Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
Popcorn 1.87 - Remote Heap Overflow (PoC)
Heap-based buffer overflow in popcorn.exe in Ultrafunk Popcorn 1.87 allows remote POP3 servers to cause a denial of serv
23RISK
open ↗Referência
CVE-2009-3760
Static code injection vulnerability in config/writeconfig.php in the sample code in the XenServer Resource Kit in Citrix
23RISK
open ↗Referência
CVE-2015-5133
Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR
35RISK
open ↗Referência
CVE-2010-1475
Directory traversal vulnerability in the Preventive & Reservation (com_preventive) component 1.0.5 for Joomla! allows re
38RISK
open ↗Referência
CVE-2012-1047
Directory traversal vulnerability in the WWWHELP Service (js/html/wwhelp.htm) in Cyberoam Central Console (CCC) 2.00.2 a
23RISK
open ↗Referência
CVE-2015-2520
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer a
28RISK
open ↗Referência
CVE-2026-91781
GNU Binutils ELF Section elf64-x86-64.c elf_x86_64_common_section_index null pointer dereference
33RISK
open ↗Referência
CVE-2012-6038
admin/core/admin_func.php in razorCMS before 1.2.1 does not properly restrict access to certain administrator directorie
23RISK
open ↗Referência
CVE-2019-10716
An Information Disclosure issue in Verodin Director 3.5.3.1 and earlier reveals usernames and passwords of integrated se
23RISK
open ↗Referência
CVE-2014-2022
SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier a
23RISK
open ↗Referência✓ VexDay Proof
Company WebSite Builder PRO 1.9.8 - 'INCLUDE_PATH' Remote File Inclusion
PHP remote file inclusion vulnerability in comanda.php in GraFX Company WebSite Builder (CWB) PRO 1.9.8, when register_g
23RISK
open ↗Referência✓ VexDay Proof
RunCMS 1.6 - Multiple Vulnerabilities
RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a m
23RISK
open ↗Referência
CVE-2025-34054
AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection
48RISK
open ↗Referência
CVE-2025-34054
AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection
48RISK
open ↗Referência
CVE-2026-91780
GNU Binutils elflink.c elf_link_add_object_symbols null pointer dereference
33RISK
open ↗Referência
CVE-2015-7252
Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_
23RISK
open ↗Referência
CVE-2010-4313
Unrestricted file upload vulnerability in fileman_file_upload.php in Orbis CMS 1.0.2 allows remote authenticated users t
23RISK
open ↗Referência✓ VexDay Proof
AlkalinePHP 0.77.35 - 'adduser.php' Arbitrary Add Admin
AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creat
23RISK
open ↗Referência✓ VexDay Proof
Tlnews 2.2 - Insecure Cookie Handling
TlNews 2.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlNews_login c
23RISK
open ↗Referência✓ VexDay Proof
team 1.x - File Disclosure / Cross-Site Scripting
Team Board 1.x and 2.x stores sensitive information under the web root with insufficient access control, which allows re
23RISK
open ↗Referência
CVE-2010-0690
SQL injection vulnerability in index.php in CommodityRentals Video Games Rentals allows remote attackers to execute arbi
23RISK
open ↗Referência
CVE-2010-0707
Cross-site request forgery (CSRF) vulnerability in add_user.php in Employee Timeclock Software 0.99 allows remote attack
23RISK
open ↗Referência
CVE-2019-1148
Microsoft Graphics Component Information Disclosure Vulnerability
33RISK
open ↗Referência
CVE-2016-3694
Multiple SQL injection vulnerabilities in modified eCommerce Shopsoftware 2.0.0.0 revision 9678, when the easybill-modul
23RISK
open ↗Referência✓ VexDay Proof
WoW Roster 1.5.1 - 'subdir' Remote File Inclusion
PHP remote file inclusion vulnerability in conf.php in WoWRoster (aka World of Warcraft Roster) 1.5.1 and earlier allows
23RISK
open ↗Referência
CVE-2010-1478
Directory traversal vulnerability in the Ternaria Informatica Jfeedback! (com_jfeedback) component 1.2 for Joomla! allow
38RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.