Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

26,190 exploits

Referência

CVE-2020-8778

CVE-2020-8778—

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document,

23RISK

open ↗

Referência

CVE-2026-90623

CVE-2026-90623MEDIUM

andreashappe cochise SSH Host Key ssh_connection.py asyncssh.connect certificate validation

33RISK

open ↗

Referência

CVE-2026-90622

CVE-2026-90622MEDIUM

GNU libredwg Layer Encoding dwg.spec DWG_TABLE null pointer dereference

33RISK

open ↗

Referência✓ VexDay Proof

Philex 0.2.3 - Remote File Inclusion / File Disclosure

CVE-2007-1698—webappsphp

download.php in Philex 0.2.3 and earlier allows remote attackers to read arbitrary files and source code, and obtain sen

23RISK

open ↗

Referência✓ VexDay Proof

Noticeware Email Server 4.6.1.0 - Denial of Service

CVE-2008-1713—doswindows

MailServer.exe in NoticeWare Email Server 4.6.1.0 allows remote attackers to cause a denial of service (application cras

23RISK

open ↗

Referência✓ VexDay Proof

Scientific Image DataBase 0.41 - Blind SQL Injection

CVE-2008-2834—webappsphp

SQL injection vulnerability in projects.php in Scientific Image DataBase 0.41 allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

e107 < 0.7.13 - 'usersettings.php' Blind SQL Injection

CVE-2008-5320—webappsphp

SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute

23RISK

open ↗

Referência

CVE-2015-2084

CVE-2015-2084—

Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote

23RISK

open ↗

Referência

CVE-2017-9813

CVE-2017-9813—

In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312), the scriptNa

23RISK

open ↗

Referência✓ VexDay Proof

Online Grades 3.2.4 - Authentication Bypass

CVE-2009-0453—webappsphp

Online Grades 3.2.4 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, whi

23RISK

open ↗

Referência✓ VexDay Proof

Orbit Downloader 2.8.7 - Arbitrary File Deletion

CVE-2009-1064—remotewindows

Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allow

23RISK

open ↗

Referência

CVE-2009-4991

CVE-2009-4991—

Cross-site scripting (XSS) vulnerability in users/resume_register.php in Omnistar Recruiting allows remote attackers to

23RISK

open ↗

Referência

CVE-2010-0764

CVE-2010-0764—

SQL injection vulnerability in index.php in KuwaitPHP eSmile allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência

CVE-2010-1544

CVE-2010-1544—

micro_httpd on the RCA DCM425 cable modem allows remote attackers to cause a denial of service (device reboot) via a lon

23RISK

open ↗

Referência

CVE-2015-2084

CVE-2015-2084—

Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote

23RISK

open ↗

Referência

CVE-2010-0796

CVE-2010-0796—

SQL injection vulnerability in the JE Quiz (com_jequizmanagement) component 1.b01 for Joomla! allows remote attackers to

23RISK

open ↗

Referência

CVE-2010-1055

CVE-2010-1055—

Multiple PHP remote file inclusion vulnerabilities in osDate 2.1.9 and 2.5.4, when magic_quotes_gpc is disabled and regi

23RISK

open ↗

Referência

CVE-2025-44868

CVE-2025-44868CRITICAL

Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm.

48RISK

open ↗

Referência

CVE-2008-0230

CVE-2008-0230—

PHP remote file inclusion vulnerability in php121db.php in osDate 2.0.8 and possibly earlier versions allows remote atta

23RISK

open ↗

Referência

CVE-2024-8162

CVE-2024-8162CRITICAL

TOTOLINK T10 AC1200 Telnet Service product.ini hard-coded credentials

48RISK

open ↗

Referência

CVE-2023-3047

CVE-2023-3047CRITICAL

SQLi in TMT's Lockcell

48RISK

open ↗

Referência

CVE-2018-16736

CVE-2018-16736—

In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters sec

23RISK

open ↗

Referência

CVE-2019-9554

CVE-2019-9554—

In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at

23RISK

open ↗

Referência

CVE-2022-35155

CVE-2022-35155MEDIUM

Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the s

33RISK

open ↗

Referência

CVE-2024-25004

CVE-2024-25004HIGH

KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insuf

41RISK

open ↗

Referência

CVE-2013-7278

CVE-2013-7278—

SQL injection vulnerability in Naxtech CMS Afroditi 1.0 allows remote attackers to execute arbitrary SQL commands via th

23RISK

open ↗

Referência

CVE-2026-90610

CVE-2026-90610MEDIUM

GPAC MP4Box svg_attributes.c gf_svg_attributes_copy buffer over-read

33RISK

open ↗

Referência

CVE-2026-14843

CVE-2026-14843MEDIUM

Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR

33RISK

open ↗

Referência

CVE-2012-6559

CVE-2012-6559—

Multiple cross-site scripting (XSS) vulnerabilities in FreeNAC 3.02 allow remote attackers to inject arbitrary web scrip

23RISK

open ↗

Referência✓ VexDay Proof

Techno Dreams Articles & Papers 2.0 - SQL Injection

CVE-2006-4891—webappsasp

SQL injection vulnerability in ArticlesTableview.asp in Techno Dreams Articles & Papers Package 2.0 and earlier allows r

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.