Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,058cataloged exploits

35,300CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,175GitHub PoC 14,096VulnCheck XDB 8,607Nuclei 4,255Metasploit 3,474✓ verified onlyrecent popular risk

22,166 exploits

Referência✓ VexDay Proof

Microsoft GDI Plugin - '.png' Infinite Loop Denial of Service (PoC)

CVE-2009-1511—doswindows

GDI+ in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (infinite loop) via a PNG file tha

28RISK

open ↗

Referência✓ VexDay Proof

pecio CMS 1.1.5 - 'index.php?language' Local File Inclusion

CVE-2009-1519—webappsphp

Directory traversal vulnerability in index.php in Pecio CMS 1.1.5 allows remote attackers to read arbitrary files via a

23RISK

open ↗

Referência

CVE-2015-1187

CVE-2015-1187CRITICALunder attack

The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr

100RISK

open ↗

Referência

CVE-2015-1305

CVE-2015-1305—

McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows local users to write to arbitrary memory locations, an

23RISK

open ↗

Referência

CVE-2015-1325

CVE-2015-1325—

Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ub

23RISK

open ↗

Referência

CVE-2015-1328

CVE-2015-1328—

The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no

50RISK

open ↗

Referência

CVE-2015-1328

CVE-2015-1328—

The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no

50RISK

open ↗

Referência

CVE-2015-1336

CVE-2015-1336—

The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access t

23RISK

open ↗

Referência

CVE-2015-1338

CVE-2015-1338—

kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly ga

23RISK

open ↗

Referência

CVE-2015-1362

CVE-2015-1362—

Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot 4.7.2 allows remote attackers to execute arbitrary co

23RISK

open ↗

Referência

CVE-2015-1368

CVE-2015-1368—

Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attacker

23RISK

open ↗

Referência

CVE-2015-1368

CVE-2015-1368—

Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attacker

23RISK

open ↗

Referência

CVE-2015-1375

CVE-2015-1375—

pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload

28RISK

open ↗

Referência

CVE-2015-1422

CVE-2015-1422—

Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary

23RISK

open ↗

Referência

CVE-2015-1422

CVE-2015-1422—

Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary

23RISK

open ↗

Referência

CVE-2022-41040

CVE-2022-41040HIGHunder attackransomware

Microsoft Exchange Server Elevation of Privilege Vulnerability

100RISK

open ↗

Referência

CVE-2015-1479

CVE-2015-1479—

SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 buil

23RISK

open ↗

Referência✓ VexDay Proof

BolinTech DreamFTP Server - 'USER' Remote Buffer Overflow (PoC)

CVE-2007-0338—doswindows

Heap-based buffer overflow in Dream FTP Server allows remote attackers to execute arbitrary code via a USER command with

23RISK

open ↗

Referência✓ VexDay Proof

DB Top Sites 1.0 - 'index.php?u' Local File Inclusion

CVE-2009-2110—webappsphp

Multiple directory traversal vulnerabilities in DB Top Sites 1.0, when magic_quotes_gpc is disabled, allow remote attack

23RISK

open ↗

Referência

CVE-2015-1479

CVE-2015-1479—

SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 buil

23RISK

open ↗

Referência

CVE-2009-2123

CVE-2009-2123—

Multiple SQL injection vulnerabilities in Elvin 1.2.0 allow remote attackers to execute arbitrary SQL commands via the (

23RISK

open ↗

Referência✓ VexDay Proof

elvin bts 1.2.0 - Multiple Vulnerabilities

CVE-2009-2123—webappsphp

Multiple SQL injection vulnerabilities in Elvin 1.2.0 allow remote attackers to execute arbitrary SQL commands via the (

23RISK

open ↗

Referência✓ VexDay Proof

elvin bts 1.2.0 - Multiple Vulnerabilities

CVE-2009-2124—webappsphp

Directory traversal vulnerability in page.php in Elvin 1.2.0 allows remote attackers to include and execute arbitrary lo

23RISK

open ↗

Referência✓ VexDay Proof

Zip Store Chat 4.0/5.0 - Authentication Bypass

CVE-2009-2142—webappsphp

Multiple SQL injection vulnerabilities in admin/index.asp in Zip Store Chat 4.0 and 5.0 allow remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

campus virtual-lms - Cross-Site Scripting / SQL Injection

CVE-2009-2148—webappsphp

SQL injection vulnerability in news/index.php in Campus Virtual-LMS allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

impleo music Collection 2.0 - SQL Injection / Cross-Site Scripting

CVE-2009-2154—webappsphp

SQL injection vulnerability in admin/login.php in Impleo Music Collection 2.0, when magic_quotes_gpc is disabled, allows

23RISK

open ↗

Referência✓ VexDay Proof

TorrentTrader Classic 1.09 - Multiple Vulnerabilities

CVE-2009-2160—webappsphp

TorrentTrader Classic 1.09 allows remote attackers to (1) obtain configuration information via a direct request to phpin

23RISK

open ↗

Referência

CVE-2026-9434

CVE-2026-9434CRITICAL

Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection

48RISK

open ↗

Referência

CVE-2026-9431

CVE-2026-9431HIGH

Tenda F1202 PptpUserAdd fromPptpUserAdd stack-based overflow

41RISK

open ↗

Referência✓ VexDay Proof

Kjtechforce mailman b1 - 'dest' Blind SQL Injection

CVE-2009-2164—webappsphp

Multiple SQL injection vulnerabilities in Kjtechforce mailman beta1, when magic_quotes_gpc is disabled, allow remote att

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.