Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
Pro Chat Rooms 3.0.3 - SQL Injection
CVE-2008-5070—webappsphp
SQL injection vulnerability in Pro Chat Rooms 3.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
Pixie CMS - Cross-Site Scripting / SQL Injection
CVE-2009-1067—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Pixie CMS 1.01a allows remote attackers to inject arbitrary web
23RISK
open ↗
Referência✓ VexDay Proof
Mozilla Firefox XSL - Parsing Remote Memory Corruption (PoC) (1)
CVE-2009-1169—dosmultiple
The txMozillaXSLTProcessor::TransformToDoc function in Mozilla Firefox before 3.0.8 and SeaMonkey before 1.1.16 allows r
28RISK
open ↗
Referência
CVE-2014-4613
CVE-2014-4613—
Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attacke
23RISK
open ↗
Referência
CVE-2014-4663
CVE-2014-4663—
TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2015-6519
CVE-2015-6519—
SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail
23RISK
open ↗
Referência
CVE-2015-6545
CVE-2015-6545—
Cross-site request forgery (CSRF) vulnerability in ajax.php in Cerb before 7.0.4 allows remote attackers to hijack the a
23RISK
open ↗
Referência
CVE-2022-30076
CVE-2022-30076MEDIUM
ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames
33RISK
open ↗
Referência✓ VexDay Proof
Libxine 1.14 - MPEG Stream Buffer Overflow (PoC)
CVE-2008-1110—doslinux
Buffer overflow in demuxers/demux_asf.c (aka the ASF demuxer) in the xineplug_dmx_asf.so plugin in xine-lib before 1.1.1
28RISK
open ↗
Referência
CVE-2026-69112
CVE-2026-69112MEDIUM
Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map
33RISK
open ↗
Referência✓ VexDay Proof
Lansuite 2.1.0 Beta - 'fid' SQL Injection
CVE-2006-1001—webappsphp
SQL injection vulnerability in the board module in LanSuite LanParty Intranet System 2.0.6 and 2.1.0 beta allows remote
23RISK
open ↗
Referência
CVE-2026-14332
CVE-2026-14332MEDIUM
Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' Action
33RISK
open ↗
Referência
CVE-2026-18391
CVE-2026-18391CRITICAL
WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection
48RISK
open ↗
Referência
CVE-2026-71966
CVE-2026-71966HIGH
CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer
41RISK
open ↗
Referência
CVE-2026-19088
CVE-2026-19088MEDIUM
ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication
33RISK
open ↗
Referência
CVE-2026-73482
CVE-2026-73482HIGH
phpList < 3.7.0-RC5 Cross-Site Request Forgery via admins.php
41RISK
open ↗
Referência
CVE-2024-58374
CVE-2024-58374HIGH
Hongjing e-HR Unauthenticated SQL Injection via getSdutyTree
41RISK
open ↗
Referência✓ VexDay Proof
Apple Mac OSX xnu 1228.x - 'vfssysctl' Local Kernel Denial of Service (PoC)
CVE-2009-1238—dososx
Race condition in the HFS vfs sysctl interface in XNU 1228.8.20 and earlier on Apple Mac OS X 10.5.6 and earlier allows
23RISK
open ↗
Referência
CVE-2026-18366
CVE-2026-18366CRITICAL
Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator
48RISK
open ↗
Referência
CVE-2026-18945
CVE-2026-18945HIGH
WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation
41RISK
open ↗
Referência
CVE-2026-14213
CVE-2026-14213LOW
Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR
28RISK
open ↗
Referência
CVE-2026-18230
CVE-2026-18230HIGH
WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter
41RISK
open ↗
Referência
CVE-2026-71965
CVE-2026-71965HIGH
CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature
41RISK
open ↗
Referência
CVE-2026-71964
CVE-2026-71964HIGH
CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload
41RISK
open ↗
Referência
CVE-2026-71962
CVE-2026-71962HIGH
Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download
41RISK
open ↗
Referência
CVE-2014-9101
CVE-2014-9101—
Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall 1.7.0 (build 7907 and 7906) and SkaDate Lite 2.0 (b
23RISK
open ↗
Referência✓ VexDay Proof
pSys 0.7.0.a - 'shownews' SQL Injection
CVE-2008-5269—webappsphp
SQL injection vulnerability in index.php in pSys 0.7.0 alpha allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
FlexCMS Calendar - 'itemID' Blind SQL Injection
CVE-2009-1256—webappsphp
SQL injection vulnerability in FlexCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the ItemId para
23RISK
open ↗
Referência
CVE-2016-5845
CVE-2016-5845—
SAP SAPCAR does not check the return value of file operations when extracting files, which allows remote attackers to ca
23RISK
open ↗
Referência
CVE-2014-9113
CVE-2014-9113—
CCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engagement) 7.1 and earlier uses weak permissions (Authenticated Use
23RISK
open ↗
← previouspage 401 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.