Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
SyndeoCMS 2.6.0 - Local File Inclusion / Cross-Site Scripting
CVE-2008-5271—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Fred Stuurman SyndeoCMS 2.6.0 allows remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
Camera Life 2.6.2b4 - SQL Injection / Cross-Site Scripting
CVE-2008-6086—webappsphp
SQL injection vulnerability in album.php in Camera Life 2.6.2b4 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
e107 Plugin Image Gallery 0.9.6.2 - SQL Injection
CVE-2008-6466—webappsphp
SQL injection vulnerability in image_gallery.php in the Akira Powered Image Gallery (image_gallery) plugin 0.9.6.2 for e
23RISK
open ↗
Referência
CVE-2012-4329
CVE-2012-4329—
The Samsung D6000 TV and possibly other products allow remote attackers to cause a denial of service (continuous restart
28RISK
open ↗
Referência
CVE-2018-9059
CVE-2018-9059—
Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code
60RISK
open ↗
Referência
CVE-2018-9059
CVE-2018-9059—
Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code
60RISK
open ↗
Referência
CVE-2018-1000049
CVE-2018-1000049—
Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner
60RISK
open ↗
Referência
Core FTP Server FTP / SFTP Server v2 Build 674 - 'SIZE' Directory Traversal
CVE-2019-9648—doswindows
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exis
28RISK
open ↗
Referência✓ VexDay Proof
LiteNews 0.1 - 'id' SQL Injection
CVE-2008-3507—webappsphp
SQL injection vulnerability in index.php in LiteNews 0.1 (aka 01), and possibly 1.2 and earlier, allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Todd Woolums ASP News Management 2.2 - SQL Injection
CVE-2008-5273—webappsasp
SQL injection vulnerability in viewnews.asp in Todd Woolums ASP News Management 2.2 allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
Drake CMS 0.4.11 - Blind SQL Injection
CVE-2008-6475—webappsphp
SQL injection vulnerability in the guestbook component (components/guestbook/guestbook.php) in Drake CMS 0.4.11 and earl
23RISK
open ↗
Referência
CVE-2009-2567
CVE-2009-2567—
SQL injection vulnerability in the Almond Classifieds (com_aclassf) component 5.6.2 for Joomla! allows remote attackers
23RISK
open ↗
Referência
CVE-2012-4361
CVE-2012-4361—
lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to exe
50RISK
open ↗
Referência
CVE-2016-0709
CVE-2016-0709—
Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3
60RISK
open ↗
Referência
CVE-2017-0290
CVE-2017-0290—
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Serve
45RISK
open ↗
Referência
CVE-2018-1000049
CVE-2018-1000049—
Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner
60RISK
open ↗
Referência
CVE-2019-6282
CVE-2019-6282—
ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpag
23RISK
open ↗
Referência
CVE-2018-15877
CVE-2018-15877—
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell meta
60RISK
open ↗
Referência
CVE-2026-0993
CVE-2026-0993HIGH
SODOLA SL902-SWTGW124AS Buffer Overflow DoS via Multipart Boundary Parser
41RISK
open ↗
Referência
CVE-2018-15877
CVE-2018-15877—
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell meta
60RISK
open ↗
Referência
CVE-2019-6340
CVE-2019-6340HIGHunder attack
Drupal core - Highly critical - Remote Code Execution
100RISK
open ↗
Referência
CVE-2019-9670
CVE-2019-9670CRITICALunder attack
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XX
100RISK
open ↗
Referência✓ VexDay Proof
Libxine 1.14 - MPEG Stream Buffer Overflow (PoC)
CVE-2006-1664—doslinux
Buffer overflow in xine_list_delete_current in libxine 1.14 and earlier, as distributed in xine-lib 1.1.1 and earlier, a
28RISK
open ↗
Referência
CVE-2026-110810
CVE-2026-110810LOW
ggml-org whisper.cpp Model Loader whisper_model_load out-of-bounds
28RISK
open ↗
Referência
CVE-2010-2341
CVE-2010-2341—
PHP remote file inclusion vulnerability in system/application/views/public/commentform.php in EZPX Photoblog 1.2 beta al
23RISK
open ↗
Referência✓ VexDay Proof
Specimen Image Database - 'client.php' Remote File Inclusion
CVE-2006-5419—webappsphp
PHP remote file inclusion vulnerability in client.php in University of Glasgow Specimen Image Database (SID), when regis
23RISK
open ↗
Referência
CVE-2019-9670
CVE-2019-9670CRITICALunder attack
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XX
100RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Rapid Recipe 1.6.6/1.6.7 - SQL Injection
CVE-2008-2697—webappsphp
SQL injection vulnerability in the Rapid Recipe (com_rapidrecipe) component 1.6.6 and 1.6.7 for Joomla! allows remote at
23RISK
open ↗
Referência
CVE-2026-110809
CVE-2026-110809MEDIUM
sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service
33RISK
open ↗
Referência✓ VexDay Proof
BitDefender - Module pdf.xmd Infinite Loop Denial of Service (PoC)
CVE-2008-5409—doswindows
Unspecified vulnerability in the pdf.xmd module in (1) BitDefender Free Edition 10 and Antivirus Standard 10, (2) BullGu
28RISK
open ↗
← previouspage 388 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.