Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
S9Y Serendipity 1.0.3 - 'comment.php' Local File Inclusion
CVE-2006-6242—webappsphp
Multiple directory traversal vulnerabilities in Serendipity 1.0.3 and earlier allow remote attackers to read or include
23RISK
open ↗
Referência✓ VexDay Proof
HomePH Design 2.10 RC2 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2008-2982—webappsphp
Multiple directory traversal vulnerabilities in HomePH Design 2.10 RC2, when register_globals is enabled, allow remote a
23RISK
open ↗
Referência
CVE-2012-3152
CVE-2012-3152CRITICALunder attack
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and
100RISK
open ↗
Referência✓ VexDay Proof
Bea Weblogic Apache Connector - Code Execution / Denial of Service
CVE-2008-3257—remotewindows
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10
60RISK
open ↗
Referência✓ VexDay Proof
Miniweb 2.0 - Authentication Bypass
CVE-2008-6582—webappsphp
SQL injection vulnerability in index.php in Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
2WIRE DSL Router - 'xslt' Denial of Service
CVE-2008-6605—doshardware
Cross-site request forgery (CSRF) vulnerability in the xslt script in the web-based management interface on the 2wire 17
23RISK
open ↗
Referência
CVE-2016-1287
CVE-2016-1287—
Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0
45RISK
open ↗
Referência✓ VexDay Proof
Ultimate HelpDesk - Cross-Site Scripting / Local File Disclosure
CVE-2006-6380—webappsasp
Cross-site scripting (XSS) vulnerability in index.asp in Ultimate HelpDesk allows remote attackers to inject arbitrary w
23RISK
open ↗
Referência
CVE-2010-4830
CVE-2010-4830—
SQL injection vulnerability in Resumes/TD_RESUME_Indlist.asp in Techno Dreams (T-Dreams) Job Career Package 3.0 allows r
23RISK
open ↗
Referência
CVE-2014-9415
CVE-2014-9415—
Huawei eSpace Desktop before V100R001C03 allows local users to cause a denial of service (program exit) via a crafted QE
23RISK
open ↗
Referência
CVE-2016-5847
CVE-2016-5847—
SAP SAPCAR allows local users to change the permissions of arbitrary files and consequently gain privileges via a hard l
23RISK
open ↗
Referência
CVE-2026-108879
CVE-2026-108879MEDIUM
JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter
33RISK
open ↗
Referência
CVE-2026-82925
CVE-2026-82925HIGH
Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature
41RISK
open ↗
Referência
CVE-2021-39144
CVE-2021-39144HIGHunder attack
XStream is vulnerable to a Remote Command Execution attack
100RISK
open ↗
Referência
CVE-2014-9416
CVE-2014-9416—
Multiple untrusted search path vulnerabilities in Huawei eSpace Desktop before V200R003C00 allow local users to execute
23RISK
open ↗
Referência
CVE-2017-9248
CVE-2017-9248CRITICALunder attack
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
100RISK
open ↗
Referência✓ VexDay Proof
BlazeVideo HDTV Player 2.1 - '.PLF' Local Buffer Overflow
CVE-2006-6396—localwindows
Stack-based buffer overflow in BlazeVideo HDTV Player 2.1, and possibly earlier, allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
J-OWAMP Web Interface 2.1b - 'link' Remote File Inclusion
CVE-2006-6453—webappsphp
PHP remote file inclusion vulnerability in JOWAMP_ShowPage.php in J-OWAMP Web Interface 2.1 allows remote authenticated
23RISK
open ↗
Referência✓ VexDay Proof
Fantastic News 2.1.4 - 'news.php' SQL Injection
CVE-2006-6542—webappsphp
SQL injection vulnerability in news.php in Fantastic News 2.1.4 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2016-6434
CVE-2016-6434—
Cisco Firepower Management Center 6.0.1 has hardcoded database credentials, which allows local users to obtain sensitive
23RISK
open ↗
Referência
CVE-2026-12809
CVE-2026-12809MEDIUM
Edimax BR-6478AC V2 POST Request wiz_5in1_redirect command injection
33RISK
open ↗
Referência
CVE-2023-28285
CVE-2023-28285HIGH
Microsoft Office Remote Code Execution Vulnerability
41RISK
open ↗
Referência
CVE-2026-12770
CVE-2026-12770MEDIUM
BerriAI litellm Admin Key key_management_endpoints.py improper authorization
33RISK
open ↗
Referência
CVE-2026-87928
CVE-2026-87928MEDIUM
MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page
33RISK
open ↗
Referência✓ VexDay Proof
Sambar FTP Server 6.4 - 'SIZE' Remote Denial of Service
CVE-2006-6624—doswindows
The FTP Server in Sambar Server 6.4 allows remote authenticated users to cause a denial of service (application crash) v
23RISK
open ↗
Referência
CVE-2015-2366
CVE-2015-2366—
win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Wi
23RISK
open ↗
Referência
CVE-2026-9710
CVE-2026-9710HIGH
Themeco Cornerstone < 7.8.8 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Password Hash Disclosure
41RISK
open ↗
Referência
CVE-2026-83537
CVE-2026-83537MEDIUM
WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment
33RISK
open ↗
Referência
CVE-2024-0204
CVE-2024-0204CRITICAL
Authentication Bypass in GoAnywhere MFT
85RISK
open ↗
Referência
CVE-2024-0723
CVE-2024-0723MEDIUM
freeSSHd denial of service
33RISK
open ↗
← previouspage 375 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.