Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,150 exploits
Referência
CVE-2010-4269
CVE-2010-4269—
SQL injection vulnerability in managechat.php in Collabtive 0.65 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência
CVE-2026-92810
CVE-2026-92810MEDIUM
PrestaShop blockwishlist through 3.0.2 Information Disclosure
33RISK
open ↗
Referência
CVE-2026-92809
CVE-2026-92809MEDIUM
PrestaShop psgdpr through 1.4.3 GDPR Log Forgery
33RISK
open ↗
Referência
CVE-2010-4269
CVE-2010-4269—
SQL injection vulnerability in managechat.php in Collabtive 0.65 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
e-Ark 1.0 - '/src/ark_inc.php' Remote File Inclusion
CVE-2006-6086—webappsphp
PHP remote file inclusion vulnerability in src/ark_inc.php in e-Ark 1.0 allows remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência
CVE-2026-109165
CVE-2026-109165MEDIUM
TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create
33RISK
open ↗
Referência
CVE-2026-108827
CVE-2026-108827LOW
Zen Cart Administrative Module Management general.php zen_call_function code injection
28RISK
open ↗
Referência✓ VexDay Proof
Arctic Issue Tracker 2.0.0 - 'filter' SQL Injection (1)
CVE-2008-3250—webappsphp
SQL injection vulnerability in index.php in Arctic Issue Tracker 2.0.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2009-2479
CVE-2009-2479—
Mozilla Firefox 3.0.x, 3.5, and 3.5.1 on Windows allows remote attackers to cause a denial of service (uncaught exceptio
28RISK
open ↗
Referência
CVE-2009-4721
CVE-2009-4721—
Multiple SQL injection vulnerabilities in Admin/index.asp in Andrews-Web (A-W) BannerAd 1.0 allow remote attackers to ex
23RISK
open ↗
Referência
CVE-2018-15473
CVE-2018-15473MEDIUM
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
70RISK
open ↗
Referência
CVE-2026-14760
CVE-2026-14760MEDIUM
radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free
33RISK
open ↗
Referência
CVE-2023-27100
CVE-2023-27100CRITICAL
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22
48RISK
open ↗
Referência
CVE-2026-14759
CVE-2026-14759MEDIUM
radareorg radare2 RBinJava Line Number Table class.c r_bin_java_inner_classes_attr_calc_size heap-based overflow
33RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke NukeAI Module 3b - 'util.php' Remote File Inclusion
CVE-2006-6202—webappsphp
PHP remote file inclusion vulnerability in modules/NukeAI/util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Pro
23RISK
open ↗
Referência✓ VexDay Proof
S9Y Serendipity 1.0.3 - 'comment.php' Local File Inclusion
CVE-2006-6242—webappsphp
Multiple directory traversal vulnerabilities in Serendipity 1.0.3 and earlier allow remote attackers to read or include
23RISK
open ↗
Referência
CVE-2026-108819
CVE-2026-108819MEDIUM
agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources
33RISK
open ↗
Referência✓ VexDay Proof
HomePH Design 2.10 RC2 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2008-2982—webappsphp
Multiple directory traversal vulnerabilities in HomePH Design 2.10 RC2, when register_globals is enabled, allow remote a
23RISK
open ↗
Referência
CVE-2026-108812
CVE-2026-108812MEDIUM
SEMCMS SEMCMS_User.php user improper authorization
33RISK
open ↗
Referência
CVE-2012-3152
CVE-2012-3152CRITICALunder attack
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and
100RISK
open ↗
Referência✓ VexDay Proof
Bea Weblogic Apache Connector - Code Execution / Denial of Service
CVE-2008-3257—remotewindows
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10
60RISK
open ↗
Referência✓ VexDay Proof
Miniweb 2.0 - Authentication Bypass
CVE-2008-6582—webappsphp
SQL injection vulnerability in index.php in Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
2WIRE DSL Router - 'xslt' Denial of Service
CVE-2008-6605—doshardware
Cross-site request forgery (CSRF) vulnerability in the xslt script in the web-based management interface on the 2wire 17
23RISK
open ↗
Referência
CVE-2026-89299
CVE-2026-89299HIGH
WP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter
41RISK
open ↗
Referência
CVE-2026-14689
CVE-2026-14689MEDIUM
CodeAstro Apartment Visitor Management System add-apartment.php sql injection
33RISK
open ↗
Referência
CVE-2026-14688
CVE-2026-14688MEDIUM
itsourcecode Online Hotel Management System login.php sql injection
33RISK
open ↗
Referência
CVE-2026-89213
CVE-2026-89213HIGH
Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter
41RISK
open ↗
Referência✓ VexDay Proof
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH
CVE-2008-3280—remotelinux
It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Deb
23RISK
open ↗
Referência✓ VexDay Proof
Phorum 3.2.11 - 'common.php' Remote File Inclusion
CVE-2006-6550—webappsphp
PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2026-14687
CVE-2026-14687MEDIUM
666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison
33RISK
open ↗
← previouspage 263 / 872next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.