Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,150 exploits
Referência✓ VexDay Proof
PowerPoint Viewer OCX 3.2 - ActiveX Control Denial of Service
CVE-2007-2494—doswindows
Multiple stack-based buffer overflows in the PowerPointOCX ActiveX control in PowerPointViewer.ocx 3.1.0.3 allow remote
23RISK
open ↗
Referência
CVE-2026-101052
CVE-2026-101052MEDIUM
refly-ai refly JWT Token app.config.ts hard-coded credentials
33RISK
open ↗
Referência
CVE-2026-86716
CVE-2026-86716MEDIUM
Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow
33RISK
open ↗
Referência
CVE-2012-10038
CVE-2012-10038CRITICAL
Auxilium RateMyPet Arbitrary File Upload RCE
63RISK
open ↗
Referência✓ VexDay Proof
Kmita Tellfriend 2.0 - 'file' Remote File Inclusion
CVE-2008-2198—webappsphp
PHP remote file inclusion vulnerability in kmitaadmin/kmitat/htmlcode.php in Kmita Tellfriend 2.0 and earlier, when regi
23RISK
open ↗
Referência✓ VexDay Proof
PortalApp 4.0 - SQL Injection / Cross-Site Scripting / Authentication Bypass
CVE-2008-4613—webappsasp
SQL injection vulnerability in forums.asp in PortalApp 4.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
eSHOP100 - 'SUB' SQL Injection
CVE-2008-5190—webappsphp
SQL injection vulnerability in index.php in eSHOP100 allows remote attackers to execute arbitrary SQL commands via the S
23RISK
open ↗
Referência✓ VexDay Proof
OpenX 2.6 - 'bannerid' Blind SQL Injection
CVE-2008-6163—webappsphp
SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência
CVE-2010-1043
CVE-2010-1043—
Directory traversal vulnerability in index.php in jaxCMS 1.0 allows remote attackers to include and execute arbitrary lo
23RISK
open ↗
Referência
CVE-2010-2336
CVE-2010-2336—
index.php in Yamamah Photo Gallery 1.00 allows remote attackers to obtain the source code of executable files within the
23RISK
open ↗
Referência
CVE-2010-2920
CVE-2010-2920—
Directory traversal vulnerability in the Foobla Suggestions (com_foobla_suggestions) component 1.5.1.2 for Joomla! allow
38RISK
open ↗
Referência
CVE-2010-3742
CVE-2010-3742—
Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Free Simple CMS 1.0 allow remote attac
23RISK
open ↗
Referência
CVE-2012-0932
CVE-2012-0932—
Cross-site scripting (XSS) vulnerability in admin/login.php in Lead Capture Page System allows remote attackers to injec
23RISK
open ↗
Referência
CVE-2009-4683
CVE-2009-4683—
Directory traversal vulnerability in vote.php in Good/Bad Vote allows remote attackers to include and execute arbitrary
23RISK
open ↗
Referência
CVE-2015-7547
CVE-2015-7547—
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
45RISK
open ↗
Referência✓ VexDay Proof
DevelopItEasy Events Calendar 1.2 - Multiple SQL Injections
CVE-2008-6608—webappsphp
Multiple SQL injection vulnerabilities in DevelopItEasy Events Calendar 1.2 allow remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2026-86675
CVE-2026-86675MEDIUM
itsourcecode Sales and Inventory System us_edit.php sql injection
33RISK
open ↗
Referência✓ VexDay Proof
pastelcms 0.8.0 - Local File Inclusion / SQL Injection
CVE-2009-1404—webappsphp
SQL injection vulnerability in admin.php in PastelCMS 0.8.0, when magic_quotes_gpc is disabled, allows remote attackers
23RISK
open ↗
Referência
CVE-2009-3822
CVE-2009-3822—
PHP remote file inclusion vulnerability in Fiji Web Design Ajax Chat (com_ajaxchat) component 1.0 for Joomla! allows rem
23RISK
open ↗
Referência✓ VexDay Proof
UploadImage/UploadScript 1.0 - Remote Change Admin Password
CVE-2008-0245—webappsphp
admin.php in UploadImage 1.0 does not check for the original password before making a change to a new password, which al
23RISK
open ↗
Referência
CVE-2015-4414
CVE-2015-4414—
Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player)
43RISK
open ↗
Referência
CVE-2026-101012
CVE-2026-101012MEDIUM
mathurvishal CloudClassroom-PHP-Project makeresult.php sql injection
33RISK
open ↗
Referência✓ VexDay Proof
CNStats 2.9 - 'who_r.php?bj' Remote File Inclusion
CVE-2007-2086—webappsphp
Multiple PHP remote file inclusion vulnerabilities in CNStats 2.9 allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗
Referência✓ VexDay Proof
Nuked-klaN 1.7.6 - Remote Code Execution
CVE-2007-2556—webappsphp
SQL injection vulnerability in Nuked-klaN 1.7.6 allows remote attackers to execute arbitrary SQL commands via the X-Forw
23RISK
open ↗
Referência✓ VexDay Proof
Flip 3.0 - Remote Admin Creation
CVE-2007-5062—webappsphp
account.php in Adam Scheinberg Flip 3.0 and earlier allows remote attackers to create administrative accounts via the un
23RISK
open ↗
Referência✓ VexDay Proof
Verlihub Control Panel 1.7.x - Local File Inclusion
CVE-2007-5321—webappsphp
Directory traversal vulnerability in index.php in Verlihub Control Panel (VHCP) 1.7 and earlier allows remote attackers
23RISK
open ↗
Referência
CVE-2012-10027
CVE-2012-10027CRITICAL
WordPress Plugin WP-Property <= 1.35.0 PHP File Upload
63RISK
open ↗
Referência
CVE-2012-10027
CVE-2012-10027CRITICAL
WordPress Plugin WP-Property <= 1.35.0 PHP File Upload
63RISK
open ↗
Referência
CVE-2012-10027
CVE-2012-10027CRITICAL
WordPress Plugin WP-Property <= 1.35.0 PHP File Upload
63RISK
open ↗
Referência✓ VexDay Proof
OpenASP 3.0 - Blind SQL Injection
CVE-2008-6257—webappsasp
SQL injection vulnerability in default.asp in Openasp 3.0 and earlier allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
← previouspage 257 / 872next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.