Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,190 exploits
Referência
CVE-2015-6306
CVE-2015-6306—
Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions,
23RISK
open ↗
Referência
CVE-2026-96533
CVE-2026-96533MEDIUM
Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL
33RISK
open ↗
Referência✓ VexDay Proof
MySpace Resource Script (MSRS) 1.21 - Remote File Inclusion
CVE-2007-5721—webappsphp
PHP remote file inclusion vulnerability in _theme/breadcrumb.php in MySpacePros MySpace Resource Script (MSRS) 1.21 allo
23RISK
open ↗
Referência
CVE-2026-109934
CVE-2026-109934MEDIUM
Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API
33RISK
open ↗
Referência
CVE-2026-109933
CVE-2026-109933MEDIUM
Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes
33RISK
open ↗
Referência
CVE-2026-107858
CVE-2026-107858HIGH
Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server
41RISK
open ↗
Referência
CVE-2026-115535
CVE-2026-115535MEDIUM
gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting
33RISK
open ↗
Referência
CVE-2012-4265
CVE-2012-4265—
SQL injection vulnerability in category_edit.php in Proman Xpress 5.0.1 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2015-6306
CVE-2015-6306—
Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions,
23RISK
open ↗
Referência
CVE-2017-14492
CVE-2017-14492—
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
45RISK
open ↗
Referência
CVE-2017-7005
CVE-2017-7005—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS
23RISK
open ↗
Referência
CVE-2011-1567
CVE-2011-1567—
Multiple stack-based buffer overflows in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Grap
50RISK
open ↗
Referência
CVE-2007-5816
CVE-2007-5816—
dialog.php in CONTENTCustomizer 3.1mp and earlier allows remote attackers to obtain sensitive author credentials by maki
23RISK
open ↗
Referência
CVE-2025-15194
CVE-2025-15194CRITICAL
D-Link DIR-600 HTTP Header hedwig.cgi stack-based overflow
48RISK
open ↗
Referência✓ VexDay Proof
Netartmedia Blog System - SQL Injection
CVE-2008-5311—webappsphp
SQL injection vulnerability in image.php in NetArt Media Blog System 1.5 allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
JBC Explorer 7.20 RC 1 - Remote Code Execution
CVE-2007-5913—webappsphp
dirsys/modules/auth.php in JBC Explorer 7.20 RC1 and earlier does not require authentication, which allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Career - SQL Injection
CVE-2008-6867—webappsphp
SQL injection vulnerability in content.php in Scripts For Sites (SFS) EZ Career allows remote attackers to execute arbit
23RISK
open ↗
Referência
CVE-2010-2916
CVE-2010-2916—
SQL injection vulnerability in news.php in AJ Square AJ HYIP MERIDIAN allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2016-1104
CVE-2016-1104—
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsof
35RISK
open ↗
Referência
CVE-2009-3969
CVE-2009-3969—
Stack-based buffer overflow in Faslo Player 7.0 allows remote attackers to cause a denial of service (application crash)
23RISK
open ↗
Referência
CVE-2009-3970
CVE-2009-3970—
SQL injection vulnerability in index.php in PHP Dir Submit (aka WebsiteSubmitter or Submitter Script) allows remote auth
23RISK
open ↗
Referência
CVE-2026-51772
CVE-2026-51772MEDIUM
A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multi
33RISK
open ↗
Referência
CVE-2026-97368
CVE-2026-97368MEDIUM
chillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization
33RISK
open ↗
Referência✓ VexDay Proof
LocazoList 2.01a beta5 - 'subcatID' SQL Injection
CVE-2007-0129—webappsasp
SQL injection vulnerability in main.asp in LocazoList 2.01a beta5 and earlier allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module debaser 0.92 - 'genre.php' Blind SQL Injection
CVE-2007-1805—webappsphp
SQL injection vulnerability in genre.php in the debaser 0.92 and earlier module for Xoops allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Phil-a-Form 1.2.0.0 - SQL Injection
CVE-2007-2933—webappsphp
SQL injection vulnerability in index.php in the Phil-a-Form (com_philaform) 1.2.0.0 and earlier component for Joomla! al
23RISK
open ↗
Referência✓ VexDay Proof
PNPHPBB2 < 1.2i - 'viewforum.php' SQL Injection
CVE-2007-3584—webappsphp
SQL injection vulnerability in viewforum.php in PNphpBB2 1.2i and earlier for Postnuke allows remote attackers to execut
23RISK
open ↗
Referência
CVE-2009-3002
CVE-2009-3002—
The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows lo
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component Remository - 'cat' SQL Injection
CVE-2007-4505—webappsphp
SQL injection vulnerability in index.php in the RemoSitory component (com_remository) for Mambo allows remote attackers
23RISK
open ↗
Referência
CVE-2007-5817
CVE-2007-5817MEDIUM
dialog.php in CONTENTCustomizer 3.1mp and earlier allows remote attackers to perform certain privileged actions via a (1
33RISK
open ↗
← previouspage 302 / 873next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.