Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2012-1029
CVE-2012-1029—
SQL injection vulnerability in mobile/search/index.php in Tube Ace (Adult PHP Tube Script) 1.6 allows remote attackers t
23RISK
open ↗
Referência
CVE-2016-5195
CVE-2016-5195HIGHunder attack
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISK
open ↗
Referência
CVE-2026-16632
CVE-2026-16632MEDIUM
boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation
33RISK
open ↗
Referência
CVE-2009-4617
CVE-2009-4617—
Multiple SQL injection vulnerabilities in Tourism Script Accommodation Hotel Booking Portal Script allow remote attacker
23RISK
open ↗
Referência
CVE-2026-7121
CVE-2026-7121CRITICAL
Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection
48RISK
open ↗
Referência
CVE-2016-20056
CVE-2016-20056HIGH
Spy Emergency build 23.0.205 Unquoted Service Path Privilege Escalation
41RISK
open ↗
Referência
CVE-2017-8740
CVE-2017-8740—
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current u
45RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke 8.0 Final - 'sid' SQL Injection
CVE-2008-0461—webappsphp
SQL injection vulnerability in index.php in the Search module in PHP-Nuke 8.0 FINAL and earlier, when magic_quotes_gpc i
23RISK
open ↗
Referência✓ VexDay Proof
Tiger PHP News System 1.0b build 39 - SQL Injection
CVE-2008-0469—webappsphp
SQL injection vulnerability in index.php in Tiger Php News System (TPNS) 1.0b and earlier allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Web Wiz Rich Text Editor 4.0 - Multiple Vulnerabilities
CVE-2008-0473—webappsasp
RTE_popup_save_file.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to upload (1) .html and (2) .htm files v
23RISK
open ↗
Referência
CVE-2026-14943
CVE-2026-14943HIGH
Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API
41RISK
open ↗
Referência
CVE-2026-16954
CVE-2026-16954MEDIUM
AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens
33RISK
open ↗
Referência
CVE-2009-4756
CVE-2009-4756—
Stack-based buffer overflow in TraktorBeatport.exe 1.0.0.283 in Beatport Player 1.0.0.0 allows remote attackers to execu
23RISK
open ↗
Referência
CVE-2010-4849
CVE-2010-4849—
SQL injection vulnerability in countrydetails.php in Alibaba Clone B2B 3.4 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2026-6993
CVE-2026-6993MEDIUM
go-kratos http.DefaultServeMux Fallback server.go NewServer confused deputy
33RISK
open ↗
Referência
CVE-2026-6992
CVE-2026-6992HIGH
Linksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injection
41RISK
open ↗
Referência
CVE-2010-4850
CVE-2010-4850—
Multiple cross-site scripting (XSS) vulnerabilities in Diferior 8.03 allow remote attackers to inject arbitrary web scri
23RISK
open ↗
Referência
CVE-2010-4850
CVE-2010-4850—
Multiple cross-site scripting (XSS) vulnerabilities in Diferior 8.03 allow remote attackers to inject arbitrary web scri
23RISK
open ↗
Referência
CVE-2012-1203
CVE-2012-1203—
Cross-site request forgery (CSRF) vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attacker
23RISK
open ↗
Referência
CVE-2026-9393
CVE-2026-9393HIGH
H3C Magic B0 aspForm Edit_BasicSSID_5G buffer overflow
41RISK
open ↗
Referência✓ VexDay Proof
Bubbling Library 1.32 - Multiple Local File Inclusions
CVE-2008-0545—webappsphp
Multiple directory traversal vulnerabilities in Bubbling Library 1.32 allow remote attackers to include and execute arbi
23RISK
open ↗
Referência
CVE-2018-12114
CVE-2018-12114—
Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.
23RISK
open ↗
Referência✓ VexDay Proof
CandyPress eCommerce suite 4.1.1.26 - Multiple Vulnerabilities
CVE-2008-0546—webappsasp
Multiple SQL injection vulnerabilities in CandyPress (CP) 4.1.1.26, and earlier 4.1.x versions, allow remote attackers t
23RISK
open ↗
Referência
CVE-2018-12326
CVE-2018-12326—
Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution
23RISK
open ↗
Referência✓ VexDay Proof
ExoPHPDesk 1.2 Final - Authentication Bypass
CVE-2008-6917—webappsphp
SQL injection vulnerability in admin.php in Exocrew ExoPHPDesk 1.2 Final allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2026-63094
CVE-2026-63094HIGH
SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft
41RISK
open ↗
Referência
CVE-2014-1202
CVE-2014-1202—
The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a c
23RISK
open ↗
Referência
CVE-2010-4870
CVE-2010-4870—
SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2009-4832
CVE-2009-4832—
The dlpcrypt.sys kernel driver 0.1.1.27 in DESlock+ 4.0.2 allows local users to gain privileges via a crafted IOCTL 0x80
23RISK
open ↗
Referência
CVE-2010-4870
CVE-2010-4870—
SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
← previouspage 476 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.