Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2026-97328
CVE-2026-97328HIGH
WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser
41RISK
open ↗
Referência✓ VexDay Proof
Mambo Module Weather - 'absolute_path' Remote File Inclusion
CVE-2007-2044—webappsphp
PHP remote file inclusion vulnerability in mod_weather.php in the Antonis Ventouris Weather module for Mambo and Joomla!
23RISK
open ↗
Referência
CVE-2026-16220
CVE-2026-16220MEDIUM
code-projects Online Examination System account.php cross site scripting
33RISK
open ↗
Referência
CVE-2017-17595
CVE-2017-17595—
Beauty Parlour Booking Script 1.0 has SQL Injection via the /list gender or city parameter.
23RISK
open ↗
Referência✓ VexDay Proof
Vivotek Motion Jpeg Control - 'MjpegDecoder.dll 2.0.0.13' Remote Overflow
CVE-2007-3167—remotewindows
Stack-based buffer overflow in the Vivotek Motion Jpeg ActiveX control (aka MjpegControl) in MjpegDecoder.dll 2.0.0.13 a
23RISK
open ↗
Referência✓ VexDay Proof
Hotel Reservation System - 'city.asp' Blind SQL Injection
CVE-2008-4204—webappsasp
SQL injection vulnerability in city.asp in SoftAcid Hotel Reservation System (HRS) allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Server - Code Execution (MS08-067)
CVE-2008-4250CRITICALunder attackremotewindows
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 20
100RISK
open ↗
Referência✓ VexDay Proof
Observer 0.3.2.1 - Multiple Remote Command Execution Vulnerabilities
CVE-2008-4318—webappsphp
Observer 0.3.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the query
28RISK
open ↗
Referência✓ VexDay Proof
PrecisionID Datamatrix - ActiveX Arbitrary File Overwrite
CVE-2009-1212—remotewindows
Multiple insecure method vulnerabilities in PRECIS~2.DLL in the PrecisionID Datamatrix ActiveX control (DMATRIXLib.Datam
23RISK
open ↗
Referência
CVE-2014-3791
CVE-2014-3791—
Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 6.8 allows remote attackers to execute arbitrary code
60RISK
open ↗
Referência
CVE-2012-5349
CVE-2012-5349—
Multiple cross-site scripting (XSS) vulnerabilities in pay.php in the Pay With Tweet plugin before 1.2 allow remote atta
23RISK
open ↗
Referência
CVE-2017-11321
CVE-2017-11321—
The restricted shell interface in UCOPIA Wireless Appliance before 5.1.8 allows remote authenticated users to gain 'admi
23RISK
open ↗
Referência
CVE-2015-2055
CVE-2015-2055—
Zhone GPON 2520 with firmware R4.0.2.566b allows remote attackers to cause a denial of service via a long string in the
23RISK
open ↗
Referência
CVE-2017-5798
CVE-2017-5798—
A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP ve
23RISK
open ↗
Referência
CVE-2019-6282
CVE-2019-6282—
ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpag
23RISK
open ↗
Referência
CVE-2020-35437
CVE-2020-35437—
Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar[path] parameter in a POST request to the
23RISK
open ↗
Referência
CVE-2021-43857
CVE-2021-43857CRITICAL
Gerapy may contain remote code execution vulnerability
60RISK
open ↗
Referência
CVE-2026-109987
CVE-2026-109987HIGH
PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie
41RISK
open ↗
Referência
CVE-2010-20121
CVE-2010-20121CRITICAL
EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow
63RISK
open ↗
Referência
CVE-2010-20121
CVE-2010-20121CRITICAL
EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow
63RISK
open ↗
Referência
CVE-2010-20121
CVE-2010-20121CRITICAL
EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow
63RISK
open ↗
Referência
CVE-2010-20121
CVE-2010-20121CRITICAL
EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow
63RISK
open ↗
Referência
CVE-2010-20121
CVE-2010-20121CRITICAL
EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow
63RISK
open ↗
Referência
CVE-2010-20121
CVE-2010-20121CRITICAL
EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow
63RISK
open ↗
Referência
CVE-2010-20121
CVE-2010-20121CRITICAL
EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow
63RISK
open ↗
Referência
CVE-2023-53963
CVE-2023-53963CRITICAL
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command Injection
48RISK
open ↗
Referência✓ VexDay Proof
vbLOGIX Tutorial Script 1.0 - 'cat_id' SQL Injection
CVE-2008-4350—webappsphp
SQL injection vulnerability in main.php in vbLOGIX Tutorial Script 1.0 and earlier allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2022-50944
CVE-2022-50944HIGH
Aero CMS 0.0.1 PHP Code Injection via posts.php
41RISK
open ↗
Referência
CVE-2013-3961
CVE-2013-3961—
SQL injection vulnerability in edit_event.php in Simple PHP Agenda before 2.2.9 allows remote authenticated users to exe
23RISK
open ↗
Referência✓ VexDay Proof
SunShop Shopping Cart 3.5 - 'abs_path' Remote File Inclusion
CVE-2007-2070—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools SunShop Shopping Cart before 3.5.1 allow remote
23RISK
open ↗
← previouspage 380 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.