Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,165cataloged exploits
40,552CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,077VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow
CVE-2008-3360—remotewindows
Stack-based buffer overflow in the HTML parser in IntelliTamper 2.0.7 allows remote attackers to execute arbitrary code
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Ice Gallery 0.5b2 - 'catid' Blind SQL Injection
CVE-2008-6852—webappsphp
SQL injection vulnerability in the Ice Gallery (com_ice) component 0.5 beta 2 for Joomla! allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
CMS NetCat 3.0/3.12 - Blind SQL Injection
CVE-2008-6853—webappsphp
SQL injection vulnerability in modules/poll/index.php in AIST NetCat 3.0 and 3.12 allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Absolute FAQ Manager 6.0 - Insecure Cookie Handling
CVE-2008-6854—webappsphp
Xigla Software Absolute FAQ Manager.NET 6.0 allows remote attackers to bypass authentication and gain administrative acc
23RISK
open ↗
Referência✓ VexDay Proof
Absolute News Feed 1.0 - Remote Insecure Cookie Handling
CVE-2008-6855—webappsphp
Xigla Software Absolute News Feed 1.0 and possibly 1.5 allows remote attackers to bypass authentication and gain adminis
23RISK
open ↗
Referência✓ VexDay Proof
Absolute Content Rotator 6.0 - Insecure Cookie Handling
CVE-2008-6862—webappsphp
Absolute Content Rotator 6.0 allows remote attackers to bypass authentication and gain administrative access by setting
23RISK
open ↗
Referência
CVE-2013-2586
CVE-2013-2586—
XAMPP 1.8.1 does not properly restrict access to xampp/lang.php, which allows remote attackers to modify xampp/lang.tmp
23RISK
open ↗
Referência
CVE-2014-9142
CVE-2014-9142—
Cross-site scripting (XSS) vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers t
23RISK
open ↗
Referência
CVE-2009-3180
CVE-2009-3180—
Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users via a modified user param
23RISK
open ↗
Referência
CVE-2014-9144
CVE-2014-9144—
Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to execute arbitrary commands via shell metac
23RISK
open ↗
Referência✓ VexDay Proof
Collabtive 0.4.8 - Cross-Site Scripting / Authentication Bypass / Arbitrary File Upload
CVE-2008-6947—webappsphp
Collabtive 0.4.8 allows remote attackers to bypass authentication and create new users, including administrators, via un
23RISK
open ↗
Referência
CVE-2009-4785
CVE-2009-4785—
SQL injection vulnerability in the Quick News (com_quicknews) component for Joomla! allows remote attackers to execute a
23RISK
open ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHunder attack
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗
Referência
CVE-2026-61517
CVE-2026-61517HIGH
Netis NX10 OS Command Injection via Ping Diagnostic Handler
41RISK
open ↗
Referência
CVE-2026-7292
CVE-2026-7292MEDIUM
o2oa NodeAgent NodeAgent.java syncFile improper authorization
33RISK
open ↗
Referência
CVE-2026-7290
CVE-2026-7290MEDIUM
JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection
33RISK
open ↗
Referência
CVE-2026-7289
CVE-2026-7289HIGH
D-Link DIR-825M formWanConfigSetup sub_414BA8 buffer overflow
41RISK
open ↗
Referência
CVE-2022-35405
CVE-2022-35405CRITICALunder attack
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code
100RISK
open ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHunder attack
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗
Referência
CVE-2014-9613
CVE-2014-9613—
Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência
CVE-2026-84425
CVE-2026-84425MEDIUM
zhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of service
33RISK
open ↗
Referência
CVE-2026-61516
CVE-2026-61516CRITICAL
Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint
48RISK
open ↗
Referência✓ VexDay Proof
Collabtive 0.4.8 - Cross-Site Scripting / Authentication Bypass / Arbitrary File Upload
CVE-2008-6948—webappsphp
Unrestricted file upload vulnerability in Collabtive 0.4.8 allows remote authenticated users to execute arbitrary code b
23RISK
open ↗
Referência
CVE-2026-7288
CVE-2026-7288HIGH
D-Link DIR-825M formVpnConfigSetup sub_4151FC buffer overflow
41RISK
open ↗
Referência
CVE-2026-7283
CVE-2026-7283MEDIUM
SourceCodester Pharmacy Sales and Inventory System ajax.php save_expired sql injection
33RISK
open ↗
Referência
CVE-2026-27760
CVE-2026-27760CRITICAL
OpenCATS PHP Code Injection via installer AJAX endpoint
75RISK
open ↗
Referência
CVE-2026-7282
CVE-2026-7282MEDIUM
SourceCodester Pharmacy Sales and Inventory System ajax.php delete_expired sql injection
33RISK
open ↗
Referência
CVE-2026-7281
CVE-2026-7281MEDIUM
SourceCodester Pharmacy Sales and Inventory System index.php supplier cross site scripting
33RISK
open ↗
Referência
CVE-2026-7272
CVE-2026-7272MEDIUM
WilliamCloudQi matlab-mcp-server MCP index.ts execute_matlab_code path traversal
33RISK
open ↗
Referência
CVE-2026-7271
CVE-2026-7271MEDIUM
DV0x creative-ad-agent creative-ad-agent-server sdk-server.ts path traversal
33RISK
open ↗
← previouspage 431 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.