Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
Venalsur on-line Booking Centre - Cross-Site Scripting / SQL Injection
CVE-2008-6216—webappsphp
SQL injection vulnerability in cadena_ofertas_ext.php in Venalsur Booking Centre Booking System for Hotels Group allows
23RISK
open ↗
Referência
CVE-2011-1667
CVE-2011-1667—
SQL injection vulnerability in index.php in Anzeigenmarkt 2011 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Linux Kernel 2.6 (Gentoo / Ubuntu 8.10/9.04) UDEV < 1.4.1 - Local Privilege Escalation (2)
CVE-2009-1185—locallinux
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to ga
60RISK
open ↗
Referência
CVE-2026-8267
CVE-2026-8267MEDIUM
Open5GS SMF smf_nsmf_handle_created_data_in_vsmf denial of service
33RISK
open ↗
Referência
CVE-2010-1496
CVE-2010-1496—
SQL injection vulnerability in the JoltCard (com_joltcard) component 1.2.1 for Joomla! allows remote attackers to execut
23RISK
open ↗
Referência
CVE-2012-5367
CVE-2012-5367—
Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbi
23RISK
open ↗
Referência
CVE-2026-108632
CVE-2026-108632MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission queryById Endpoint
33RISK
open ↗
Referência
CVE-2012-2571
CVE-2012-2571—
Multiple cross-site scripting (XSS) vulnerabilities in WinWebMail Server 3.8.1.6 allow remote attackers to inject arbitr
23RISK
open ↗
Referência
CVE-2024-8580
CVE-2024-8580CRITICAL
TOTOLINK AC1200 T8 shadow.sample hard-coded password
48RISK
open ↗
Referência
CVE-2026-103234
CVE-2026-103234MEDIUM
WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email
33RISK
open ↗
Referência
CVE-2026-100142
CVE-2026-100142MEDIUM
FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR
33RISK
open ↗
Referência
CVE-2014-100011
CVE-2014-100011—
SQL injection vulnerability in /send-to in Sendy 1.1.9.1 allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Referência
CVE-2014-3246
CVE-2014-3246—
SQL injection vulnerability in Collabtive 1.2 allows remote authenticated users to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
Apple Mac OSX xnu 1228.x - 'hfs-fcntl' Kernel Privilege Escalation
CVE-2009-1235—localosx
XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space
23RISK
open ↗
Referência
CVE-2025-34148
CVE-2025-34148CRITICAL
Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via WISP SSID
48RISK
open ↗
Referência
CVE-2015-8411
CVE-2015-8411—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and
35RISK
open ↗
Referência
CVE-2010-2461
CVE-2010-2461—
SQL injection vulnerability in storecat.php in JCE-Tech Overstock 1 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2016-2288
CVE-2016-2288—
Cogent DataHub before 7.3.10 allows local users to gain privileges by leveraging the user or guest role to modify a file
23RISK
open ↗
Referência
CVE-2011-5160
CVE-2011-5160—
Cross-site scripting (XSS) vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗
Referência✓ VexDay Proof
Weblogicnet - 'files_dir' Multiple Remote File Inclusions
CVE-2007-4715—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Weblogicnet allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗
Referência
CVE-2026-18720
CVE-2026-18720MEDIUM
kalcaddle kodbox msgWarning Plugin action improper authorization
33RISK
open ↗
Referência
CVE-2026-18602
CVE-2026-18602CRITICAL
GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config command injection
48RISK
open ↗
Referência
CVE-2010-2464
CVE-2010-2464—
Multiple cross-site scripting (XSS) vulnerabilities in the RSComments (com_rscomments) component 1.0.0 Rev 2 for Joomla!
23RISK
open ↗
Referência
CVE-2013-10064
CVE-2013-10064CRITICAL
ActFax 5.01 RAW Server Buffer Overflow
63RISK
open ↗
Referência
CVE-2013-10064
CVE-2013-10064CRITICAL
ActFax 5.01 RAW Server Buffer Overflow
63RISK
open ↗
Referência
CVE-2025-34110
CVE-2025-34110CRITICAL
ColoradoFTP Server <= 1.3 Build 8 Path Traversal Information Disclosure
63RISK
open ↗
Referência
CVE-2025-34110
CVE-2025-34110CRITICAL
ColoradoFTP Server <= 1.3 Build 8 Path Traversal Information Disclosure
63RISK
open ↗
Referência
CVE-2005-3686
CVE-2005-3686—
SQL injection vulnerability in search.inc.php in Unclassified NewsBoard before 1.5.3 Patch 4 allows remote attackers to
23RISK
open ↗
Referência
CVE-2026-55391
CVE-2026-55391HIGH
datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
41RISK
open ↗
Referência
CVE-2025-2907
CVE-2025-2907CRITICAL
Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update
63RISK
open ↗
← previouspage 282 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.