Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,166cataloged exploits

40,553CVEs with public exploitation

24,696lab-tested

All Referência 26,327Exploit-DB 24,488GitHub PoC 18,078VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecent popular risk

26,240 exploits

Referência

CVE-2026-91781

CVE-2026-91781MEDIUM

GNU Binutils ELF Section elf64-x86-64.c elf_x86_64_common_section_index null pointer dereference

33RISK

open ↗

Referência

CVE-2012-6038

CVE-2012-6038—

admin/core/admin_func.php in razorCMS before 1.2.1 does not properly restrict access to certain administrator directorie

23RISK

open ↗

Referência

CVE-2019-10716

CVE-2019-10716—

An Information Disclosure issue in Verodin Director 3.5.3.1 and earlier reveals usernames and passwords of integrated se

23RISK

open ↗

Referência

CVE-2014-2022

CVE-2014-2022—

SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier a

23RISK

open ↗

Referência✓ VexDay Proof

Company WebSite Builder PRO 1.9.8 - 'INCLUDE_PATH' Remote File Inclusion

CVE-2007-1513—webappsphp

PHP remote file inclusion vulnerability in comanda.php in GraFX Company WebSite Builder (CWB) PRO 1.9.8, when register_g

23RISK

open ↗

Referência✓ VexDay Proof

RunCMS 1.6 - Multiple Vulnerabilities

CVE-2007-6546—webappsphp

RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a m

23RISK

open ↗

Referência

CVE-2025-34054

CVE-2025-34054CRITICAL

AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection

48RISK

open ↗

Referência

CVE-2025-34054

CVE-2025-34054CRITICAL

AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection

48RISK

open ↗

Referência

CVE-2026-91780

CVE-2026-91780MEDIUM

GNU Binutils elflink.c elf_link_add_object_symbols null pointer dereference

33RISK

open ↗

Referência

CVE-2015-7252

CVE-2015-7252—

Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_

23RISK

open ↗

Referência

CVE-2010-4313

CVE-2010-4313—

Unrestricted file upload vulnerability in fileman_file_upload.php in Orbis CMS 1.0.2 allows remote authenticated users t

23RISK

open ↗

Referência✓ VexDay Proof

AlkalinePHP 0.77.35 - 'adduser.php' Arbitrary Add Admin

CVE-2008-2346—webappsphp

AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creat

23RISK

open ↗

Referência✓ VexDay Proof

Tlnews 2.2 - Insecure Cookie Handling

CVE-2008-4752—webappsphp

TlNews 2.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlNews_login c

23RISK

open ↗

Referência✓ VexDay Proof

team 1.x - File Disclosure / Cross-Site Scripting

CVE-2009-0760—webappsasp

Team Board 1.x and 2.x stores sensitive information under the web root with insufficient access control, which allows re

23RISK

open ↗

Referência

CVE-2010-0690

CVE-2010-0690—

SQL injection vulnerability in index.php in CommodityRentals Video Games Rentals allows remote attackers to execute arbi

23RISK

open ↗

Referência

CVE-2015-5452

CVE-2015-5452—

SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr

23RISK

open ↗

Referência

CVE-2016-3313

CVE-2016-3313—

Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016, Word 2016 for Mac, and Word Viewer allow remote at

35RISK

open ↗

Referência

CVE-2018-5978

CVE-2018-5978—

SQL Injection exists in Facebook Style Php Ajax Chat Zechat 1.5 via the login.php User field.

23RISK

open ↗

Referência

CVE-2018-6395

CVE-2018-6395—

SQL Injection exists in the Visual Calendar 3.1.3 component for Joomla! via the id parameter in a view=load action.

23RISK

open ↗

Referência

CVE-2018-8584

CVE-2018-8584—

An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (A

23RISK

open ↗

Referência

CVE-2026-91091

CVE-2026-91091MEDIUM

GPAC Node Insertion base_scenegraph.c gf_node_list_insert_child memory corruption

33RISK

open ↗

Referência✓ VexDay Proof

phpWebSite 0.10.0-full - 'topics.php' SQL Injection

CVE-2006-0973—webappsphp

SQL injection vulnerability in topics.php in Appalachian State University phpWebSite 0.10.2 and earlier allows remote at

23RISK

open ↗

Referência✓ VexDay Proof

OPT Max 1.2.0 - 'CRM_inc' Remote File Inclusion

CVE-2006-4239—webappsphp

PHP remote file inclusion vulnerability in include/urights.php in Outreach Project Tool (OPT) Max 1.2.6 and earlier allo

23RISK

open ↗

Referência

CVE-2026-65920

CVE-2026-65920MEDIUM

Diffusers Path Traversal via weight_map Arbitrary File Read

33RISK

open ↗

Referência

CVE-2026-65918

CVE-2026-65918HIGH

PyTorch torchvision GIF Decoder Out-of-bounds Heap Read

41RISK

open ↗

Referência✓ VexDay Proof

phpFullAnnu 5.1 - 'repmod' Remote File Inclusion

CVE-2006-4644—webappsphp

PHP remote file inclusion vulnerability in modules/home.module.php in phpFullAnnu 5.1 and earlier allows remote attacker

23RISK

open ↗

Referência

CVE-2010-1477

CVE-2010-1477—

SQL injection vulnerability in the SermonSpeaker (com_sermonspeaker) component before 3.2.1 for Joomla! allows remote at

23RISK

open ↗

Referência

CVE-2012-5919

CVE-2012-5919—

Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit

23RISK

open ↗

Referência

CVE-2015-5453

CVE-2015-5453—

Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell

50RISK

open ↗

Referência✓ VexDay Proof

Star FTP Server 1.10 - 'RETR' Remote Denial of Service

CVE-2006-6643—doswindows

Fightersoft Multimedia Star FTP server 1.10 allows remote attackers to cause a denial of service (crash) via multiple RE

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.