Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,150 exploits
Referência✓ VexDay Proof
MKPortal 1.1.1 reviews / Gallery modules - SQL Injection
CVE-2007-3814—webappsphp
Multiple SQL injection vulnerabilities in MKPortal 1.1.1 allow remote attackers to execute arbitrary SQL commands via (1
23RISK
open ↗
Referência✓ VexDay Proof
Vigile CMS 1.4 - Multiple Vulnerabilities
CVE-2007-6085—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in index.php in VigileCMS 1.4 allow remote attackers to inject arbit
23RISK
open ↗
Referência✓ VexDay Proof
BibCiter 1.4 - Multiple SQL Injections
CVE-2009-0324—webappsphp
Multiple SQL injection vulnerabilities in BibCiter 1.4 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2010-1949
CVE-2010-1949—
SQL injection vulnerability in the Online News Paper Manager (com_jnewspaper) component 1.0 for Joomla! allows remote at
23RISK
open ↗
Referência
CVE-2017-0284
CVE-2017-0284—
Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT
23RISK
open ↗
Referência
CVE-2014-9322
CVE-2014-9322—
arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack S
23RISK
open ↗
Referência
CVE-2015-7566
CVE-2015-7566—
The clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel through 4.4.1 allows physically proximate a
23RISK
open ↗
Referência
CVE-2026-58057
CVE-2026-58057LOW
Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity
28RISK
open ↗
Referência✓ VexDay Proof
bwired - 'index.php?newsID' SQL Injection
CVE-2007-3978—webappsphp
Session fixation vulnerability in bwired allows remote attackers to hijack web sessions by setting the PHPSESSID paramet
23RISK
open ↗
Referência✓ VexDay Proof
mm chat 1.5 - Local File Inclusion / Cross-Site Scripting
CVE-2008-2973—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in chathead.php in MM Chat 1.5 allow remote attackers to inject arbi
23RISK
open ↗
Referência
CVE-2013-6852
CVE-2013-6852—
Cross-site request forgery (CSRF) vulnerability in html/json.html on HP 2620 switches allows remote attackers to hijack
23RISK
open ↗
Referência✓ VexDay Proof
phpdaily - SQL Injection / Cross-Site Scripting / Local File Download
CVE-2008-4756—webappsphp
Cross-site scripting (XSS) vulnerability in add_prest_date.php in PHP-Daily allows remote attackers to inject arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Butterfly ORGanizer 2.0.0 - SQL Injection / Cross-Site Scripting
CVE-2008-6700—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Butterfly Organizer 2.0.0 allow remote attackers to inject arbitr
23RISK
open ↗
Referência
CVE-2009-4869
CVE-2009-4869—
Cross-site scripting (XSS) vulnerability in index.php in Nasim Guest Book 1.2 allows remote attackers to inject arbitrar
23RISK
open ↗
Referência
CVE-2009-3530
CVE-2009-3530—
Cross-site scripting (XSS) vulnerability in storefront.php in RadScripts RadBids Gold 4 allows remote attackers to injec
23RISK
open ↗
Referência
CVE-2010-2143
CVE-2010-2143—
Directory traversal vulnerability in index.php in Symphony CMS 2.0.7 allows remote attackers to read arbitrary files and
23RISK
open ↗
Referência
CVE-2010-4877
CVE-2010-4877—
Cross-site scripting (XSS) vulnerability in index.php in OneCMS 2.6.1 allows remote attackers to inject arbitrary web sc
23RISK
open ↗
Referência
CVE-2010-4909
CVE-2010-4909—
Multiple cross-site scripting (XSS) vulnerabilities in PaysiteReviewCMS 1.1 allow remote attackers to inject arbitrary w
23RISK
open ↗
Referência
CVE-2017-17111
CVE-2017-17111—
Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-detail
23RISK
open ↗
Referência✓ VexDay Proof
MemHT Portal 4.0.1 - Remote Code Execution
CVE-2009-0372—webappsphp
Unrestricted file upload vulnerability in index.php in Miltenovik Manojlo MemHT Portal 4.0.1 and earlier allows remote a
23RISK
open ↗
Referência
CVE-2009-2391
CVE-2009-2391—
Cross-site scripting (XSS) vulnerability in text.php in Virtuenetz Virtue Online Test Generator allows remote attackers
23RISK
open ↗
Referência
CVE-2010-1954
CVE-2010-1954—
Directory traversal vulnerability in the iNetLanka Multiple root (com_multiroot) component 1.0 and 1.1 for Joomla! allow
43RISK
open ↗
Referência
CVE-2010-1955
CVE-2010-1955—
Directory traversal vulnerability in the Deluxe Blog Factory (com_blogfactory) component 1.1.2 for Joomla! allows remote
43RISK
open ↗
Referência✓ VexDay Proof
PHP 5.2.3 - 'PHP_gd2.dll' imagepsloadfont Local Buffer Overflow (PoC)
CVE-2007-4033—doswindows
Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent at
28RISK
open ↗
Referência
CVE-2008-6924
CVE-2008-6924—
Multiple cross-site scripting (XSS) vulnerabilities in register.php in eSyndiCat Directory 2.2 allow remote attackers to
23RISK
open ↗
Referência
CVE-2009-4464
CVE-2009-4464—
Cross-site scripting (XSS) vulnerability in searchadvance.asp in Active Business Directory 2 allows remote attackers to
23RISK
open ↗
Referência
CVE-2009-4684
CVE-2009-4684—
Cross-site scripting (XSS) vulnerability in index.php in EZodiak allows remote attackers to inject arbitrary web script
23RISK
open ↗
Referência
CVE-2026-8385
CVE-2026-8385MEDIUM
WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback
48RISK
open ↗
Referência
CVE-2026-12216
CVE-2026-12216MEDIUM
svaarala duktape duk_api_bytecode.c memory corruption
33RISK
open ↗
Referência
CVE-2010-2156
CVE-2010-2156—
ISC DHCP 4.1 before 4.1.1-P1 and 4.0 before 4.0.2-P1 allows remote attackers to cause a denial of service (server exit)
60RISK
open ↗
← previouspage 249 / 872next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.