Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,596cataloged exploits
39,732CVEs with public exploitation
24,695lab-tested
AllReferência 25,742Exploit-DB 24,485GitHub PoC 16,615VulnCheck XDB 9,736Nuclei 4,493Metasploit 3,525✓ verified onlyrecentpopularrisk
25,624 exploits
Referência
CVE-2011-4862
CVE-2011-4862—
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka k
60RISK
open ↗
Referência
CVE-2009-2403
CVE-2009-2403—
Heap-based buffer overflow in SCMPX 1.5.1 allows remote attackers to cause a denial of service (application crash) or ex
23RISK
open ↗
Referência
CVE-2009-2735
CVE-2009-2735—
SQL injection vulnerability in admin.php in sun-jester OpenNews 1.0, when magic_quotes_gpc is disabled, allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
All Club CMS 0.0.1f - 'index.php' Local File Inclusion
CVE-2008-0602—webappsphp
Directory traversal vulnerability in index.php in All Club CMS (ACCMS) 0.0.1f and earlier allows remote attackers to inc
23RISK
open ↗
Referência
CVE-2009-2762
CVE-2009-2762—
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the
28RISK
open ↗
Referência✓ VexDay Proof
WebChamado 1.1 - 'tsk_id' SQL Injection
CVE-2008-2906—webappsphp
SQL injection vulnerability in lista_anexos.php in WebChamado 1.1 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
template creature - SQL Injection / File Disclosure
CVE-2008-5950—webappsphp
SQL injection vulnerability in media/media_level.asp in ASP Template Creature allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2018-1999002
CVE-2018-1999002—
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framewor
45RISK
open ↗
Referência
CVE-2021-32305
CVE-2021-32305—
WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search paramet
60RISK
open ↗
Referência
CVE-2022-31814
CVE-2022-31814CRITICAL
pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metachar
85RISK
open ↗
Referência
CVE-2020-10915
CVE-2020-10915CRITICAL
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.
85RISK
open ↗
Referência✓ VexDay Proof
BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery
CVE-2008-7058—webappsphp
Cross-site request forgery (CSRF) vulnerability in BandSite CMS 1.1.4 allows remote attackers to hijack the authenticati
23RISK
open ↗
Referência✓ VexDay Proof
CMS Frogss 0.4 - 'podpis' SQL Injection
CVE-2006-4536—webappsphp
SQL injection vulnerability in module/rejestracja.php in CMS Frogss 0.4 and earlier allows remote attackers to execute a
23RISK
open ↗
Referência
CVE-2009-2326
CVE-2009-2326—
Multiple SQL injection vulnerabilities in KerviNet Forum 1.1 and earlier allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2026-7110
CVE-2026-7110MEDIUM
code-projects Invoice System in Laravel item cross site scripting
33RISK
open ↗
Referência
CVE-2026-7113
CVE-2026-7113MEDIUM
NousResearch hermes-agent Webhooks Endpoint webhook.py missing authentication
33RISK
open ↗
Referência
CVE-2026-7112
CVE-2026-7112MEDIUM
NousResearch hermes-agent API_SERVER_KEY api_server.py _check_auth improper authentication
33RISK
open ↗
Referência
CVE-2026-7109
CVE-2026-7109MEDIUM
code-projects Invoice System in Laravel API Endpoint item improper authorization
33RISK
open ↗
Referência
CVE-2009-2778
CVE-2009-2778—
Cross-site scripting (XSS) vulnerability in visitor/view.php in GarageSales Script allows remote attackers to inject arb
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component Shambo2 - 'itemID' SQL Injection
CVE-2008-0606—webappsphp
SQL injection vulnerability in index.php in the Shambo2 (com_shambo2) component for Mambo and Joomla! allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
Active Test 2.1 - Authentication Bypass
CVE-2008-5959—webappsasp
Multiple SQL injection vulnerabilities in start.asp in Active Test 2.1 allow remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2020-14295
CVE-2020-14295—
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead
60RISK
open ↗
Referência
CVE-2018-6961
CVE-2018-6961HIGHunder attack
VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web U
100RISK
open ↗
Referência✓ VexDay Proof
Active Price Comparison 4 - Authentication Bypass
CVE-2008-5974—webappsasp
Multiple SQL injection vulnerabilities in login.aspx in Active Price Comparison 4.0 allow remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2025-9242
CVE-2025-9242CRITICALunder attack
WatchGuard Firebox iked Out of Bounds Write Vulnerability
100RISK
open ↗
Referência
CVE-2007-2222
CVE-2007-2222—
Multiple buffer overflows in the (1) ActiveListen (Xlisten.dll) and (2) ActiveVoice (Xvoice.dll) speech controls, as use
35RISK
open ↗
Referência
CVE-2025-49844
CVE-2025-49844CRITICAL
Redis Lua Use-After-Free may lead to remote code execution
85RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin dmsguestbook 1.7.0 - Multiple Vulnerabilities
CVE-2008-0616—webappsphp
SQL injection vulnerability in the administration panel in the DMSGuestbook 1.7.0 plugin for WordPress allows remote aut
23RISK
open ↗
Referência✓ VexDay Proof
ICQ Toolbar 2.3 - ActiveX Remote Denial of Service
CVE-2008-7136—doswindows
toolbaru.dll in ICQ Toolbar (ICQToolbar) 2.3 allows remote attackers to cause a denial of service (toolbar crash) via a
23RISK
open ↗
Referência
CVE-2009-2443
CVE-2009-2443—
Siteframe 3.2.3, and other 3.2.x versions, allows remote attackers to obtain configuration information via a direct requ
23RISK
open ↗
← previouspage 29 / 855next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.