Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

26,240 exploits

Referência

CVE-2018-9128

CVE-2018-9128—

DVD X Player Standard 5.5.3.9 has a Buffer Overflow via a crafted .plf file, a related issue to CVE-2007-3068.

23RISK

open ↗

Referência

CVE-2018-9128

CVE-2018-9128—

DVD X Player Standard 5.5.3.9 has a Buffer Overflow via a crafted .plf file, a related issue to CVE-2007-3068.

23RISK

open ↗

Referência

CVE-2016-9566

CVE-2016-9566—

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root

23RISK

open ↗

Referência

CVE-2019-8925

CVE-2019-8925—

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerabi

28RISK

open ↗

Referência

CVE-2019-8925

CVE-2019-8925—

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerabi

28RISK

open ↗

Referência

CVE-2026-92466

CVE-2026-92466HIGH

microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking

41RISK

open ↗

Referência

CVE-2026-89327

CVE-2026-89327LOW

FluentBoards < 2.0.15 - Board Member+ Comment Author Spoofing via 'comment_by' Parameter

28RISK

open ↗

Referência

CVE-2026-92380

CVE-2026-92380MEDIUM

WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery

33RISK

open ↗

Referência

CVE-2025-5623

CVE-2025-5623CRITICAL

D-Link DIR-816 qosClassifier stack-based overflow

53RISK

open ↗

Referência

CVE-2011-5148

CVE-2011-5148—

Multiple incomplete blacklist vulnerabilities in the Simple File Upload (mod_simplefileuploadv1.3) module before 1.3.5 f

23RISK

open ↗

Referência

CVE-2010-4920

CVE-2010-4920—

SQL injection vulnerability in detail.asp in Micronetsoft Rental Property Management Website 1.0 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component com_loudmouth 4.0j - Remote File Inclusion

CVE-2006-3748—webappsphp

PHP remote file inclusion vulnerability in includes/abbc/abbc.class.php in the LoudMouth Component for Mambo 4.0j, and p

23RISK

open ↗

Referência✓ VexDay Proof

NukeSentinel 2.5.05 - 'nukesentinel.php' File Disclosure

CVE-2007-1172—webappsphp

SQL injection vulnerability in nukesentinel.php in NukeSentinel 2.5.05, and possibly earlier, allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

SmartPPC Pay Per Click Script - 'idDirectory' Blind SQL Injection (2)

CVE-2008-3152—webappsphp

SQL injection vulnerability in directory.php in SmartPPC and SmartPPC Pro allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

Triton CMS Pro 1.06 - 'x-forwarded-for' Blind SQL Injection

CVE-2008-3153—webappsphp

SQL injection vulnerability in Triton CMS Pro allows remote attackers to execute arbitrary SQL commands via the X-Forwar

23RISK

open ↗

Referência✓ VexDay Proof

CMS WebBlizzard - 'index.php' Blind SQL Injection

CVE-2008-3154—webappsphp

SQL injection vulnerability in index.php in WebBlizzard CMS allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência

CVE-2009-3213

CVE-2009-3213—

Stack-based buffer overflow in broid 1.0 Beta 3a allows remote attackers to cause a denial of service (application crash

23RISK

open ↗

Referência

CVE-2010-3130

CVE-2010-3130—

Untrusted search path vulnerability in TechSmith Snagit all versions 10.x and 11.x allows local users, and possibly remo

23RISK

open ↗

Referência

CVE-2021-35956

CVE-2021-35956—

Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote aut

23RISK

open ↗

Referência

CVE-2025-14535

CVE-2025-14535CRITICAL

UTT 进取 512W formConfigFastDirectionW strcpy buffer overflow

48RISK

open ↗

Referência

CVE-2022-31325

CVE-2022-31325—

There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.

23RISK

open ↗

Referência

CVE-2010-1296

CVE-2010-1296—

Multiple buffer overflows in Adobe Photoshop CS4 before 11.0.2 allow user-assisted remote attackers to execute arbitrary

28RISK

open ↗

Referência

CVE-2018-0826

CVE-2018-0826—

Windows Storage Services in Windows 10 versions 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, versi

23RISK

open ↗

Referência

CVE-2014-1841

CVE-2014-1841—

Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attacke

38RISK

open ↗

Referência

CVE-2020-28413

CVE-2020-28413MEDIUM

In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the A

33RISK

open ↗

Referência

CVE-2010-2680

CVE-2010-2680—

Directory traversal vulnerability in the JExtensions JE Section/Property Finder (jesectionfinder) component for Joomla!

38RISK

open ↗

Referência✓ VexDay Proof

Panda Security ActiveScan 2.0 (Update) - Remote Buffer Overflow

CVE-2008-3155—remotewindows

Stack-based buffer overflow in the ActiveX control (as2guiie.dll) in Panda ActiveScan before 1.02.00 allows remote attac

23RISK

open ↗

Referência

CVE-2010-2857

CVE-2010-2857—

Directory traversal vulnerability in the Music Manager component for Joomla! allows remote attackers to read arbitrary f

38RISK

open ↗

Referência

CVE-2010-2857

CVE-2010-2857—

Directory traversal vulnerability in the Music Manager component for Joomla! allows remote attackers to read arbitrary f

38RISK

open ↗

Referência✓ VexDay Proof

CodeDB 1.1.1 - 'list.php' Local File Inclusion

CVE-2008-3190—webappsphp

Directory traversal vulnerability in list.php in 1Scripts CodeDB 1.1.1 allows remote attackers to include and execute ar

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.