Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
26,190 exploits
Referência
CVE-2015-2097
CVE-2015-2097—
Multiple buffer overflows in WebGate Embedded Standard Protocol (WESP) SDK allow remote attackers to execute arbitrary c
28RISK
open ↗
Referência✓ VexDay Proof
Comodo AntiVirus 2.0 - 'ExecuteStr()' Remote Command Execution
CVE-2008-0470—remotewindows
A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteS
35RISK
open ↗
Referência✓ VexDay Proof
Web Wiz Forums 9.07 - 'sub' Directory Traversal
CVE-2008-0480—webappsasp
Multiple directory traversal vulnerabilities in Web Wiz Forums 9.07 and earlier allow remote attackers to list arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin fGallery 2.4.1 - 'fimrss.php' SQL Injection
CVE-2008-0491—webappsphp
SQL injection vulnerability in fim_rss.php in the fGallery 2.4.1 plugin for WordPress allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Absolute Poll Manager XE 4.1 - 'xlacomments.asp' SQL Injection
CVE-2008-4569—webappsasp
SQL injection vulnerability in xlacomments.asp in XIGLA Software Absolute Poll Manager XE 4.1 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Merak Media Player 3.2 - '.m3u' File Local Buffer Overflow (PoC)
CVE-2009-0350—doswindows
Stack-based buffer overflow in Merak Media Player 3.2 allows remote attackers to execute arbitrary code via a long strin
28RISK
open ↗
Referência✓ VexDay Proof
SiteXS CMS 0.1.1 - Local File Inclusion
CVE-2009-0371—webappsphp
Directory traversal vulnerability in post.php in SiteXS CMS 0.1.1 and earlier allows remote attackers to include and exe
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component ElearningForce Flash Magazine Deluxe - SQL Injection
CVE-2009-0373—webappsphp
SQL injection vulnerability in the ElearningForce Flash Magazine Deluxe (com_flashmagazinedeluxe) component for Joomla!
23RISK
open ↗
Referência✓ VexDay Proof
PLE CMS 1.0 Beta 4.2 - Blind SQL Injection
CVE-2009-0394—webappsphp
SQL injection vulnerability in login.php in Pre Lecture Exercises (PLEs) CMS 1.0 beta 4.2 allows remote attackers to exe
23RISK
open ↗
Referência
CVE-2014-7200
CVE-2014-7200—
Cross-site scripting (XSS) vulnerability in pi1/class.tx_dmmjobcontrol_pi1.php in the JobControl (dmmjobcontrol) extensi
23RISK
open ↗
Referência
CVE-2015-3314
CVE-2015-3314—
SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.
23RISK
open ↗
Referência✓ VexDay Proof
Hummingbird Deployment Wizard 2008 - Registry Values Creation/Change
CVE-2008-4728—remotewindows
Multiple insecure method vulnerabilities in the DeployRun.DeploymentSetup.1 (DeployRun.dll) ActiveX control 10.0.0.44 in
35RISK
open ↗
Referência
CVE-2011-5116
CVE-2011-5116—
SQL injection vulnerability in setseed-hub in SetSeed CMS 5.8.20, 5.11.2, and earlier allows remote attackers to execute
23RISK
open ↗
Referência
CVE-2015-3205
CVE-2015-3205—
libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file,
28RISK
open ↗
Referência
CVE-2015-3301
CVE-2015-3301—
Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce
23RISK
open ↗
Referência
CVE-2015-5477
CVE-2015-5477HIGHunder attack
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (
100RISK
open ↗
Referência
Printix Client 1.3.1106.0 - Privilege Escalation
CVE-2022-25090—localwindows
Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure
28RISK
open ↗
Referência
CVE-2024-13159
CVE-2024-13159CRITICALunder attack
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up
100RISK
open ↗
Referência
CVE-2022-25148
CVE-2022-25148CRITICAL
WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id
85RISK
open ↗
Referência
CVE-2021-34527
CVE-2021-34527HIGHunder attackransomware
Windows Print Spooler Remote Code Execution Vulnerability
100RISK
open ↗
Referência
CVE-2015-5520
CVE-2015-5520—
Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allow
23RISK
open ↗
Referência
CVE-2022-25359
CVE-2022-25359—
On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, dele
35RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Portfol 1.2 - 'vcatid' SQL Injection
CVE-2009-0494—webappsphp
SQL injection vulnerability in the Portfol (com_portfol) 1.2 component for Joomla! allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
SnippetMaster Webpage Editor 2.2.2 - Remote File Inclusion / Cross-Site Scripting
CVE-2009-0529—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in SnippetMaster Webpage Editor 2.2.2 allows remote attackers to i
23RISK
open ↗
Referência✓ VexDay Proof
ZeroShell 1.0beta11 - Remote Code Execution
CVE-2009-0545—remotehardware
cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell meta
60RISK
open ↗
Referência✓ VexDay Proof
Mailist 3.0 - Insecure Backup / Local File Inclusion
CVE-2009-0570—webappsphp
Directory traversal vulnerability in send.php in Ninja Designs Mailist 3.0, when register_globals is enabled and magic_q
23RISK
open ↗
Referência
CVE-2014-8493
CVE-2014-8493—
ZTE ZXHN H108L with firmware 4.0.0d_ZRQ_GR4 allows remote attackers to modify the CWMP configuration via a crafted reque
23RISK
open ↗
Referência
CVE-2014-8493
CVE-2014-8493—
ZTE ZXHN H108L with firmware 4.0.0d_ZRQ_GR4 allows remote attackers to modify the CWMP configuration via a crafted reque
23RISK
open ↗
Referência
CVE-2015-3036
CVE-2015-3036—
Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in c
28RISK
open ↗
Referência
CVE-2026-8759
CVE-2026-8759MEDIUM
xiandafu beetl SpELFunction SpELFunction.java expression language injection
33RISK
open ↗
← previouspage 264 / 873next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.