Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
ablespace 1.0 - Cross-Site Scripting / Blind SQL Injection
Multiple cross-site scripting (XSS) vulnerabilities in AbleSpace 1.0 allow remote attackers to inject arbitrary web scri
23RISK
open ↗Referência
CVE-2010-1476
Directory traversal vulnerability in the AlphaUserPoints (com_alphauserpoints) component 1.5.5 for Joomla! allows remote
38RISK
open ↗Referência
CVE-2010-5008
SQL injection vulnerability in pages/contact_list_mail_form.asp in BrightSuite Groupware 5.4 allows remote attackers to
23RISK
open ↗Referência
CVE-2018-7737
In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.ph
23RISK
open ↗Referência
CVE-2014-3225
Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated us
23RISK
open ↗Referência
CVE-2024-51978
Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc.
68RISK
open ↗Referência
CVE-2024-51978
Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc.
68RISK
open ↗Referência
CVE-2024-51978
Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc.
68RISK
open ↗Referência
CVE-2016-4656
The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denia
91RISK
open ↗Referência
CVE-2010-0718
Buffer overflow in Microsoft Windows Media Player 9 and 11.0.5721.5145 allows remote attackers to cause a denial of serv
23RISK
open ↗Referência
CVE-2017-17111
Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-detail
23RISK
open ↗Referência
CVE-2018-7737
In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.ph
23RISK
open ↗Referência
ScreenStream 3.0.15 - Denial of Service
The Screen Stream application through 3.0.15 for Android allows remote attackers to cause a denial of service via many s
28RISK
open ↗Referência
CVE-2010-1604
Multiple SQL injection vulnerabilities in admin_login.php in NCT Jobs Portal Script allow remote attackers to execute ar
23RISK
open ↗Referência
CVE-2020-8615
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves a
43RISK
open ↗Referência
CVE-2006-3144
PHP remote file inclusion vulnerability in micro_cms_files/microcms-include.php in Implied By Design (IBD) Micro CMS 3.5
23RISK
open ↗Referência✓ VexDay Proof
PHPMyCMS 0.3 - 'basic.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in basic.inc.php in PhpMyCms 0.3 allows remote attackers to execute arbitrary PH
23RISK
open ↗Referência
CVE-2010-5227
Untrusted search path vulnerability in Opera before 10.62 allows local users to gain privileges via a Trojan horse dwmap
23RISK
open ↗Referência
CVE-2015-20124
Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php
41RISK
open ↗Referência
CVE-2009-2534
RealNetworks Helix Server and Helix Mobile Server before 13.0.0 allow remote attackers to cause a denial of service (dae
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component JContentSubscription 1.5.8 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in the JContentSubscription (com_jcs) 1.5.8 component for Joomla! all
35RISK
open ↗Referência
CVE-2009-4992
SQL injection vulnerability in paidbanner.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbitrary S
23RISK
open ↗Referência
CVE-2015-20123
Aspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download.php
41RISK
open ↗Referência
CVE-2026-17457
mf-yang openclaw-cn Scheme navigation-guard.ts assertBrowserNavigationAllowed information disclosure
33RISK
open ↗Referência
CVE-2015-20123
Aspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download.php
41RISK
open ↗Referência
CVE-2014-125134
ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php
41RISK
open ↗Referência✓ VexDay Proof
Mms Gallery PHP 1.0 - 'id' Remote File Disclosure
Multiple directory traversal vulnerabilities in MMS Gallery PHP 1.0 allow remote attackers to read arbitrary files via a
23RISK
open ↗Referência✓ VexDay Proof
phpCMS 1.2.2 - 'file' Remote File Disclosure
Directory traversal vulnerability in parser/include/class.cache_phpcms.php in phpCMS 1.2.2 allows remote attackers to re
23RISK
open ↗Referência✓ VexDay Proof
MailEnable Professional/Enterprise 3.13 - 'Fetch' (Authenticated) Remote Buffer Overflow
Multiple buffer overflows in the IMAP service (MEIMAPS.EXE) in MailEnable Professional Edition and Enterprise Edition 3.
23RISK
open ↗Referência
CVE-2021-26828
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and exe
83RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.