Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,112cataloged exploits

40,548CVEs with public exploitation

24,696lab-tested

All Referência 26,327Exploit-DB 24,488GitHub PoC 18,072VulnCheck XDB 10,121Nuclei 4,567Metasploit 3,537✓ verified onlyrecent popular risk

26,240 exploits

Referência

CVE-2015-8285

CVE-2015-8285—

The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service.

23RISK

open ↗

Referência

CVE-2010-5280

CVE-2010-5280—

Directory traversal vulnerability in the Community Builder Enhanced (CBE) (com_cbe) component 1.4.8, 1.4.9, and 1.4.10 f

23RISK

open ↗

Referência

CVE-2016-1743

CVE-2016-1743—

The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary co

23RISK

open ↗

Referência

CVE-2017-15221

CVE-2017-15221—

ASX to MP3 converter 3.1.3.7.2010.11.05 has a buffer overflow via a crafted M3U file, a related issue to CVE-2009-1324.

23RISK

open ↗

Referência

CVE-2026-16281

CVE-2026-16281HIGH

Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR

41RISK

open ↗

Referência

CVE-2026-89236

CVE-2026-89236HIGH

SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Parameters

41RISK

open ↗

Referência

CVE-2019-25706

CVE-2019-25706HIGH

Across DR-810 ROM-0 Unauthenticated File Disclosure

41RISK

open ↗

Referência

CVE-2026-80518

CVE-2026-80518LOW

WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path

28RISK

open ↗

Referência

CVE-2017-15221

CVE-2017-15221—

ASX to MP3 converter 3.1.3.7.2010.11.05 has a buffer overflow via a crafted M3U file, a related issue to CVE-2009-1324.

23RISK

open ↗

Referência✓ VexDay Proof

Really Simple PHP and Ajax (RSPA) 2007-03-23 - Remote File Inclusion

CVE-2007-1982—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Really Simple PHP and Ajax (RSPA) 2007-03-23 and earlier allow rem

23RISK

open ↗

Referência

CVE-2010-5280

CVE-2010-5280—

Directory traversal vulnerability in the Community Builder Enhanced (CBE) (com_cbe) component 1.4.8, 1.4.9, and 1.4.10 f

23RISK

open ↗

Referência✓ VexDay Proof

Yahoo! Music Jukebox 2.2 - 'AddImage()' ActiveX Remote Buffer Overflow (PoC)

CVE-2008-0623—doswindows

Stack-based buffer overflow in the YMP Datagrid ActiveX control (datagrid.dll) in Yahoo! Music Jukebox 2.2.2.056 allows

23RISK

open ↗

Referência✓ VexDay Proof

CMS MAXSITE 1.10 - 'category' SQL Injection

CVE-2008-2487—webappsphp

SQL injection vulnerability in index.php in MAXSITE 1.10 and earlier allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

Flux CMS 1.5.0 - 'loadsave.php' Arbitrary File Overwrite

CVE-2008-2686—webappsphp

webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overw

23RISK

open ↗

Referência

CVE-2010-1495

CVE-2010-1495—

Directory traversal vulnerability in the Matamko (com_matamko) component 1.01 for Joomla! allows remote attackers to rea

43RISK

open ↗

Referência

CVE-2010-0632

CVE-2010-0632—

SQL injection vulnerability in the Parkview Consultants SimpleFAQ (com_simplefaq) component for Joomla! allows remote at

23RISK

open ↗

Referência

CVE-2014-0866

CVE-2014-0866—

RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics sends cleartext c

23RISK

open ↗

Referência

CVE-2014-8391

CVE-2014-8391—

The Web interface in Sendio before 7.2.4 does not properly handle sessions, which allows remote authenticated users to o

23RISK

open ↗

Referência

CVE-2026-101141

CVE-2026-101141MEDIUM

Eleveo Call Recording Software Play Audio audio.jsp cross site scripting

33RISK

open ↗

Referência

CVE-2006-1595

CVE-2006-1595—

Cross-site scripting (XSS) vulnerability in document/rqmkhtml.php in Claroline 1.7.4 and earlier allows remote attackers

23RISK

open ↗

Referência

CVE-2013-6627

CVE-2013-6627—

net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process HTTP Informational (aka 1x

23RISK

open ↗

Referência

CVE-2018-10969

CVE-2018-10969—

SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute ar

23RISK

open ↗

Referência

CVE-2014-3110

CVE-2014-3110—

Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earli

23RISK

open ↗

Referência

CVE-2014-1635

CVE-2014-1635—

Buffer overflow in login.cgi in MiniHttpd in Belkin N750 Router with firmware before F9K1103_WW_1.10.17m allows remote a

50RISK

open ↗

Referência

CVE-2014-4170

CVE-2014-4170—

A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restric

28RISK

open ↗

Referência

CVE-2015-6970

CVE-2015-6970—

The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows r

23RISK

open ↗

Referência

CVE-2017-15662

CVE-2017-15662—

In Flexense VX Search Enterprise v10.1.12, the Control Protocol suffers from a denial of service vulnerability. The atta

23RISK

open ↗

Referência✓ VexDay Proof

VCDGear 3.56 Build 050213 - 'FILE' Local Code Execution

CVE-2007-2062—localwindows

Stack-based buffer overflow in VCDGear 3.55 and 3.56 BETA allows user-assisted remote attackers to execute arbitrary cod

23RISK

open ↗

Referência

CVE-2017-3622

CVE-2017-3622—

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Common Desktop Environment (C

38RISK

open ↗

Referência

CVE-2010-4280

CVE-2010-4280—

Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.