Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,325 exploits
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6497—webappsasp
Hosting Controller 6.1 Hot fix 3.3 and earlier (1) allows remote attackers to change arbitrary user profiles via a reque
23RISK
open ↗
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6498—webappsasp
Multiple SQL injection vulnerabilities in Hosting Controller 6.1 Hot fix 3.3 and earlier allow remote authenticated user
23RISK
open ↗
Referência
CVE-2009-4621
CVE-2009-4621—
SQL injection vulnerability in the JiangHu Inn plugin 1.1 and earlier for Discuz! allows remote attackers to execute arb
23RISK
open ↗
Referência
CVE-2009-3057
CVE-2009-3057—
Multiple cross-site scripting (XSS) vulnerabilities in AOM Software Beex 3 allow remote attackers to inject arbitrary we
23RISK
open ↗
Referência
CVE-2010-4142
CVE-2010-4142—
Multiple stack-based buffer overflows in DATAC RealWin 2.0 Build 6.1.8.10 and earlier allow remote attackers to cause a
50RISK
open ↗
Referência
CVE-2009-4622
CVE-2009-4622—
PHP remote file inclusion vulnerability in admin/admin_news_bot.php in Drunken:Golem Gaming Portal 0.5.1 alpha 2 allows
23RISK
open ↗
Referência
CVE-2007-6515
CVE-2007-6515—
support/dispatch.cgi in SiteScape Forum allows remote attackers to execute arbitrary TCL code via code separator charact
23RISK
open ↗
Referência
CVE-2009-3119
CVE-2009-3119—
SQL injection vulnerability in screen.php in the Download System mSF (dsmsf) module for PHP-Fusion allows remote attacke
23RISK
open ↗
Referência
TikiWiki Project < 1.9.9 - 'tiki-listmovies.php' Directory Traversal
CVE-2007-6528—webappsphp
Directory traversal vulnerability in tiki-listmovies.php in TikiWiki before 1.9.9 allows remote attackers to read arbitr
23RISK
open ↗
Referência
CVE-2016-3081
CVE-2016-3081HIGHunder attack
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, a
100RISK
open ↗
Referência
CVE-2017-9756
CVE-2017-9756—
The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a d
23RISK
open ↗
Referência
CVE-2017-9811
CVE-2017-9811—
The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maint
28RISK
open ↗
Referência
CVE-2010-3458
CVE-2010-3458—
SQL injection vulnerability in lib/toolkit/events/event.section.php in Symphony CMS 2.0.7 and 2.1.1 allows remote attack
23RISK
open ↗
Referência
CVE-2021-47926
CVE-2021-47926MEDIUM
WordPress Contact Form to Email 1.3.24 Stored XSS
33RISK
open ↗
Referência
CVE-2021-47925
CVE-2021-47925MEDIUM
CMDBuild 3.3.2 Multiple Stored Cross-Site Scripting
33RISK
open ↗
Referência
CVE-2021-47924
CVE-2021-47924MEDIUM
WordPress Plugin Ultimate Product Catalogue 5.8.2 Stored XSS via price
33RISK
open ↗
Referência
CVE-2026-16605
CVE-2026-16605HIGH
MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization
41RISK
open ↗
Referência
CVE-2018-0492
CVE-2018-0492—
Johnathan Nightingale beep through 1.3.4, if setuid, has a race condition that allows local privilege escalation.
23RISK
open ↗
Referência
CVE-2018-0706
CVE-2018-0706—
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticate
50RISK
open ↗
Referência
CVE-2026-18901
CVE-2026-18901HIGH
H3C NX15 Web API esps service.add routine
41RISK
open ↗
Referência✓ VexDay Proof
Mihalism Multi Host 2.0.7 - 'download.php' Remote File Disclosure
CVE-2007-6653—webappsphp
Directory traversal vulnerability in download.php in Mihalism Multi Host 2.0.7 allows remote attackers to read arbitrary
23RISK
open ↗
Referência
CVE-2009-4756
CVE-2009-4756—
Stack-based buffer overflow in TraktorBeatport.exe 1.0.0.283 in Beatport Player 1.0.0.0 allows remote attackers to execu
23RISK
open ↗
Referência
CVE-2026-9517
CVE-2026-9517MEDIUM
hemant6488 CodeIgniter-StudentManagementSystem Student Management addStudentView access control
33RISK
open ↗
Referência
CVE-2010-3458
CVE-2010-3458—
SQL injection vulnerability in lib/toolkit/events/event.section.php in Symphony CMS 2.0.7 and 2.1.1 allows remote attack
23RISK
open ↗
Referência
CVE-2011-5040
CVE-2011-5040—
Multiple cross-site scripting (XSS) vulnerabilities in Infoproject Biznis Heroj allow remote attackers to inject arbitra
23RISK
open ↗
Referência
CVE-2010-4982
CVE-2010-4982—
SQL injection vulnerability in address_book/contacts.php in My Kazaam Address & Contact Organizer allows remote attacker
23RISK
open ↗
Referência
CVE-2026-86292
CVE-2026-86292MEDIUM
SourceCodester Simple Traffic Offense System User Creation saveuser.php missing authentication
33RISK
open ↗
Referência
CVE-2018-25324
CVE-2018-25324MEDIUM
Simple Fields 0.2-0.3.5 Local File Inclusion via wp_abspath
33RISK
open ↗
Referência
CVE-2026-67608
CVE-2026-67608HIGH
Telenia TVox 26.5.3 OS Command Injection via action_audio.php
41RISK
open ↗
Referência
CVE-2026-16263
CVE-2026-16263HIGH
WP Maps < 4.9.7 - Subscriber+ Local File Inclusion
41RISK
open ↗
← previouspage 478 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.