Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,105cataloged exploits
40,548CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,065VulnCheck XDB 10,121Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2026-112093
CVE-2026-112093MEDIUM
subhajitkhan online-clinic-management-system feedback.php cross site scripting
33RISK
open ↗
Referência
CVE-2022-44877
CVE-2022-44877CRITICALunder attack
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execut
100RISK
open ↗
Referência✓ VexDay Proof
XnView 1.93.6 - '.taac' Local Buffer Overflow
CVE-2008-2427—localwindows
Stack-based buffer overflow in NConvert 4.92, GFL SDK 2.82, and XnView 1.93.6 on Windows and 1.70 on Linux and FreeBSD a
28RISK
open ↗
Referência✓ VexDay Proof
DELTAScripts PHP Classifieds 7.5 - SQL Injection
CVE-2008-5805—webappsphp
SQL injection vulnerability in detail.php in DeltaScripts PHP Classifieds 7.5 and earlier allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Grabit 1.7.2 Beta 3 - '.nzb' Local Buffer Overflow (SEH)
CVE-2009-1586—localwindows
Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2017-17596
CVE-2017-17596—
Entrepreneur Job Portal Script 2.0.6 has SQL Injection via the jobsearch_all.php rid1 parameter.
23RISK
open ↗
Referência
CVE-2026-103376
CVE-2026-103376MEDIUM
PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check
33RISK
open ↗
Referência
CVE-2022-4681
CVE-2022-4681CRITICAL
Hide My WP < 6.2.9 - Unauthenticated SQLi
48RISK
open ↗
Referência✓ VexDay Proof
WMNews 0.2a - 'base_datapath' Remote File Inclusion
CVE-2006-3928—webappsphp
PHP remote file inclusion vulnerability in index.php in WMNews 0.2a and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência
CVE-2022-47870
CVE-2022-47870MEDIUM
A Cross Site Scripting (XSS) vulnerability in the web SQL monitor login page in Redgate SQL Monitor 12.1.31.893 allows r
33RISK
open ↗
Referência
CVE-2026-112020
CVE-2026-112020MEDIUM
LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()
33RISK
open ↗
Referência✓ VexDay Proof
Kayako eSupport 2.3.1 - 'subd' Remote File Inclusion
CVE-2006-4011—webappsphp
PHP remote file inclusion vulnerability in esupport/admin/autoclose.php in Kayako eSupport 2.3.1 and earlier, when regis
23RISK
open ↗
Referência
CVE-2026-95182
CVE-2026-95182CRITICAL
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supply
48RISK
open ↗
Referência
CVE-2026-111284
CVE-2026-111284MEDIUM
Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
33RISK
open ↗
Referência
CVE-2022-4944
CVE-2022-4944MEDIUM
kalcaddle KodExplorer cross-site request forgery
33RISK
open ↗
Referência
CVE-2022-4953
CVE-2022-4953—
Elementor < 3.5.5 - Iframe Injection
23RISK
open ↗
Referência
CVE-2026-111993
CVE-2026-111993MEDIUM
Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage
33RISK
open ↗
Referência
CVE-2026-111992
CVE-2026-111992MEDIUM
itsmeravitejak Online-Examination-System Exam exam.php startExam sql injection
33RISK
open ↗
Referência✓ VexDay Proof
NEWSolved Lite 1.9.2 - 'abs_path' Remote File Inclusion
CVE-2006-4059—webappsphp
Multiple PHP remote file inclusion vulnerabilities in USOLVED NEWSolved Lite 1.9.2, and possibly earlier, allow remote a
28RISK
open ↗
Referência✓ VexDay Proof
Microsoft Works 7 - 'WkImgSrv.dll' ActiveX Remote Buffer Overflow
CVE-2008-1898—remotewindows
A certain ActiveX control in WkImgSrv.dll 7.03.0616.0, as distributed in Microsoft Works 7 and Microsoft Office 2003 and
50RISK
open ↗
Referência
CVE-2012-2572
CVE-2012-2572—
Cross-site scripting (XSS) vulnerability in the ThreeWP Email Reflector plugin before 1.16 for WordPress allows remote a
23RISK
open ↗
Referência✓ VexDay Proof
LaserNet CMS 1.5 - SQL Injection
CVE-2008-1913—webappsphp
SQL injection vulnerability in index.php in Lasernet CMS 1.5 and 1.11, when magic_quotes_gpc is disabled, allows remote
23RISK
open ↗
Referência✓ VexDay Proof
C6 Messenger - ActiveX Remote Download and Execute
CVE-2008-2551—remotewindows
The DownloaderActiveX Control (DownloaderActiveX.ocx) in Icona SpA C6 Messenger 1.0.0.1 allows remote attackers to force
50RISK
open ↗
Referência✓ VexDay Proof
Java SE Runtime Environment JRE 6 Update 13 - Multiple Vulnerabilities
CVE-2009-1672—doswindows
The Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 1
23RISK
open ↗
Referência✓ VexDay Proof
32bit FTP - 'PASV' Reply Client Remote Overflow (Metasploit)
CVE-2009-1675—remotewindows_x86
Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a
43RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_gsticketsystem - 'catid' Blind SQL Injection
CVE-2009-1736—webappsphp
SQL injection vulnerability in the GridSupport (GS) Ticket System (com_gsticketsystem) component for Joomla! allows remo
23RISK
open ↗
Referência✓ VexDay Proof
Catviz 0.4.0 beta1 - Local File Inclusion / Cross-Site Scripting
CVE-2009-1749—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Catviz 0.4.0 beta 1 allow remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
Realty Web-Base 1.0 - 'list_list.php?id' SQL Injection
CVE-2009-1751—webappsphp
SQL injection vulnerability in list_list.php in Realty Webware Technologies Web-Base 1.0 allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2017-17603
CVE-2017-17603—
Advanced Real Estate Script 4.0.7 has SQL Injection via the search-results.php Projectmain, proj_type, searchtext, sell_
23RISK
open ↗
Referência
CVE-2017-17605
CVE-2017-17605—
Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter.
23RISK
open ↗
← previouspage 422 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.