Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,313cataloged exploits
34,834CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,797GitHub PoC 13,885VulnCheck XDB 8,484Nuclei 4,237Metasploit 3,467✓ verified onlyrecentpopularrisk
21,692 exploits
Referência✓ VexDay Proof
TorrentTrader Classic 1.07 - Multiple Vulnerabilities
Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic Edition 1.07 allows remote att
23RISK
open ↗Referência✓ VexDay Proof
phpFastNews 1.0.0 - Insecure Cookie Handling
The isLoggedIn function in fastnews-code.php in phpFastNews 1.0.0 allows remote attackers to bypass authentication and g
23RISK
open ↗Referência
CVE-2018-9926
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add an admin account via index.php?m=
23RISK
open ↗Referência
CVE-2017-14096
A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and b
23RISK
open ↗Referência
CVE-2017-7446
HelpDEZk 1.1.1 has CSRF in admin/home#/person/ with an impact of obtaining admin privileges.
23RISK
open ↗Referência
CVE-2025-34101
Serviio Media Server Unauthenticated Command Injection via checkStreamUrl VIDEO Parameter
63RISK
open ↗Referência
CVE-2015-8258
AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via v
23RISK
open ↗Referência
CVE-2025-34101
Serviio Media Server Unauthenticated Command Injection via checkStreamUrl VIDEO Parameter
63RISK
open ↗Referência
CVE-2025-34101
Serviio Media Server Unauthenticated Command Injection via checkStreamUrl VIDEO Parameter
63RISK
open ↗Referência
CVE-2025-34101
Serviio Media Server Unauthenticated Command Injection via checkStreamUrl VIDEO Parameter
63RISK
open ↗Referência
CVE-2014-4643
Multiple heap-based buffer overflows in the client in Core FTP LE 2.2 build 1798 allow remote FTP servers to cause a den
23RISK
open ↗Referência
CVE-2010-5002
Cross-site scripting (XSS) vulnerability in modules/slideshowmodule/slideshow.js.php in Exponent CMS 0.97.0 allows remot
23RISK
open ↗Referência
CVE-2017-6020
Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237
23RISK
open ↗Referência✓ VexDay Proof
phpBB lat2cyr Mod 1.0.1 - 'lat2cyr.php' Remote File Inclusion
PHP remote file inclusion vulnerability in lat2cyr.php in the lat2cyr 1.0.1 and earlier phpbb module allows remote attac
23RISK
open ↗Referência✓ VexDay Proof
BitsCast 0.13.0 - invalid string Remote Denial of Service
BitsCast 0.13.0 allows remote attackers to cause a denial of service (application crash) via an RSS 2.0 feed item with c
23RISK
open ↗Referência✓ VexDay Proof
WebCalendar 1.0.4 - 'includedir' Remote File Inclusion
PHP remote file inclusion vulnerability in send_reminders.php in WebCalendar 1.0.4 allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
mUnky 0.0.1 - 'zone' Local File Inclusion
Directory traversal vulnerability in index.php in mUnky 0.0.1 allows remote attackers to include and execute arbitrary l
23RISK
open ↗Referência
CVE-2016-4313
Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitra
23RISK
open ↗Referência
CVE-2010-1875
Directory traversal vulnerability in the Real Estate Property (com_properties) component 3.1.22-03 for Joomla! allows re
43RISK
open ↗Referência
CVE-2020-13228
An issue was discovered in Sysax Multi Server 6.90. There is reflected XSS via the /scgi sid parameter.
23RISK
open ↗Referência
CVE-2023-0916
SourceCodester Auto Dealer Management System Users.php access control
33RISK
open ↗Referência
CVE-2016-4313
Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitra
23RISK
open ↗Referência
CVE-2023-31902
RPA Technology Mobile Mouse 3.6.0.4 is vulnerable to Remote Code Execution (RCE).
63RISK
open ↗Referência
CVE-2016-8024
Improper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security VirusScan Enterprise Linux (VS
23RISK
open ↗Referência
CVE-2018-10575
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Hardcoded credentia
23RISK
open ↗Referência✓ VexDay Proof
PGOSD - '/misc/function.php3' Remote File Inclusion
PHP remote file inclusion vulnerability in misc/function.php3 in PHP Generator of Object SQL Database (PGOSD), when regi
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.