Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2014-9144
CVE-2014-9144—
Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to execute arbitrary commands via shell metac
23RISK
open ↗
Referência
CVE-2014-9440
CVE-2014-9440—
SQL injection vulnerability in browse.php in phpMyRecipes 1.2.2 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência
CVE-2026-86776
CVE-2026-86776MEDIUM
KeePass 2.35 through 2.61.1 Memory Exhaustion via KDBX Header Field Size
33RISK
open ↗
Referência
CVE-2026-85117
CVE-2026-85117MEDIUM
Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
33RISK
open ↗
Referência
CVE-2023-38035
CVE-2023-38035CRITICALunder attackransomware
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an
100RISK
open ↗
Referência✓ VexDay Proof
TuMusika Evolution 1.7R5 - Remote File Disclosure
CVE-2007-6188—webappsphp
Multiple directory traversal vulnerabilities in TuMusika Evolution 1.7R5 allow remote attackers to include and execute a
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component Recipes 1.00 - 'id' SQL Injection
CVE-2008-0518—webappsphp
SQL injection vulnerability in index.php in the Recipes (com_recipes) 1.00 component for Mambo and Joomla! allows remote
23RISK
open ↗
Referência✓ VexDay Proof
EPShop < 3.0 - 'pid' SQL Injection
CVE-2008-3412—webappsphp
SQL injection vulnerability in Comsenz EPShop (aka ECShop) before 3.0 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2008-6887
CVE-2008-6887—
SQL injection vulnerability in detailad.asp in Pre Classified Listings 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2013-2754
CVE-2013-2754—
Cross-site request forgery (CSRF) vulnerability in Umisoft UMI.CMS before 2.9 build 21905 allows remote attackers to hij
23RISK
open ↗
Referência
CVE-2013-2945
CVE-2013-2945—
SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to
23RISK
open ↗
Referência
CVE-2026-85137
CVE-2026-85137MEDIUM
SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection
33RISK
open ↗
Referência
CVE-2026-82884
CVE-2026-82884MEDIUM
All in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block
33RISK
open ↗
Referência
CVE-2021-46381
CVE-2021-46381—
Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd]
50RISK
open ↗
Referência
CVE-2026-71624
CVE-2026-71624CRITICAL
An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class
48RISK
open ↗
Referência✓ VexDay Proof
LoveCMS 1.6.2 Final - Update Settings
CVE-2008-3509—webappsphp
LoveCMS 1.6.2 does not require administrative authentication for (1) addblock.php, (2) blocks.php, and (3) themes.php in
23RISK
open ↗
Referência✓ VexDay Proof
Getleft 1.2 - Remote Buffer Overflow (PoC)
CVE-2008-6897—dosmultiple
Multiple buffer overflows in Getleft.exe in Andres Garcia Getleft 1.2 allow remote attackers to cause a denial of servic
23RISK
open ↗
Referência✓ VexDay Proof
2532/Gigs 1.2.2 Stable - Remote Authentication Bypass
CVE-2008-6907—webappsphp
Multiple SQL injection vulnerabilities in checkuser.php in 2532designs 2532|Gigs 1.2.2 Stable, when magic_quotes_gpc is
23RISK
open ↗
Referência✓ VexDay Proof
Zeeways ZeeJobsite 2.0 - Arbitrary File Upload
CVE-2008-6913—webappsphp
Unrestricted file upload vulnerability in editresume_next.php in Zeeways ZEEJOBSITE 2.0 allows remote authenticated user
23RISK
open ↗
Referência✓ VexDay Proof
TaskDriver 1.3 - Remote Change Admin Password
CVE-2008-6919—webappsphp
profileedit.php TaskDriver 1.3 and earlier allows remote attackers to bypass authentication and gain administrative acce
23RISK
open ↗
Referência
CVE-2026-9434
CVE-2026-9434CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection
48RISK
open ↗
Referência
CVE-2013-7186
CVE-2013-7186—
Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long
28RISK
open ↗
Referência
CVE-2022-41040
CVE-2022-41040HIGHunder attackransomware
Microsoft Exchange Server Elevation of Privilege Vulnerability
100RISK
open ↗
Referência
CVE-2026-9431
CVE-2026-9431HIGH
Tenda F1202 PptpUserAdd fromPptpUserAdd stack-based overflow
41RISK
open ↗
Referência
CVE-2013-7186
CVE-2013-7186—
Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long
28RISK
open ↗
Referência
CVE-2013-7186
CVE-2013-7186—
Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long
28RISK
open ↗
Referência
CVE-2014-9418
CVE-2014-9418—
The eSpace Meeting ActiveX control (eSpaceStatusCtrl.dll) in Huawei eSpace Desktop before V200R001C03 allows local users
23RISK
open ↗
Referência
CVE-2014-9611
CVE-2014-9611—
Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via
28RISK
open ↗
Referência✓ VexDay Proof
PHPAdBoard - PHP uploads Arbitrary File Upload
CVE-2008-6921—webappsphp
Unrestricted file upload vulnerability in index.php in phpAdBoard 1.8 allows remote attackers to execute arbitrary code
23RISK
open ↗
Referência✓ VexDay Proof
PHPStore Real Estate - Arbitrary File Upload
CVE-2008-6930—webappsphp
Unrestricted file upload vulnerability in PHPStore Real Estate allows remote authenticated users to execute arbitrary co
23RISK
open ↗
← previouspage 336 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.