SQL Injection
CVE-2007-5222—webappsphp
SQL injection vulnerability in index.php in MAXdev MDPro (MD-Pro) 1.0.76 allows remote attackers to execute arbitrary SQ
23RISK
open ↗
← previouspage 248 / 871next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.